On October 8, the United Kingdom government designated cryptocurrency payment processors Cryptomus and Heleket, along with Kyrgyzstani exchange TokenSpot, under its sanctions regime after blockchain analytics firm Chainalysis linked the platforms to illicit financial networks supporting Russian sanctions evasion.
Chainalysis Exposes 15,000 Illicit Counterparties
Both Cryptomus and Heleket are operated by Xeltox Enterprises Ltd. According to Chainalysis, the two processors received funds from more than 15,000 distinct illicit counterparties across every criminal category tracked by the firm. In categories including scams, sanctioned jurisdictions, and terrorist financing, their combined illicit inflows exceeded those of all mixing services in the Chainalysis dataset combined.
Illicit counterparties connected to the two platforms spiked to over 900 in a single month in late 2025, a shift attributed in part to users migrating after the closure of Russian exchange Garantex. Cryptomus actively advertised payment and conversion services without know-your-customer (KYC) or know-your-business (KYB) checks on Russian-language cybercrime forum BHF and the Nulled forum. Prior to the UK action, Canada's financial intelligence unit levied a CAD 177 million penalty against Cryptomus in October 2025 for anti-money laundering and counter-terrorist financing infractions.
TokenSpot and the $308 Million HTX Deposit Address
The enforcement against TokenSpot followed a separate tracking path. Chainalysis traced funds from TokenSpot, as well as previously sanctioned exchanges Grinex and Meer, to a shared HTX deposit address that accepted over $308 million. The analysis highlighted connections to Moldovan businessman Ilan Shor and A7A5, an instant swapper that converts ruble-backed tokens into dollar-backed stablecoins. As international enforcement tightens, crypto platforms face mounting compliance demands, similar to how ESMA established strict timelines for non-compliant stablecoins in Europe.
Grinex was founded in Kyrgyzstan in December 2024 to replace Garantex, which had processed more than $100 billion while under sanctions. Grinex halted operations following a hack that drained over 1 billion rubles, and TokenSpot reportedly went offline around April. HTX (formerly Huobi) was previously sanctioned by the UK in May for directing more than $1.5 billion to Russia.
The broader UK sanctions package also targeted oil entities Zarubezhneft and INK Capital, pushing UK coverage past 90% of Russia's oil production capacity, alongside Stolichny Kredit bank, 12 shadow fleet tankers, and 17 individuals and entities involved in importing machinery and missile components.
Key Takeaways
- Targeted Platforms: The UK sanctioned Cryptomus, Heleket, and TokenSpot on October 8.
- Massive Counterparty Footprint: Xeltox Enterprises Ltd. platforms processed funds from over 15,000 illicit counterparties.
- Shared Deposit Hub: TokenSpot and related exchanges routed more than $308 million through a single HTX deposit address.
Why It Matters
This enforcement action highlights how Western authorities are expanding focus beyond primary exchanges toward nested payment processors and regional off-ramps. By mapping shared deposit infrastructure across exchanges like TokenSpot and HTX, regulators are restricting the conversion of ruble-pegged assets into global stablecoins. Moving forward, compliance demands will force international exchanges to tighten monitoring on multi-hop deposit addresses and unverified payment gateways.
