UK Targets Cryptomus, Heleket, TokenSpot in New Russian Sanctions

What it is

A Chainalysis analysis of the UK FCDO's October 8 sanctions package, which designated 38 entities including crypto payment processors Cryptomus and Heleket (both under parent Xeltox Enterprises Ltd) and Kyrgyzstani exchange TokenSpot CJSC — alongside non-crypto targets like Russian oil companies Zarubezhneft and INK Capital, bank Stolichny Kredit, twelve shadow fleet tankers, and seventeen individuals/entities tied to ballistic missile and drone component procurement.

How it works

Cryptomus and Heleket function as low-KYC payment processors rather than mixers, but Chainalysis found they received more illicit funds across tracked categories (scams, sanctioned jurisdictions, escort services, terrorist financing, EU 20th sanctions package) than all tracked mixers combined. Illicit counterparty counts surged past 900 in a single month in late 2025, a spike Chainalysis attributes partly to users migrating from the sanctioned Garantex exchange — many had accounts on both Garantex and Cryptomus/Heleket simultaneously before Garantex's takedown. TokenSpot's link to the A7A5 sanctions-evasion network is established two ways: a near-identical website template (layout, visual assets, value proposition) to Meer, and on-chain convergence of TokenSpot, Grinex, and Meer funds into one HTX deposit address, with ties to a leaked AnyKey LLC (Ilan Shor) address set and the A7A5 instant swapper.

Preconditions / Affected

Relevant to compliance teams screening counterparties connected to Cryptomus, Heleket, Xeltox Enterprises Ltd, TokenSpot, Grinex, Meer, HTX, or the A7A5 token/instant swapper — particularly firms with exposure to Kyrgyzstani or Russian-adjacent crypto-fiat rails.

What to do

• Treat Cryptomus and Heleket as high-risk payment rails comparable to mixers for AML screening, not as standard payment processors — the page notes Canada's FINTRAC fined Cryptomus a record CAD 177 million in October 2025 for AML/CFT violations.
• Flag any counterparty activity touching the shared HTX deposit address (>$308M aggregate from TokenSpot, Grinex, and Meer) as A7A5-network exposure.
• Watch for migration patterns where users of newly-sanctioned/seized services (e.g., Garantex) reappear on Cryptomus/Heleket.

Caveats

Chainalysis notes some illicit-counterparty growth may be an artifact of designation timing: once an entity is sanctioned, its past transactions retroactively count toward a service's illicit-counterparty tally even if those transactions occurred months or years earlier. The TokenSpot–Meer connection relies partly on visual/template similarity (common operator inference) rather than solely on-chain evidence, and intermediary wallets sit between several entities and the HTX convergence point, so the page describes the link as indirect in places.