The UK sanctioned three cryptocurrency firms on October 8 over alleged links to Russia's wartime economy and sanctions evasion. The targets include payment processors Cryptomus and Heleket, operated by Xeltox Enterprises Ltd., and Kyrgyzstani exchange TokenSpot CJSC.
Illicit Network Connections
Blockchain analytics firm Chainalysis identified extensive connections between the sanctioned services and illicit financial networks. Cryptomus and Heleket received funds from more than 15,000 distinct illicit counterparties, according to the analysis.
Chainalysis found that both processors handled funds associated with scams, ransomware, fraud shops, and organized criminal networks. Their transaction histories also included indirect flows connected to North Korea's Lazarus Group and a $1.4 billion exploit.
In several illicit activity categories—including scams, sanctioned jurisdictions, and terrorist financing—the processors' exposure exceeded that of all tracked cryptocurrency mixing services combined. A surge in illicit counterparties linked to both services occurred during late 2025, with more than 900 new counterparties in a single month.
Cryptomus had previously faced regulatory action in Canada. In October 2025, Canadian authorities imposed a CAD 177 million penalty for anti-money laundering and counter-terrorist financing violations.
TokenSpot and Sanctions-Evasion Network
Chainalysis identified connections between TokenSpot and Kyrgyzstani exchanges Grinex and Meer. Funds from all three exchanges converged on the same HTX deposit address, which received more than $308 million according to blockchain analysis.
The analysis also identified links to addresses affiliated with A7A5, a ruble-backed cryptocurrency associated with sanctions-evasion activity, and to an A7A5 instant swapper service that exchanges ruble-backed tokens for dollar-backed stablecoins.
Chainalysis noted similarities between the websites of TokenSpot and Meer, both operating Russian-language crypto-fiat exchange platforms with closely matching layouts. These similarities suggest shared infrastructure or operators, though website resemblance alone cannot establish common ownership.
Broader Sanctions Package
The UK's Foreign, Commonwealth & Development Office designated 38 entities on October 8. Beyond cryptocurrency services, authorities targeted Russian oil companies, financial institutions, military suppliers, and twelve shadow fleet tankers. The measures brought the total number of sanctioned vessels above 600.
