UK sanctions three crypto firms as Chainalysis traces $308 million flows

What happened

The UK sanctioned three crypto firms on October 8 over suspected links to Russia's wartime economy and sanctions evasion. The targets were Cryptomus and Heleket, two payment processors run by Xeltox Enterprises Ltd., and TokenSpot CJSC, an exchange based in Kyrgyzstan. The Foreign, Commonwealth & Development Office named 38 entities that day.

Chainalysis published an analysis alongside the announcement. It said Cryptomus and Heleket had received funds from more than 15,000 distinct illicit counterparties across every criminal category the firm tracks. In categories including scams, sanctioned jurisdictions and terrorist financing, their illicit inflows beat those of all mixing services in its dataset combined.

Why it matters

The designations reach parts of the infrastructure used to move money through crypto, including payment services that took funds from thousands of illicit counterparties and exchanges tied to a ruble-backed token network. That puts payment processors, not just mixers, inside the flows that sanctions enforcers are targeting.

Chainalysis said its findings raise questions about how services that present themselves as legitimate payment providers can carry illicit money. It said weak identity verification and compliance controls make it easier for criminal actors to move crypto through these platforms. Cryptomus had advertised payments and conversions without know-your-customer or know-your-business checks on Russian-language cybercrime forums, the firm reported.

What the data shows

Chainalysis traced funds from TokenSpot, Grinex and Meer to one shared HTX deposit address that received more than $308 million. It also found links to addresses tied to Moldovan businessman Ilan Shor and to the A7A5 instant swapper, which turns ruble-backed tokens into dollar-backed stablecoins.

Illicit counterparties linked to the two processors rose to more than 900 in one month in late 2025, and Chainalysis suggested Garantex's closure may have contributed, since some users already held accounts with Cryptomus or Heleket. Garantex processed over $100 billion in transactions while sanctioned. Their transaction histories also included indirect flows tied to North Korea's Lazarus Group and the $1.4 billion Bybit exploit. In October 2025, Canada's financial intelligence unit fined Cryptomus CAD 177 million. The UK sanctioned HTX in May for channeling more than $1.5 billion to Russia.

What is still unclear

• Chainalysis cautioned that new designations can cause historical transactions to be reclassified as illicit exposure, so the reported totals may change as older activity is reassessed.
• Grinex suspended operations in April after a hack that took more than 1 billion rubles, and TokenSpot reportedly went offline around the same time. The reports do not say whether TokenSpot is still active.

Questions readers ask