The United Kingdom’s Foreign, Commonwealth & Development Office (FCDO) has designated 38 entities in a sweeping crackdown aimed at dismantling the financial networks, oil conduits, and supply chains fueling Russia’s wartime economy. Announced on October 8, the new sanctions package delivers a heavy blow to actors facilitating sanctions evasion and supporting the Russian military-industrial base. Among the most prominent targets are crypto payment processors Cryptomus and Heleket—both operating under the parent company Xeltox Enterprises LTD—alongside Kyrgyzstani crypto exchange TokenSpot CJSC.
These designations underscore the growing intersection between digital asset infrastructure and geopolitical conflict. According to blockchain analytics firm Chainalysis, the targeted services have long histories of handling illicit proceeds and bypassing financial restrictions. The findings provide critical visibility into how state-backed procurement networks, ransomware operators, and criminal syndicates leverage permissive crypto payment gateways to move funds globally.
Tracing the Illicit Ecosystem Around Cryptomus and Heleket
The inclusion of Cryptomus and Heleket in the UK’s sanctions list brings renewed regulatory focus to services that blockchain investigators have tracked for years. Chainalysis data indicates that both platforms have received funds from more than 15,000 illicit actors spanning every major category of financial crime.
The scope of their exposure is vast. Indirect inflows to both processors have been linked to the staggering $1.4 billion Bybit exploit attributed to North Korea’s Lazarus Group. Additionally, proceeds from notorious ransomware operations, such as Black Basta, and illicit marketplaces like Xinbi Guarantee have routinely flowed through their infrastructure.
For many cybercriminals, Cryptomus and Heleket have served as preferred payment rails, offering redundancy by allowing malicious actors to maintain accounts across multiple services to mitigate the risk of disruption. Furthermore, these platforms have acted as vital payment processors for a wide array of malicious cyber infrastructure vendors. Bulletproof hosting providers, proxy services, and malware and DDoS-as-a-service operators—including entities previously designated by international authorities such as Zservers, Stark Industries, First VPN, and Aeza Group—have all relied heavily on these gateways.
Regulatory penalties have previously signaled trouble for these platforms. In October 2025, Canada’s financial intelligence unit, FINTRAC, slapped Cryptomus with a record administrative monetary penalty of CAD 177 million for severe violations of anti-money laundering (AML) and counter-terrorist financing (CFT) regulations. This regulatory action, combined with extensive on-chain findings, paints a clear picture of persistent, systemic weak controls that effectively invited illicit actors to utilize the services at scale.
Comparative data reveals a striking trend: Cryptomus and Heleket have exceeded all tracking metrics for mixing services when it comes to funds received from illicit actors operating in categories such as scams, sanctioned jurisdictions, escort services, terrorist financing, and specific EU sanctions package designations. While crypto mixers are explicitly built to obscure transaction trails and carry well-documented illicit finance risks, Cryptomus and Heleket operated ostensibly as legitimate payment processors while maintaining lax compliance standards. Their capacity to facilitate laundering actually rivaled or exceeded specialized privacy-enhancing services, demonstrating how minimal identity verification can enable systemic abuse.
The volume of illicit activity flowing through Cryptomus and Heleket has climbed steadily since 2022, culminating in a sharp surge in late 2025 that saw connections to more than 900 distinct illicit counterparties in a single month. This spike coincided with the dismantling of other illicit-friendly services, such as the Russian crypto exchange Garantex. On-chain analysis indicates that many users maintained simultaneous accounts on Garantex and the Xeltox-backed processors, allowing them to seamlessly shift their operations once Garantex was taken offline.
Compounding this growth, Cryptomus actively promoted its services on dark web and cybercrime forums. Operating under the guise of an anonymous payment gateway, the platform advertised on the Russian-language forum BHF and the major cybercrime hub Nulled, which boasted over ten million users at its peak. By explicitly marketing instant cryptocurrency conversion without requiring Know Your Customer (KYC) or Know Your Business (KYB) verifications, Cryptomus deliberately courted individuals seeking to operate completely outside traditional financial oversight.
Inside TokenSpot, Grinex, and the A7A5 Network
While Cryptomus and Heleket specialized in high-volume payment processing for cybercrime and sanctions evasion, TokenSpot CJSC represents a distinct vector within a Kyrgyzstan-based network specifically engineered to help Russia circumvent international financial blocks.
Investigative findings tie TokenSpot directly to a cluster of Kyrgyzstani crypto exchanges previously sanctioned for facilitating Russian sanctions evasion, including Grinex and Meer.kg. A side-by-side examination of the websites for Meer and TokenSpot reveals near-identical digital architectures. Both platforms deployed matching Russian-language layouts, visual assets, and functional templates tailored for crypto-fiat conversions. While Meer marketed itself as a standard cryptocurrency exchange, TokenSpot advertised "cryptocurrency for business growth," offering ruble-denominated crypto purchases explicitly designed for individuals and legal entities. This shared template strongly points to a common administrative core or shared technical infrastructure behind both entities.
Blockchain tracking via Chainalysis Reactor further maps out how these operations converged. Funds from TokenSpot, Grinex, and Meer were systematically funneled downstream into the same HTX deposit address, which accumulated over $308 million in inflows. This nexus connects directly to wallet addresses exposed in leaked documentation regarding AnyKey LLC—a company affiliated with Ilan Shor—and the A7A5 instant swapper. The A7A5 system plays a crucial role in enabling users to swap ruble-backed A7A5 tokens for dollar-backed stablecoins, shielding participants from currency volatility and tracking.
Although various intermediary wallets stood between these exchanges and the final destination, the convergence of funds into the same HTX deposit address illustrates a unified logistics pipeline. HTX, formerly known as Huobi, was itself sanctioned by the UK in May for channeling more than $1.5 billion to Russia via transaction flows originating from previously blacklisted entities.
Russia’s Oil and Military Supply Chains Also Targeted
The UK’s October 8 designations extend far beyond digital asset infrastructure, striking deeply at the physical commodities and industrial supply chains sustaining the Russian state.
The FCDO expanded its energy sanctions by targeting major Russian oil enterprises Zarubezhneft and INK Capital, alongside financial institution Stolichny Kredit. With these additions, the UK’s sanctions net now covers more than 90% of Russia’s total oil production capacity. Furthermore, the government designated an additional twelve shadow fleet tankers, pushing the total number of restricted vessels past the 600 mark.
Simultaneously, the new measures focus heavily on cutting off the industrial inputs required for Russia’s military-industrial complex. Seventeen individuals and corporate entities involved in importing crucial machine tools, advanced electronics, and specialized raw materials utilized in the manufacturing of ballistic missiles and military drones were formally sanctioned.
Cryptocurrency increasingly serves as the financial glue binding these supply chains and procurement networks together. Earlier research highlighted how state-backed and pro-Russian volunteer networks utilized open crowdfunding campaigns to raise millions of dollars in digital assets. In notable instances, decentralized collections of paramilitary organizations secured over $8.3 million in crypto contributions, directing the funds toward drone procurement and tactical military equipment.
The latest round of sanctions emphasizes the complex reality of modern financial warfare, where traditional commodities like crude oil and high-tech military hardware are inextricably linked to digital asset rails. As international authorities continue to disrupt established channels, monitoring these evolving blockchain connections remains essential for understanding how illicit actors adapt to financial enforcement.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
