Loading story…
Investigations by TRM Labs and Synaptic Security link Russia-connected cryptocurrency payment processor Cryptomus to Heleket, with Synaptic also identifying connections to Mirocard, which now operates Heleket’s crypto-funded card business. TRM assesses with high confidence that Cryptomus and Heleket share infrastructure, branding, personnel, liquidity sources and coordinated on-chain activity. Cryptomus introduced mandatory identity verification in February 2025, after which transaction volumes declined; TRM assesses that Heleket likely emerged as a lower-friction parallel service and that sanctions-related entities and cybercrime service providers subsequently migrated to it. In October 2025, Canada’s FINTRAC imposed a CAD 176.96 million penalty on Cryptomus operator Xeltox Enterprises Ltd. for anti-money-laundering reporting failures, including those involving suspicious transactions and transfers from Iran. Xeltox is appealing the penalty.
Synaptic’s investigation adds shared documentation, software development kit artifacts, DNS configurations and automatic account migration as evidence of continuity, while noting that ultimate control remains unestablished. Public disclosures connect Heleket to Georgia’s Handy Elect LLC and Mirocard to Kyrgyzstan’s Byte Commerce LLC, which reportedly lacks an NBKR payment-activities licence. Heleket’s Russian-language marketing promotes overcoming sanctions-related banking restrictions despite its published Russia prohibition; Mirocard advertises cards without identity verification and recommends misleading billing details. TRM identifies sanctioned Russian exchange Garantex as a shared liquidity provider and estimates Heleket’s 2025 illicit inflow ratio at approximately 0.6%, nearly five times its payment-provider average. The findings raise counterparty and sanctions-screening concerns across the connected brands, but Synaptic does not establish specific prohibited transactions, payment volumes or merchant complicity.
TTPs, infrastructure, and targeting history in one profile.
25 events from the most recent confirmed update back to the earliest known activity.
A Censys search returned 3,430 Cryptomus-tagged and 1,569 Heleket-tagged web properties; a manual review of 100 results per processor found nine overlapping sites. The results may contain duplicates and do not establish completed verification or transactions.
Georgia’s registry classified Handy Elect LLC as a deficient company following cancellation of its registered address.
Handy Elect LLC’s registered address was cancelled by Georgia’s registry.
Byte Commerce LLC was registered in Bishkek. Unremoved drafting notes in Mirocard’s Terms of Use identify Byte Commerce as its intended operating company.
Heleket’s legal policies dated 23 June 2026 identify no operating company, registration number or jurisdiction.
Bithumb blocked deposits and withdrawals involving Heleket.
RDAP records date mirocard.com’s current registration to 13 April 2026. The investigation distinguished this registration from unrelated earlier Mirocard DNS records.
TRM assessed with high confidence that Cryptomus operators launched Heleket as a parallel service, citing shared infrastructure, branding, personnel and coordinated on-chain activity. Its analysis identified shared Garantex liquidity and elevated illicit exposure, including sanctions-related flows.
FINTRAC penalized Xeltox Enterprises Ltd., Cryptomus’s Vancouver-registered operator, for anti-money-laundering and terrorist-financing reporting violations. Findings included unreported suspicious transactions and more than 7,500 transfers originating from Iran.
Handy Elect LLC was registered in Georgia with Kazakh citizen Radik Akhmetov as its sole owner and director. Registry documents link the company to lawyer@heleket.com.
A forum user reported being able to log into Heleket using the same credentials as their Cryptomus account.
Cryptomus’s on-chain volume fell to USD 86 million in March 2025, down from USD 153 million in January, following mandatory KYC implementation and regulatory scrutiny.
Cryptomus implemented mandatory know-your-customer controls amid regulatory scrutiny.
The heleket/api-php-sdk package was released from a fork of Cryptomus’s official SDK under the GitHub account cryptomus-plugin. It retained Cryptomus example values from 2022.
Heleket began operating in January 2025. TRM identified its first large incoming transactions that month as originating from sanctioned Russian exchange Garantex.
FINTRAC found that Cryptomus failed to report more than 1,000 suspicious transactions in July 2024 involving darknet markets, ransomware, sanctions evasion and child sexual abuse material.
RDAP records show that heleket.com was registered on 8 February 2024.
The National Bank of the Kyrgyz Republic confirmed that Byte Commerce holds no NBKR licence for payment activities. It referred questions about crypto-funded cards and virtual assets to the National Agency for Virtual Assets and Blockchain Technologies.
Mastercard stated that reloadable no-KYC cards are prohibited on its network and that it investigates allegations to enforce legal and network requirements. Its statement did not specifically address Mirocard or the identified card BINs.
The investigation found Mirocard advertising cards without passport or video identification, despite its published risk-based KYC programme. A Russia-facing payment guide recommended registering in another region and entering a random US billing location.
Robin Dost’s investigation identified matching Cryptomus and Heleket authentication schemes, documentation artifacts and DNS patterns, alongside Heleket API and Mirocard hosting in the same network /24. These findings support operational continuity but do not establish ultimate control.
Mirocard’s documentation allows existing Heleket users to log in with their accounts and automatically transfer funds and cards. Heleket’s card page also began serving Mirocard content.
Xeltox Enterprises Ltd. appealed the FINTRAC penalty, claiming it had no knowledge of or control over the transactions.
A Cryptomus administrator stated on Telegram that Cryptomus and Heleket had “entered into certain agreements,” while maintaining that they were distinct entities.
TRM observed cybercrime actors, including CSAM vendors and cybercrime service providers, switching from Cryptomus to Heleket after Cryptomus tightened compliance controls.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed **A7 network**, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated **Huobi Global S.A.**, the entity behind crypto exchange **HTX**, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows. Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across **TRON**, **Ethereum**, **BNB Smart Chain**, and **Solana**, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for **A7 LLC** and **Garantex** and to the UK National Crime Agency-led **Operation Destabilize**, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
Jul 24, 2026