On October 8, the United Kingdom’s Foreign, Commonwealth & Development Office (FCDO) implemented a sweeping package of sanctions designating 38 entities for their roles in fueling Russia’s wartime economy, bolstering its military-industrial base, and facilitating sophisticated sanctions-evasion schemes. Among the primary targets of this latest regulatory crackdown are crypto payment processors Cryptomus and Heleket—both operating under the parent company Xeltox Enterprises LTD—alongside Kyrgyzstani crypto exchange TokenSpot CJSC.
These designations have brought renewed regulatory scrutiny to virtual asset services that blockchain intelligence firms have been tracking for extensive illicit activity. According to data and analysis from Chainalysis, Cryptomus and Heleket have long been linked to a broad spectrum of illegal operations. On-chain analysis reveals that both payment processors have received funds from more than 15,000 distinct illicit actors spanning every major category of financial crime tracked by compliance investigators.
The scale of illicit exposure crossing through these processors highlights a growing trend in digital asset laundering. While privacy mixers are explicitly designed to obscure transaction histories and are widely recognized for their inherent financial crime risks, Cryptomus and Heleket ostensibly presented themselves as legitimate, mainstream payment gateways while maintaining lax compliance and identity verification standards. Consequently, on-chain data shows that these two services have actually received more funds from illicit actors across specific categories—including scams, transactions involving sanctioned jurisdictions, escort services, terrorist financing, and targeted European Union sanctions packages—than all tracked mixing services combined.
The breadth of criminal actors utilizing Cryptomus and Heleket is extensive. Investigators have traced indirect fund flows originating from the massive $1.4 billion Bybit exploit, which has been attributed to North Korea’s notorious Lazarus Group, to both payment processors. Furthermore, proceeds generated by prominent ransomware variants such as Black Basta and funds moving through illicit cybercriminal marketplaces like Xinbi Guarantee have been routed through their platforms.
Some malicious actors have maintained concurrent accounts across multiple processors to distribute their financial activities and mitigate the risk of relying on a single provider. Additionally, Cryptomus and Heleket have served as the preferred payment rails for numerous malicious cyber infrastructure vendors. This includesbulletproof hosting providers, proxy services, and operators offering malware and distributed denial-of-service (DDoS) as-a-service. Several of these underlying infrastructure providers, such as Zservers, Stark Industries, First VPN, and the Aeza Group, have faced their own international sanctions designations.
The persistent failure of these platforms to implement adequate anti-money laundering and counter-terrorist financing (AML/CFT) controls has drawn heavy penalties from global financial watchdogs. In October 2025, Canada’s financial intelligence unit, FINTRAC, penalized Cryptomus with a record administrative monetary penalty of 177 million Canadian dollars for severe AML/CFT violations. This regulatory action, paired with ongoing blockchain tracking, points to a systemic pattern of weak oversight that enabled illicit actors to launder capital at scale.
Data indicates that illicit activity connected to Cryptomus and Heleket has grown steadily since 2022, culminating in a sharp surge in late 2025 that saw interactions with more than 900 distinct illicit counterparties in a single month. Industry experts attribute a portion of this spike to the coordinated dismantling of other illicit-friendly platforms, such as the 2025 takedown of the Russian crypto exchange Garantex. Blockchain records show that many users maintained accounts on Garantex alongside Cryptomus and Heleket, allowing them to seamlessly pivot their transaction flows to the remaining processors once Garantex was neutralized.
To attract this criminal clientele, Cryptomus actively promoted its services directly on dark web and cybercrime forums. Translations of marketing materials show the platform advertising on BHF, a Russian-language cybercrime forum, and Nulled, a major underground platform that once boasted over 10 million users at its peak. In these promotional campaigns, Cryptomus explicitly marketed "anonymous" cryptocurrency payments and conversion services that completely bypassed traditional Know Your Customer (KYC) and Know Your Business (KYB) requirements, making it an attractive destination for threat actors seeking to operate entirely outside regulated financial frameworks.
Inside TokenSpot, Grinex, and the A7A5 Network
The UK’s targeting of TokenSpot CJSC highlights a broader, interconnected network of Kyrgyzstani cryptocurrency exchanges actively involved in facilitating Russian sanctions evasion. Investigative evidence demonstrates that TokenSpot shares deep operational and structural ties with other regional exchanges previously penalized by international regulators.
A direct comparison between TokenSpot and Meer—a Kyrgyzstani exchange sanctioned by the Office of the Superintendent of Financial Institutions (OSFI) in August 2025 for its role in processing trades for the A7A5 token network—reveals near-identical website architectures. Both platforms operate as Russian-language crypto-fiat exchanges featuring matching website layouts, visual assets, and core value propositions. While Meer marketed itself broadly as a crypto-fiat exchange, TokenSpot advertised "cryptocurrency for business growth," offering ruble-denominated digital asset purchases tailored for both individual and corporate legal entities. This shared infrastructure strongly suggests common operators behind the scenes.
Further confirmation comes from blockchain analysis, which maps downstream funds from TokenSpot, Grinex, and Meer converging into the exact same deposit addresses on major trading platforms. Specifically, transaction flows from all three Kyrgyzstani exchanges funneled capital into a single deposit address on HTX that ultimately received over $308 million. This activity links TokenSpot to a broader web of sanctions evasion uncovered through leaked documents tied to Ilan Shor-affiliated entities such as AnyKey LLC, as well as the A7A5 instant swapper, which allows traders to exchange ruble-backed A7A5 tokens for dollar-backed stablecoins.
The convergence of these illicit flows onto HTX—formerly known as Huobi—underscores the systemic nature of these networks. HTX itself was sanctioned by the United Kingdom in May for channeling more than $1.5 billion to Russia through transaction streams originating from previously penalized entities.
Russia’s Oil and Military Supply Chains Also Targeted
The Foreign, Commonwealth & Development Office designations extend far beyond digital asset infrastructure, striking directly at the core industrial and economic supply chains supporting Russia’s military operations.
The UK government sanctioned prominent Russian oil enterprises Zarubezhneft and INK Capital, a move that expands British sanctions coverage to encompass more than 90 percent of Russia’s total oil production capacity. Financial channels supporting these sectors were also hit, including the designation of Russian financial institution Stolichny Kredit. Additionally, twelve vessels belonging to Russia’s shadow fleet were added to the sanctions list, bringing the total number of restricted tankers to over 600.
Beyond energy markets, the sanctions target the procurement networks supplying Russia’s military-industrial base. Seventeen individuals and corporate entities involved in the importation of critical machine tools, advanced electronics, and specialized materials utilized in the manufacturing of ballistic missiles and military drones have been formally designated.
Cryptocurrency continues to play a vital supporting role in financing these procurement networks and bypass mechanisms. Blockchain intelligence reports published earlier this year documented how state-backed drone procurement networks successfully leveraged open crowdfunding campaigns to raise millions of dollars in digital assets. In one notable instance, a coalition of pro-Russian volunteer and paramilitary organizations managed to raise upwards of $8.3 million in cryptocurrency to purchase military-grade drones and combat equipment.
These coordinated international designations demonstrate the complex intersection between decentralized digital assets and traditional industrial supply chains in enabling modern sanctions evasion. As regulatory agencies continue to disrupt established financial corridors, intelligence and compliance firms are maintaining ongoing oversight of these evolving networks to track how illicit actors adapt to mounting enforcement pressures.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
