The UK Targets Crypto Payment Processors Linked to Russia's War Economy
On October 8th, the UK designated 38 entities for their role in funding Russia's war economy, including crypto payment processors Cryptomus and Heleket, both controlled by Xeltox Enterprises Ltd., and Kirghizistan-based exchange TokenSpot CJSC. This sanctions package aims to hit the broader infrastructure supporting Russia's wartime economy, including the energy sector, military supply chains, and the financial system.
Quick Answer
The UK has sanctioned three crypto entities for their role in supporting Russia's war economy. Cryptomus and Heleket operate as payment processors based in Kirghizistan and have been linked to large-scale illicit activities. TokenSpot is connected to the A7A5 sanctions evasion network. The sanctions aim to disrupt illegal financial flows supporting Russian military operations.
Cryptomus and Heleket: Hubs for Illicit Transactions
Chainalysis found that Cryptomus and Heleket received funds from over 15,000 illicit actors, covering all categories of illicit activity monitored. According to the analysis, the two services received more illicit funds than all monitored mixers, with over 900 illicit counterparts in a single month at the end of 2025. Among the illicit funds received were those linked to North Korea's Lazarus group, responsible for the $1.4 billion exploit on Bybit, and proceeds from ransomware groups like Black Basta and illicit markets like Xinbi Guarantee.
Growing Illicit Activity
Illicit activity at Cryptomus and Heleket has steadily increased since 2022, with a significant peak at the end of 2025. This increase is likely due to the shutdown of other services friendly to illicit activities, such as the dismantling of the Russian exchange Garantex in 2025. Many Garantex users also had accounts on Cryptomus or Heleket, suggesting a simple shift of activities after losing access to Garantex.
Promotion on Criminal Forums
Cryptomus actively promoted its services on criminal forums, positioning itself as a way for illicit actors to move and convert cryptocurrencies. The service advertised "anonymous" crypto payments and conversions without requiring KYC (Know Your Customer) or KYB (Know Your Business), making it particularly attractive to users seeking to operate outside traditional financial controls. Cryptomus was also fined by FINTRAC, Canada's financial intelligence unit, for AML/CFT violations for a record amount of CAD 177 million.
TokenSpot and the A7A5 Network
TokenSpot is closely linked to a broader network of crypto exchanges based in Kirghizistan already sanctioned for facilitating Russian sanctions evasion. A comparison between TokenSpot and Meer, another sanctioned exchange, reveals nearly identical website designs, suggesting common operators or infrastructure. Chainalysis analysis shows that TokenSpot, along with Grinex and Meer, funneled funds to the same HTX deposit address, which received over $308 million.
Links to the Sanctions Evasion Network
The Chainalysis Reactor graph reveals links with addresses included in a leak from AnyKey LLC, affiliated with Ilan Shor, and the instant swapper A7A5, a service that allows users to swap A7A5 tokens supported by the ruble for dollar-supported stablecoins. HTX (previously Huobi) was sanctioned by the UK in May 2026 for channeling over $1.5 billion to Russia through flows from previously sanctioned entities.
Implications for Crypto AML Compliance
The sanctions highlight the importance of robust crypto AML compliance for exchanges and payment processors. Companies must implement rigorous exchange KYC and crypto anti-money laundering measures to prevent the use of their services for illicit activities. The lack of adequate controls can lead to significant sanctions and reputational damage.
Impact on Russian Military and Energy Supply Chains
The sanctions are not limited to the crypto sector but also target various actors in the Russian energy and military sectors. This comprehensive approach aims to disrupt financial flows supporting Russian military operations. Companies involved in military supply chains and energy sectors must be aware of sanctions risks and implement NIS2 compliance and DORA compliance measures to ensure digital operational resilience.
Protection Against Related Cyber Threats
Illicit activities related to Cryptomus and Heleket include the provision of malicious cyber infrastructure such as bulletproof hosting, proxy services, malware, and DDoS-as-a-service. Companies must implement cyber insurance and breach remediation measures to protect themselves from these threats. A MDR service (Managed Detection and Response) can help detect and quickly respond to attacks.
Challenges for Crypto Risk Management
The designation of Cryptomus and Heleket underscores the challenges in crypto risk management. Companies must carefully monitor transactions to detect suspicious activity and prevent the use of their services for sanctions evasion. Implementing a Managed Security Operations Center (SOC as a Service) can improve the ability to detect and respond to threats.
Implications for Crypto Regulation
The sanctions highlight the need for stricter crypto regulation. The EU's MiCA (Markets in Crypto-Assets) regulation aims to provide a comprehensive regulatory framework for the crypto sector, improving transparency and security. Companies must be ready to comply with new regulations to avoid sanctions and ensure legal operations.
The UK's sanctions against Cryptomus, Heleket, and TokenSpot highlight the risks associated with using crypto services for illicit activities and sanctions evasion. Companies must implement crypto risk management and crypto AML compliance measures to protect themselves from these threats. The evolving regulation requires greater attention to MiCA compliance and crypto asset management.
For further insights into crypto risk management and compliance measures, explore our guide on crypto asset management.
The Context of Sanctions in the Crypto Landscape
These sanctions are part of a broader trend of strengthening measures against the use of cryptocurrencies for illicit activities. According to an Elliptic report, the volume of crypto transactions linked to criminal activities reached $20.1 billion in 2025, a 15% increase from the previous year. The UK's sanctions represent an attempt to specifically target the infrastructure that facilitates these illicit financial flows.
The Impact on Legitimate Exchange Operations
Legitimate crypto exchanges are facing significant challenges in distinguishing themselves from these illicit services. Binance, for example, has recently implemented an advanced identity management system to improve crypto AML compliance. Coinbase, on the other hand, has invested in a Managed Security Operations Center to monitor and prevent suspicious activities. These efforts are crucial to maintaining user and institutional investor trust.
The Challenges for Institutional Crypto Custody Companies
The sanctions also highlight the challenges for institutional crypto custody companies. Coinbase Custody and BitGo, two of the leading providers of custody services, must ensure that their clients are not involved in illicit activities. This requires the implementation of rigorous NIS2 compliance and DORA compliance protocols, as well as advanced Data Loss Prevention solutions to protect sensitive data.
The Evolution of Sanctions Evasion Strategies
Sanctions evasion networks are becoming increasingly sophisticated. The case of TokenSpot and the A7A5 network demonstrates how illicit actors are exploiting regulatory gaps between different jurisdictions. Regulatory authorities are responding with stricter measures, such as the EU's MiCA regulation, which aims to create a more consistent regulatory framework for the crypto sector.
The Importance of Cybersecurity Training
Protection against cyber threats related to these illicit activities requires continuous training. Companies must invest in training programs for their employees on incident response and breach remediation. The ISO 27001 certification has become a fundamental requirement for many companies operating in the crypto sector, ensuring that they have implemented best security practices.
Implications for Institutional Investors
Institutional investors are becoming increasingly attentive to the risks associated with sanctions and illicit activities. Crypto asset management requires rigorous crypto AML compliance and the implementation of advanced identity access management solutions. Institutional crypto custody companies must ensure that their clients are protected from potential sanctions violations.
The Role of Cyber Insurance
Cyber insurance is becoming an essential element for companies operating in the crypto sector. Cyber insurance can help cover the costs related to data breaches and ransomware attacks. However, the cost of cyber insurance has increased significantly in recent years, reflecting the rise in cyber threats. Companies must carefully evaluate their insurance options to ensure adequate protection.
Challenges for Crypto Payment Companies
Crypto payment companies face unique challenges in ensuring crypto AML compliance. The lack of clear regulatory standards has made it difficult for these companies to implement adequate security measures. However, the adoption of advanced Security Information and Event Management (SIEM) and penetration testing solutions can help improve their ability to detect and prevent illicit activities.
Future Prospects for the Crypto Sector
The crypto sector is set to become increasingly regulated. Companies must be ready to comply with stricter regulations, such as the EU's MiCA regulation. The implementation of advanced MiCA compliance and crypto risk management solutions will be crucial to ensuring the long-term sustainability of the sector. Companies that invest in these solutions will be better positioned to face future challenges.
Frequently Asked Questions
What is the impact of sanctions on the crypto sector?
The sanctions specifically target crypto services used for illicit activities, such as sanctions evasion and funding military operations. This has a significant impact on crypto payment companies and institutional custody providers, which must ensure compliance with stricter regulations.
How can companies protect themselves from cyber threats related to illicit activities?
Companies can implement advanced cyber insurance, breach remediation, and Managed Security Operations Center solutions to improve their ability to detect and respond to cyber threats. Continuous training in incident response and ISO 27001 certification are also essential elements to ensure security.
What are the challenges for institutional investors in the crypto sector?
Institutional investors must face significant challenges in ensuring crypto AML compliance and protection against sanctions violations. The implementation of advanced identity access management and crypto asset management solutions is crucial to ensuring the security of their investments.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not engage in real-time information activities.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.