The United Kingdom has imposed sanctions on three cryptocurrency firms after uncovering links to Russia’s wartime economy and ongoing sanctions evasion efforts. The affected companies are payment processors Cryptomus and Heleket, both operated by Xeltox Enterprises Ltd., as well as TokenSpot CJSC, an exchange based in Kyrgyzstan.
Chainalysis exposes large-scale illicit connections
Blockchain analytics firm Chainalysis assisted in tracing the connections of these crypto services to illicit networks. The firm determined that Cryptomus and Heleket processed payments from more than 15,000 distinct illicit counterparties. These funds were linked to clear patterns of scams, fraud shops, ransomware operations, and transactions from organized criminal groups.
Chainalysis reported that the exposure of these two payment services to sanctioned jurisdictions, terrorist financing, and other unlawful activities was higher than all tracked crypto mixing services combined. Mixers typically obscure transaction origins, while payment processors provide services for conducting and converting crypto transactions.
The analysis raised concerns that services presenting themselves as legitimate payment platforms may in fact be facilitating high volumes of illicit financial flows due to limited compliance or weak verification systems.
Chainalysis identified a surge in illicit transactions associated with Cryptomus and Heleket during late 2025, noting that the number of linked entities surpassed 900 in one month. Enforcement actions against other services, notably the closure of Russian exchange Garantex, appeared to shift illicit flows to these platforms.
Cryptomus previously faced scrutiny in Canada, where the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) levied a CAD 177 million penalty in October 2025 for failing to meet anti-money laundering and counter-terrorist financing standards.
Mini dictionary: Chainalysis is a New York-based blockchain analytics company that provides tools and intelligence to help governments, exchanges, and financial institutions track cryptocurrency transactions related to crime, sanctions evasion, and terrorist financing.
TokenSpot, Kyrgyzstani exchanges, and HTX fund flows
TokenSpot, an exchange headquartered in Kyrgyzstan, was also implicated in a broad illicit finance network. Chainalysis found that TokenSpot, along with Kyrgyzstani exchanges Grinex and Meer, sent funds to the same HTX deposit address, which ultimately received over $308 million. These flows were connected to a ruble-backed cryptocurrency called A7A5, known for its role in sanction-evasion schemes.
| Exchange/Processor | Origin Country | Illicit Counterparties Linked | Main Identified Flow |
|---|---|---|---|
| Cryptomus | Not specified | 15,000+ | Scams, ransomware, sanctioned entities |
| Heleket | Not specified | 15,000+ | Scams, ransomware, sanctioned entities |
| TokenSpot | Kyrgyzstan | Unspecified | Transfers to HTX ($308 million) |
Further investigation highlighted links between TokenSpot, Meer, and the A7A5 instant swapper platform, a service allowing users to exchange ruble-backed tokens for dollar-backed stablecoins.
Chainalysis noted that TokenSpot and Meer share similar web layouts and Russian-language platforms, suggesting a potential connection in infrastructure or management. However, website similarities alone do not confirm common ownership.
Mini dictionary: HTX is a major global cryptocurrency exchange formerly known as Huobi. It handles digital asset trading and custodial services, and is known for its significant trading volumes, especially in Asia.
Broader sanctions target Russian economy and oil sector
The UK’s actions form part of a wider sanctions package announced by the Foreign, Commonwealth & Development Office. In total, authorities designated 38 entities related to Russia, aiming to disrupt the country’s military supply chains and targeting energy sector assets, including twelve “shadow fleet” tankers used to evade international restrictions. The number of sanctioned vessels now exceeds 600.
For the cryptocurrency sector, the move illustrates how on-chain forensic analysis can reveal pathways connecting sanctioned groups with global exchanges and payment processors. Firms found to be facilitating or indirectly supporting these networks may become subject to equivalent regulatory and law enforcement measures.
Authorities emphasized that failing to implement robust anti-money laundering and compliance standards can expose financial services to exploitation by sanctioned entities and criminal groups, potentially leading to severe regulatory penalties and international scrutiny.
