UK Sanctions Cryptomus for Processing Russian Ransomware and Sanctions-Evasion Flows
UK sanctions target Cryptomus infrastructure that processed billions in ransomware and Russian evasion payments. Successive name changes and unenforceable fines allowed the service to continue until coordinated Five Eyes action. The move exposes the gap between paper penalties and actual payment rails disruption.
The UK froze Cryptomus assets and prohibited British entities from any dealings with the platform, previously known as Certa Payments and now operating as Heleket. Parallel designations hit VexPay, TokenSpot and Tsunami Payments. The action followed documented flows to Russian exchanges and cybercrime vendors that had already drawn a CAD $176 million Canadian fine the operator simply sidestepped by rebranding.
OFAC: Parallel US designations on Heleket successor entities within 120 days once wallet clustering exceeds 500 high-risk addresses.
Sources (3)
- [1]Primary Source(https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/)
- [2]Supporting Source(https://www.chainalysis.com/blog/cryptomus-heleket-sanctions-october-2026/)
- [3]Supporting Source(https://www.trmlabs.com/reports/cryptomus-volume-analysis-2026)