UK Sanctions Cryptomus, Heleket and TokenSpot Over Russia-Linked Payment Networks

The UK imposed 38 Russia-related sanctions designations on October 8, targeting oil revenues, military suppliers, shadow fleet vessels and financial sanctions-evasion channels. The financial targets included Xeltox Enterprises Ltd, covering crypto payment processors Cryptomus and Heleket, and Kyrgyzstani exchange TokenSpot, alongside other payment companies and banks. TRM Labs assessed that Cryptomus and Heleket are operationally linked and that TokenSpot acts as a front for sanctioned exchange Grinex, citing shared infrastructure and transaction evidence. TRM reported that TokenSpot sent more than $950 million combined to Grinex, Garantex and the A7 network. Xeltox had previously been the subject of a Canadian FINTRAC administrative monetary penalty announced in 2025.

Chainalysis reported that Cryptomus and Heleket received funds from more than 15,000 illicit actors, including indirect proceeds from the Lazarus Group-attributed Bybit exploit and funds associated with ransomware and illicit marketplaces. Cryptomus also advertised anonymous payments without customer or business identity checks on cybercrime forums, while TRM observed cybercrime actors migrating to Heleket. Chainalysis identified transfers from TokenSpot, Grinex and Meer, including through intermediary wallets, to a shared HTX deposit address that received more than $308 million, plus connections to the A7A5 sanctions-evasion network. Compliance and security teams should update screening for designated entities and aliases, review historical and indirect exposure, and monitor successor platforms and wallet-infrastructure changes rather than relying solely on named services.