UK sanctions three crypto services tied to Russia network

The United Kingdom designated crypto payment processors Cryptomus and Heleket, both operating under parent company Xeltox Enterprises Ltd., alongside Kyrgyzstani exchange TokenSpot CJSC on Oct. 8. The Chainalysis account of the sanctions package links the move to a wider UK action covering 38 Russia-linked entities.

That makes three crypto services among the 38 designated entities, or 7.9% of the package (3 ÷ 38 × 100). The remaining targets span Russia’s energy sector, military supply chains and financial system. The significance for crypto services is direct: the UK action reaches processors that sit between digital assets and payments, rather than limiting sanctions to banks or other traditional financial institutions.

For service providers, the immediate consequence is sanctions-screening exposure to Cryptomus, Heleket and TokenSpot from the designation date, Oct. 8.

The Chainalysis analysis says Cryptomus and Heleket received funds from more than 15,000 illicit actors across every category of illicit activity it tracks. Those categories include scams, sanctioned jurisdictions, escort services, terrorist financing and exposure to the European Union’s 20th sanctions package. Their combined illicit-actor flows exceeded those of all tracked mixers across those categories, according to the analysis.

The exposure also reaches major crypto crime cases. Funds from the $1.4 billion Bybit exploit attributed to North Korea’s Lazarus Group ultimately reached both Cryptomus and Heleket indirectly. Proceeds from ransomware groups including Black Basta and illicit marketplaces such as Xinbi Guarantee also flowed through the processors.

Activity accelerated late in 2025. Cryptomus and Heleket recorded more than 900 illicit counterparties in a single month, after their illicit-actor activity had grown steadily from 2022. Cryptomus also advertised on the Russian-language dark web forum BHF and the cybercrime forum Nulled, promoting “anonymous” crypto payments and conversion without KYC or KYB, according to Chainalysis.

The compliance record predates this week’s designation. Canada’s financial intelligence unit, FINTRAC, imposed a CAD 177 million penalty on Cryptomus in October 2025 for AML/CFT violations. Cryptomus is registered in Canada and operates with Heleket through Xeltox Enterprises Ltd.; Heleket launched in January 2025.

TokenSpot brings a separate connection to the Russia-linked A7A5 sanctions-evasion network. Chainalysis found funds from TokenSpot, Grinex and Meer converging on the same HTX deposit address, which received more than $308 million. HTX, formerly Huobi, was sanctioned by the UK in May for channeling more than $1.5 billion to Russia through flows from previously sanctioned entities.

Crypto Briefing’s account cites TRM Labs’ assessment that TokenSpot facilitated more than $950 million in transfers to Grinex, Garantex and the A7 network. TRM also found that Cryptomus received more than $204 million from Garantex before sanctions were imposed on that entity.

The sequence matters. Kyrgyzstani exchanges Grinex and Meer.kg were sanctioned in August 2025 as key facilitators of A7A5 trades; HTX followed in May; and an April 2026 assessment identified operational connections among Cryptomus, Heleket and TokenSpot. On Oct. 6, TRM assessed TokenSpot as a front sharing infrastructure with Grinex. Two days later, all three crypto services entered the UK’s designation list.

The desk’s read is that the UK is treating payment processors and exchange infrastructure as sanctions-relevant nodes in their own right. The Oct. 8 action gives Western authorities a concrete model for targeting crypto services tied to sanctioned-regime access: identify the processors, map their counterparties and designate the infrastructure on the same schedule as actors in energy, military supply and finance.