The United Kingdom has sanctioned cryptocurrency platforms Cryptomus, Heleket and TokenSpot as part of 38 new Russia-related designations targeting financial services, payment networks, oil companies and suppliers linked to Moscow’s war in Ukraine.
Summary
- The UK has sanctioned Cryptomus, Heleket and TokenSpot under a package of 38 Russia related designations targeting financial services and payment networks.
- TRM Labs found that Cryptomus and Heleket shared infrastructure and liquidity sources, with both services processing transactions involving sanctioned exchanges.
- TokenSpot transferred more than $950 million combined to A7, Garantex and Grinex, according to blockchain transaction data examined by TRM Labs.
- The sanctions require UK persons to freeze assets belonging to designated entities, while internet service restrictions apply to several of the listed payment platforms.
According to an October 8 TRM Labs report shared with crypto.news, the measures cover cryptocurrency exchanges and payment companies suspected of helping Russia bypass financial sanctions, including platforms connected to the Kremlin-backed A7 financial network.
The UK’s Foreign, Commonwealth and Development Office imposed the restrictions under the Russia (Sanctions) (EU Exit) Regulations 2019. The package covers 12 shadow fleet tankers, two Russian oil companies and 17 individuals and entities involved in supplying goods used by Russia’s military industry.
Among the financial targets are Canadian company Xeltox Enterprises Ltd, which operates Cryptomus, Kyrgyzstan-based TokenSpot, Tsunami Payments and Processing KG, along with Russian companies Planeta and commercial bank Stolichny Kredit.
British authorities listed Cryptomus, Heleket and Certa Payments as names associated with Xeltox, treating the services under a single sanctions designation. TokenSpot received a separate listing following research connecting its operations to previously sanctioned Russian cryptocurrency exchange Grinex.
UK sanctions target Cryptomus and its links to Heleket
Xeltox Enterprises was designated for supporting Russia’s financial services sector through its ownership of Cryptomus and operations connected to Heleket.
In April 2026, TRM Labs assessed with high confidence that the two cryptocurrency payment services shared operational infrastructure, personnel, branding and liquidity sources.
Heleket began operating in January 2025, shortly before Cryptomus introduced mandatory know your customer checks in February. Cryptomus subsequently recorded a decline in monthly onchain transaction volume from $153 million in January to $86 million in March, while activity on Heleket grew.
Both services used a 0.4% processing fee and shared unusual wording across their websites. Investigators identified Garantex as an early liquidity provider to both platforms.
The blockchain intelligence firm’s findings linked the services to transactions involving sanctioned exchanges and illicit cryptocurrency activity.
During 2025, illicit transactions accounted for 0.6% of Heleket’s incoming volume, nearly five times the average observed among payment service providers in TRM’s dataset. Sanctions-related entities, primarily Garantex, represented 60% of those illicit inflows.
By April 2026, Cryptomus had received $1.86 billion and sent $1.63 billion in onchain transactions. Garantex was its largest sanctioned counterparty, accounting for more than $204 million received by Cryptomus and $101 million sent to the exchange.
Heleket had processed over $2.89 billion in transactions as of October 2026, with previously sanctioned exchange Rapira identified as its largest sanctioned counterparty.
Xeltox has faced regulatory action outside the UK. Canada’s financial intelligence agency FINTRAC imposed a penalty of nearly CAD 177 million against the company in October 2025 over alleged violations of anti-money laundering and terrorist financing requirements. The company is appealing the penalty.
TokenSpot transferred hundreds of millions to sanctioned networks
TokenSpot’s designation followed an October 6 investigation that connected the Kyrgyzstan-based exchange to Grinex, which TRM identified as a likely successor to Garantex.
Investigators assessed with high confidence that TokenSpot operated as a front company for Grinex after finding shared cryptocurrency wallets and coordinated exchange activity.
Following an April 2026 security incident, Grinex publicly identified an aggregator wallet as its own. Blockchain records showed the address had received $146.3 million from 126 TokenSpot deposit addresses.
Six TRON blockchain addresses were attributed to both exchanges, while another address collected remaining TRX balances used for transaction fees.
On April 15, Grinex announced a technical interruption. TokenSpot informed customers of maintenance work just 25 minutes later.
Between December 8, 2023, and September 27, 2026, TokenSpot’s TRON addresses received $3.54 billion and sent $3.14 billion.
The A7 network was TokenSpot’s largest external counterparty. TokenSpot transferred $679.5 million to A7 and received $48.5 million in return, while another $26.5 million went directly to the A7A5 token.
After the UK sanctioned Garantex and Grinex, TokenSpot sent $269.2 million to the two exchanges and received $285.7 million from them.
TRM calculated that TokenSpot had transferred more than $950 million combined to A7, Garantex and Grinex.
In April 2026, Grinex suspended trading after reporting the theft of approximately $13.7 million from 54 cryptocurrency wallets. The exchange described the incident as a sophisticated cyberattack and alleged that the attackers had access to resources associated with foreign intelligence agencies.
The connections between Garantex and Grinex had been examined before the latest UK action. In March 2025, crypto.news previously reported that blockchain investigators had traced customer funds and liquidity moving from Garantex to Grinex after the former stopped operating.
Kyrgyzstan payment firms face restrictions over Russia ties
Three of the newly designated financial companies are registered in Kyrgyzstan, where investigators have identified infrastructure connected to Russian payment services and the A7 network.
Tsunami Payments, a Bishkek-based company, was sanctioned for supporting Russia’s financial services sector.
Its registered office is located in the same building as TokenSpot, according to the UK sanctions records. Historical Kyrgyz corporate records cited by TRM identified Melis Batyrbekovich Umarhodjaev as a director of both businesses, although he was no longer listed in the Justice Ministry registry as of September 2026.
Processing KG, another Kyrgyz company, was designated for conducting business considered economically significant to the Russian government.
The UK sanctions entry identifies the Kyrgyz Ministry of Finance as its parent company and lists processing-kg.com and vexpay.net among its websites.
British authorities sanctioned Processing KG director Ulan Arymbaevich Bukabaev.
An early October Financial Times investigation described VexPay as a payment system presented by A7 representatives to Kyrgyz officials in 2025 as an alternative to the SWIFT international banking messaging network.
The UK designated Russian payment company Planeta, known as Planeta 365, and Moscow-based commercial bank Stolichny Kredit within the same package.
UK restrictions cover crypto assets and internet services
Under the new sanctions, UK persons must freeze funds and economic resources owned or controlled by designated individuals and entities. They are prohibited from making funds or economic resources available to them unless permitted under applicable sanctions rules.
The government imposed internet services sanctions on Xeltox, TokenSpot, Tsunami Payments, Processing KG and Planeta.
These measures require social media providers, internet access companies and app stores to take reasonable steps to prevent users in the UK from accessing the designated entities’ online content, websites and applications.
The October action follows previous UK sanctions against Garantex in May 2022 and Grinex in August 2025.
In May 2026, Britain’s sanctions against Huobi Global targeted suspected financial services involving A7 and Garantex. The measures covered 18 individuals and entities, including cryptocurrency platforms HTX, Exmo, Bitpapa and Rapira.
The European Union subsequently imposed transaction bans on 14 cryptocurrency-related platforms in third countries under its 21st sanctions package in July 2026 and designated four entities linked to A7.
In August, Binance restricted transactions involving 11 cryptocurrency platforms, including HTX, Rapira, Bitpapa and EXMO, following sanctions-related regulatory measures.
TRM’s compliance guidance recommends reviewing historical transactions involving the newly sanctioned platforms, including indirect exposure through shared wallet infrastructure.
For Cryptomus and Heleket, the research identified direct transactions between the services and continued use of some common infrastructure. In TokenSpot’s case, investigators traced shared deposit collection and fee management addresses connecting the exchange to Grinex.
Powered by WPeMatico
