UK Sanctions 3 Crypto Firms as Chainalysis Traces $308M in Flows

TLDR:

The UK sanctioned Cryptomus, Heleket, and TokenSpot over links to Russia’s wartime economy.

Chainalysis linked Cryptomus and Heleket to more than 15,000 distinct illicit counterparties.

TokenSpot, Grinex, and Meer sent funds toward an HTX deposit address receiving over $308 million.

The sanctions also target Russian oil, military supply chains, financial institutions, and shadow fleet tankers.

The UK sanctioned three crypto firms on October 8 over alleged links to Russia’s wartime economy and sanctions evasion. The targets include payment processors Cryptomus and Heleket, operated by Xeltox Enterprises Ltd., and Kyrgyzstani exchange TokenSpot CJSC.

Blockchain analytics firm Chainalysis identified extensive connections between these services and illicit financial networks. Its analysis found that Cryptomus and Heleket received funds from more than 15,000 distinct illicit counterparties.

Separately, TokenSpot was linked to a network of exchanges funneling funds toward an HTX deposit address that received over $308 million.

What the UK Crypto Sanctions Reveal About Illicit Finance

The UK’s Foreign, Commonwealth & Development Office designated 38 entities on October 8. The measures target organizations accused of supporting Russia’s wartime economy, military supply chains, and sanctions evasion.

According to Chainalysis, Cryptomus and Heleket received funds associated with scams, ransomware, fraud shops, and organized criminal networks. Their transaction histories also included indirect flows connected to North Korea’s Lazarus Group and the $1.4 billion Bybit exploit.

Chainalysis found that both processors received funds from more than 15,000 distinct illicit counterparties. In several categories, their exposure exceeded that of all tracked cryptocurrency mixing services combined.

These categories included scams, sanctioned jurisdictions, terrorist financing, and other illicit activity. Mixers deliberately obscure transaction trails, while payment processors typically facilitate cryptocurrency transfers and conversions.

The findings raise concerns about how services presented as legitimate payment providers can facilitate illicit financial flows. Weak identity verification and compliance controls can make it easier for criminal actors to move cryptocurrency through these platforms.

Chainalysis also reported a surge in illicit counterparties linked to both services during late 2025. The number exceeded 900 in a single month, although newly designated entities may have contributed to the increase.

The analysis suggests that enforcement actions against other services may have redirected activity. Following the dismantling of Russian exchange Garantex in 2025, some users may have shifted activity toward Cryptomus and Heleket.

Cryptomus had also faced regulatory action in Canada. In October 2025, FINTRAC imposed a CAD 177 million penalty for anti-money laundering and counter-terrorist financing violations.

Earlier today, the UK sanctioned three crypto services linked to Russia’s wartime economy. Our data reveals how they fit into a broader illicit financial ecosystem.

The UK designated crypto payment processors Cryptomus and Heleket, both operated by parent company Xeltox… pic.twitter.com/jP02BhPKvD

— Chainalysis (@chainalysis) October 9, 2026

How TokenSpot Connects to Russia’s Sanctions-Evasion Network

Chainalysis identified connections between TokenSpot and Kyrgyzstani exchanges Grinex and Meer. Both exchanges were linked to the broader network surrounding A7A5, a ruble-backed cryptocurrency associated with sanctions-evasion activity.

Blockchain transaction analysis showed funds from all three exchanges converging on the same HTX deposit address. That address received more than $308 million, according to Chainalysis Reactor analysis.

The firm also identified connections to addresses affiliated with Ilan Shor and the A7A5 instant swapper. This service allows users to exchange ruble-backed A7A5 tokens for dollar-backed stablecoins.

Chainalysis further noted similarities between the websites of TokenSpot and Meer. Both operate Russian-language crypto-fiat exchange platforms with closely matching layouts and visual elements. These similarities suggest shared infrastructure or operators, although website similarities alone cannot establish common ownership.

The UK’s sanctions package also extends beyond cryptocurrency. Authorities targeted Russian oil companies, financial institutions, military suppliers, and twelve shadow fleet tankers. The measures brought the total number of sanctioned vessels above 600.

For crypto traders and businesses, the designations demonstrate how blockchain transaction trails can expose links between seemingly separate services. Exchanges and payment providers connected to sanctioned entities may face heightened compliance scrutiny.

The post UK Sanctions 3 Crypto Firms as Chainalysis Traces $308M in Flows appeared first on Blockonomi.