UK sanctions Cryptomus, a payment hub for Russian cybercrime

The United Kingdom sanctioned Cryptomus, a cryptocurrency payment platform previously known as Certa Payments and Xeltox Enterprises, on 8 October 2026, Krebs on Security reported on 14 October. The measure targets the platform for processing payments that benefit the Russian state and its financial institutions: it freezes Cryptomus assets at UK banks and bars British companies from doing business with it. VexPay, TokenSpot and Tsunami Payments were sanctioned as well.

According to the article, Cryptomus has been a key payment processor for Russian cryptocurrency exchanges and for sites selling cybercrime services. After Canada fined it a record CAD 176 million for anti-money laundering violations, it launched Heleket as a parallel service. Chainalysis wrote that Cryptomus and Heleket received more illicit funds across its tracked categories than the mixers in its dataset, and TRM Labs found in April 2026 that Cryptomus had processed more than $7 billion since 2022.

Blockchain investigator Richard Sanders told the outlet that the Canadian fine had not stopped the platform from processing payments, while sanctions can, and that this is the first known case of a Five Eyes country sanctioning a crypto operation incorporated in another Five Eyes jurisdiction.

Why it matters Payment processors that ask no questions are the plumbing behind ransomware payouts, darknet market sales and fraud services. As the Heleket episode shows, pressure can push such a service to rebrand rather than stop, so following successor names and shared infrastructure is part of following the money.