The UK’s Foreign, Commonwealth & Development Office has imposed sanctions on crypto payment processors Cryptomus and Heleket, which operate under Xeltox Enterprises Ltd., along with Kyrgyzstani exchange TokenSpot CJSC. The measures were announced as part of a wider package aimed at Russia’s wartime economy, spanning the energy sector, military supply chains and the financial system.
According to Chainalysis, the three crypto businesses were not isolated targets. The firm said the action reflects a broader pattern in which payment processors and exchanges can become part of sanctions-evasion and illicit-finance networks linked to Russia.
Payment processors cited as major illicit hubs
Chainalysis said Cryptomus and Heleket had functioned as significant payment hubs for illicit activity before the UK designation. In the firm’s tracked dataset, the two services received more illicit funds than mixers, a notable marker because mixers are commonly associated with laundering activity.
The company said both platforms received funds from more than 15,000 illicit actors across categories including scams, sanctioned jurisdictions, escort services, terrorist financing and EU sanctions exposure. It also linked the services to criminal activity involving scam operators, fraud shops and organized crime networks.
Chainalysis added that illicit counterparties connected to Cryptomus and Heleket surged to 900 in late 2025. In its assessment, that pattern suggested continuing exposure to sanctioned and illicit networks rather than isolated historical activity.
TokenSpot tied to A7A5 sanctions-evasion network
Chainalysis said TokenSpot is connected to the A7A5 sanctions-evasion network, a link it based on transaction flows and other indicators. The firm reported that funds from TokenSpot, Grinex and Meer converged on the same HTX deposit address.
That address, Chainalysis said, received more than $308 million. The report also pointed to intermediary wallets feeding the same destination, with all three Kyrgyzstani exchanges described as funneling funds toward that address.
Beyond blockchain flows, Chainalysis said TokenSpot shared website-design similarities with Meer. It presented those similarities as additional evidence alongside the on-chain connections rather than as a standalone basis for the alleged link.
Sanctions package reaches beyond crypto
The UK measures were not limited to digital-asset businesses. The sanctions package also targeted actors tied to Russia’s oil sector, military procurement and financial infrastructure.
Among the designations were Zarubezhneft and INK Capital, which Chainalysis said brought the sanctions’ coverage to more than 90% of Russia’s total oil production. The package also included Stolichny Kredit bank, more than 600 sanctioned vessels, and 17 entities involved in importing machine tools, electronics and materials used in missile and drone production.
In that broader context, the crypto-related designations were presented as part of the same effort to disrupt financing and procurement channels that support Russia’s war economy.
What the designations indicate next
Chainalysis framed the UK action as another example of how crypto services can intersect with sanctions evasion and other illicit finance activity. It also referenced earlier evidence that drone procurement networks had used crypto fundraising.
For now, the confirmed development is the designation itself and the specific links Chainalysis says it has identified between the sanctioned firms and larger networks. The company said it will continue monitoring these flows and related entities as the networks evolve.
Source: www.chainalysis.com