The UK sanctioned three cryptocurrency services on October 8 after blockchain analytics firm Chainalysis linked them to illicit financial flows and networks associated with Russia's sanctions evasion efforts.
The designations targeted crypto payment processors Cryptomus and Heleket, both operated by Xeltox Enterprises Ltd., and TokenSpot, a Kyrgyzstani cryptocurrency exchange. The action aims to disrupt infrastructure used to move money through digital assets.
Chainalysis Findings
Chainalysis reported that Cryptomus and Heleket had received funds from more than 15,000 distinct illicit counterparties across multiple criminal categories. In several categories—including scams, sanctioned jurisdictions, and terrorist financing—their illicit inflows exceeded those received by all mixing services in Chainalysis's dataset combined.
The firm noted that illicit counterparties linked to the two processors increased to more than 900 in a single month in late 2025. Chainalysis suggested the closure of Russian exchange Garantex may have contributed, as some users held existing accounts with Cryptomus or Heleket.
Cryptomus had advertised cryptocurrency payments and conversions without know-your-customer (KYC) or know-your-business (KYB) checks on Russian-language cybercrime forums, according to Chainalysis. In October 2025, Canada's financial intelligence unit imposed a CAD 177 million penalty on Cryptomus for anti-money laundering and counter-terrorist financing violations.
TokenSpot and Related Exchanges
TokenSpot's involvement followed a different pathway. Chainalysis traced funds from the Kyrgyzstani exchange, alongside those from previously sanctioned exchanges Grinex and Meer, to a shared HTX deposit address that received more than $308 million.
The firm identified connections to addresses associated with Moldovan businessman Ilan Shor and the A7A5 instant swapper, which exchanges ruble-backed tokens for dollar-backed stablecoins.
Grinex, set up in Kyrgyzstan in December 2024 as a reported replacement for Garantex, suspended operations in April following a hack. TokenSpot went offline around the same time. Garantex had processed over $100 billion in transactions while under sanctions. HTX, formerly Huobi, was sanctioned by the UK in May for channeling more than $1.5 billion to Russia.
Broader Sanctions Package
The crypto designations were part of a wider UK sanctions package. The action also targeted oil companies Zarubezhneft and INK Capital, bringing UK coverage to more than 90% of Russia's oil production capacity, along with the bank Stolichny Kredit and twelve shadow fleet tankers. Seventeen individuals and entities importing machine tools, electronics, and materials allegedly used in ballistic missiles and drones were named as well.
