> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # U.K. Sanctions Cryptomus for RU Money Laundering - URL: https://f4n6.co.uk/security-feed/u-k-sanctions-cryptomus-for-ru-money-laundering/ - Published: 2026-10-14T17:51:48.000Z - Updated: 2026-10-14T17:51:48.000Z - Author: Jeff Davies - Tags: #security-feed, Cryptomus, Heleket, VexPay, TokenSpot, Tsunami Payments ## 1\. Executive summary On 8 October 2026 the United Kingdom sanctioned Cryptomus (formerly Certa Payments, formerly Xeltox Enterprises, now also operating as Heleket) for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze Cryptomus assets held at U.K. banks and bar British companies from doing any business with the platform, virtual or otherwise. VexPay, TokenSpot and Tsunami Payments were designated in the same action. Chainalysis reports that Cryptomus and Heleket together received more illicit funds across tracked categories than the mixers in its dataset, with illicit counterparties exceeding 900 in a single month in late 2025, and TRM Labs put Cryptomus lifetime volume above $7 billion since 2022\. For EMEA financial services the exposure is counterparty and payment-chain, not host-based: any client onboarding, correspondent flow, or crypto off-ramp that touches these names is now a sanctions-screening and third-party risk problem, and the parallel Heleket brand means a name-only screen will miss it. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 28: ICT third-party risk, general principles | Cryptomus/Heleket is a payment processor named in a sanctions action, and clients may hold it as a third-party payment or crypto service in their ICT provider register. | Any client using these platforms as a payment rail must re-assess the provider, and the register entry must reflect the sanctions status. | | NIS2 Art. 21(2)(d): supply chain security measures | The sanctioned entity operates under multiple successive names (Cryptomus, Certa Payments, Xeltox Enterprises, Heleket), so supply chain screening keyed to a single legal name will not catch it. | Supply chain security measures must screen on all known aliases and on the underlying payment infrastructure, not just the primary trading name. | | UK NIS 2018: OES/RDSP duties | The sanctions are issued by the U.K. and bind British companies directly, so U.K. OES/RDSP entities have a specific duty to act on the designation. | U.K. OES/RDSP entities must confirm no Cryptomus/Heleket exposure in their payment and third-party estate and document the check. | No DORA incident-reporting article is engaged: this item is a sanctions designation, not an ICT-related incident at a client. ## 3\. Technical analysis & attack chain This is a sanctions and financial-crime item, not a malware or vulnerability item. There is no CVE, no exploited component, and no host-based attack chain. The operation is a payment-processing and money-laundering scheme, and the "chain" is the sequence of corporate and financial moves that kept it running. 1. Cryptomus emerged in 2022 as a cryptocurrency payment processor and became a key payment processor for dozens of Russian cryptocurrency exchanges and websites selling cybercrime services, per Krebs's December 2024 investigation. 2. The platform changed its name several times. It was previously known as Certa Payments and Xeltox Enterprises, and most recently rebranded to Heleket in 2025 after Canada levied a CAD $176 million fine against it for anti-money laundering violations. 3. After the Canadian fine, Cryptomus appealed the penalty, launched Heleket as a parallel service, and continued processing large volumes of transactions, according to blockchain analyst Richard Sanders. 4. TRM Labs found in April 2026 that Cryptomus had processed more than $7 billion in transactions since 2022, including transactions tied to child sexual abuse material vendors, terrorist financing networks, and human trafficking operations. 5. TRM also found that Cryptomus transaction volume dropped after the platform introduced KYC rules, and that Heleket was launched as a parallel service that continued to offer no-KYC payment processing. 6. On 8 October 2026 the U.K. sanctioned Cryptomus for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze Cryptomus assets at U.K. banks and bar British companies from offering it any business. VexPay, TokenSpot and Tsunami Payments were designated in the same action. The corporate structure behind the platform is the part that matters for screening. Krebs's 2024 investigation found the sole shareholder of Cryptomus parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including WS Management and Advisory Corporation. That entity presents itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region of northwest Africa known as the Western Sahara. Its website, crasadr\[.\]com, offers bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments' former sites, certa\[.\]website, shared a server with 12 other domains, including rasd-state\[.\]ws, a site for the Central Reserve Authority of the Western Sahara. Cryptomus also shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses, none of which appeared to be physically located there. Attribution caveat: the actors named in the verified reference data (Cryptomus, Heleket, VexPay, TokenSpot, Tsunami Payments) have no MITRE ATT&CK profile. Treat any attribution of these entities to a specific criminal group or state actor as unconfirmed. The sanctions action itself is a U.K. government designation and is not in dispute; the characterisation of the platform's role in ransomware, narcotics, darknet markets and fraud rests on Chainalysis, TRM Labs and Krebs reporting, and the $7 billion figure is single-sourced to TRM Labs. ## 4\. Mitigation & containment P1 (within 24h) - Screen the full alias set against all client, counterparty and payment records: Cryptomus, Certa Payments, Xeltox Enterprises, Heleket, VexPay, TokenSpot, Tsunami Payments. A screen on "Cryptomus" alone will miss Heleket, which is the live parallel brand. - Freeze or block any outbound payment or crypto transfer to these names and confirm no client account is using them as an off-ramp. U.K. entities are barred from offering these platforms any business, virtual or otherwise. - Check the third-party and ICT provider register for any of the six names and flag the entry as sanctioned pending removal. P2 (within 72h) - Pull the last 12 months of transaction data for any flow that touched these platforms and route it to financial crime for retrospective review. The TRM finding that volume dropped after KYC was introduced, then moved to Heleket, means the exposure may sit under the Heleket name in more recent records. - Review any client that lists a Western Sahara or crasadr\[.\]com-linked licence as its regulatory authority. A licence issued by WS Management and Advisory Corporation is not a recognised financial services authorisation. - Add the domain set to web and email filtering for staff who may be researching or transacting with these services. P3 (within 7 days) - Update sanctions screening lists and the supply chain screening rule to include all known aliases and the crasadr\[.\]com and rasd-state\[.\]ws domains. - Document the exposure check for the U.K. OES/RDSP record if the entity is in scope. ## 5\. Indicators of compromise The source material contains no file hashes, no malware samples, and no host-based artefacts. The indicators below are network and identity indicators tied to the sanctioned entities and their corporate infrastructure. All are single-sourced to the Krebs investigation and the linked vendor reporting; verify before enforcement. | type | value | confidence | source | | ------ | ------------------------------------------------------- | ---------- | ------------------------- | | domain | crasadr\[.\]com | medium | Krebs, 2024 investigation | | domain | certa\[.\]website | medium | Krebs, 2024 investigation | | domain | rasd-state\[.\]ws | medium | Krebs, 2024 investigation | | entity | Cryptomus (formerly Certa Payments, Xeltox Enterprises) | high | Krebs, 2026-10-14 | | entity | Heleket | high | Krebs, 2026-10-14 | | entity | VexPay | high | Krebs, 2026-10-14 | | entity | TokenSpot | high | Krebs, 2026-10-14 | | entity | Tsunami Payments | high | Krebs, 2026-10-14 | ```iocs domain crasadr[.]com domain certa[.]website domain rasd-state[.]ws entity Cryptomus entity Certa Payments entity Xeltox Enterprises entity Heleket entity VexPay entity TokenSpot entity Tsunami Payments ``` Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------- | ------------------- | | Payment or crypto transfer to a Cryptomus/Heleket-controlled address or account | Transaction monitoring, crypto analytics platform | medium | | Client onboarding that cites a crasadr\[.\]com or WS Management and Advisory Corporation licence as regulatory authority | KYC/onboarding records | medium | | Counterparty address matching the Vancouver shared-address cluster of foreign currency dealers | Counterparty due diligence records | low, single-sourced | ## 6\. Detection Insufficient indicators to author detection rules. The source material provides no file artefacts, command lines, registry keys, or process behaviour. Detection for this item belongs in sanctions screening and transaction monitoring rule sets, not in YARA or Sigma. ## 7\. Sources - Krebs on Security, "U.K. Sanctions Cryptomus for RU Money Laundering", https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/, 2026-10-14. - Chainalysis blog post, cited in Krebs, 2026-10-08. - TRM Labs, cited in Krebs, April 2026. - Richard Sanders, LinkedIn post, cited in Krebs, 2026-10. - Krebs on Security, "How Cryptocurrency Turns to Cash in Russian Banks", December 2024. ## 8\. Adverse Trace position Adverse Trace assesses this as a high-impact sanctions and financial-crime item for EMEA financial services clients with any crypto payment, correspondent, or third-party exposure to the named entities, and a low-impact item for clients with no such exposure. The technical severity is not the issue; there is no CVE and no exploitation to patch. The risk is counterparty and screening failure, and the specific failure mode is the alias set: a client that screens on "Cryptomus" and not "Heleket" will keep processing flows the U.K. has now prohibited. The $7 billion volume figure is single-sourced to TRM Labs and should be treated as an estimate, not a verified total. We will monitor for follow-on designations in other Five Eyes jurisdictions and for any U.S. Treasury action against the same entities, and we will update this advisory if the alias set or the sanctions scope changes. Clients should treat the P1 alias screen as the immediate action and confirm completion to their financial crime function. --- [Read the original source →](https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*