From CryptoPotato · By Wayne Jones
The UK sanctioned crypto payment processors Cryptomus and Heleket and Kyrgyzstani exchange TokenSpot on October 8, after blockchain analytics firm Chainalysis linked the services to illicit financial flows and networks associated with Russia’s sanctions evasion.
The designations target parts of the infrastructure used to move money through crypto, including payment services that received funds from thousands of illicit counterparties and exchanges connected to a ruble-backed token network.
Chainalysis Traces Illicit Funds Through Three Crypto Services
In an analysis published alongside the announcement, Chainalysis reported that Cryptomus and Heleket, both operated by Xeltox Enterprises Ltd., had received funds from more than 15,000 distinct illicit counterparties across every criminal category tracked by the firm.
In several categories, including scams, sanctioned jurisdictions and terrorist financing, their illicit inflows exceeded those received by all mixing services in its dataset combined.
Illicit counterparties linked to the two processors increased to more than 900 in a single month in late 2025. Chainalysis suggested the closure of Russian exchange Garantex may have contributed, as some users already held accounts with Cryptomus or Heleket. The firm cautioned that new sanctions designations can also cause historical transactions to be reclassified as illicit exposure.
Cryptomus had also advertised crypto payments and conversions without know-your-customer (KYC) or know-your-business (KYB) checks on Russian-language cybercrime forum BHF and the Nulled forum, Chainalysis reported. In October 2025, Canada’s financial intelligence unit imposed a CAD 177 million penalty on Cryptomus for anti-money laundering and counter-terrorist financing violations.
TokenSpot’s connections followed a different route. Chainalysis traced funds from the Kyrgyzstani exchange, alongside those from previously sanctioned exchanges Grinex and Meer, to a shared HTX deposit address that received more than $308 million.
The firm identified links to addresses associated with Moldovan businessman Ilan Shor and the A7A5 instant swapper, which exchanges ruble-backed tokens for dollar-backed stablecoins.
Earlier Cases and the Wider Package
As CryptoPotato reported earlier, Grinex was set up in Kyrgyzstan in December 2024 and presented as a replacement for Garantex, which processed over $100 billion in transactions while sanctioned.
In April, Grinex suspended operations after a hack that took more than 1 billion rubles, about 13.74 USDT, and TokenSpot reportedly went offline around the same time. HTX, formerly Huobi, was sanctioned by the UK in May for channeling more than $1.5 billion to Russia.