The United Kingdom on 8 October 2026 added 38 new entries to its Russia sanctions list, with a portion of the package aimed at cryptocurrency exchanges and payment services suspected of helping Moscow route funds around existing restrictions.
The Foreign, Commonwealth and Development Office said the measures cover entities believed to support Russia’s wartime economy by moving money outside conventional banking channels.
Three crypto platforms and two payment businesses were designated, along with one individual linked to the activity. Three of the firms are registered in Kyrgyzstan.
The listed targets include Canada-registered Xeltox Enterprises Ltd, which the UK treats as the operator of the Cryptomus and Heleket brands as well as Certa Payments Ltd; Kyrgyzstan-based TokenSpot CJSC; Tsunami Payments LLC; and Processing KG, together with its director Ulan Arymbaevich Bukabaev.
British authorities stated that two of the platforms had processed or facilitated transactions involving the A7 network, a Kremlin-linked arrangement used to bypass restrictions on Russia’s financial sector.
The network has claimed it moved more than $90 billion in the previous year, a figure roughly equivalent to half of Russia’s annual military outlays.
The designations freeze assets under UK jurisdiction and bar British persons and firms from providing funds, payment processing, or correspondent services.
Blockchain analytics firms had already mapped connections among several of the named services.
TRM Labs reported in April 2026, with high confidence, that Cryptomus and Heleket functioned as operationally linked services under the same corporate umbrella.
Heleket appeared in January 2025 as a parallel offering that shared infrastructure, personnel, branding elements, and liquidity sources with Cryptomus; early volume on both was tied in part to the previously sanctioned exchange Garantex.
TRM data indicated Cryptomus had received more than $204 million from Garantex and sent roughly $101 million in the other direction, while Heleket’s cumulative on-chain activity exceeded $2.89 billion, with the UK-sanctioned platform Rapira among its largest counterparties of concern.
Two days before the UK announcement,
TRM assessed with high confidence that TokenSpot operated as a front sharing wallet infrastructure with Grinex, itself viewed as a successor to Garantex.
The firms used overlapping TRON deposit, collection, and fee addresses and had announced coordinated technical pauses. Across the period examined,
TokenSpot sent more than $950 million combined to Grinex, Garantex, and the A7 network, including hundreds of millions after earlier UK designations of the Russian exchanges.
TRM noted that successor or parallel brands have repeatedly absorbed flows once pressure rose on an earlier service.
Chainalysis, in its own review published the same day, found that Cryptomus and Heleket together had received funds from more than 15,000 distinct illicit counterparties spanning scams, ransomware, sanctioned jurisdictions, and other categories—volumes that in several tracked areas exceeded those of mixing services.
Activity surged in late 2025.
On TokenSpot, Chainalysis traced funds that, together with flows from Grinex and Meer, converged on a single HTX deposit address that had received more than $308 million, with additional links to infrastructure associated with the ruble-backed A7A5 token.Industry commentary followed quickly.
TRM Labs noted on X that its earlier public assessments had already connected Cryptomus with Heleket and TokenSpot with Grinex.
Chainalysis posted that the designations illustrated how certain crypto services sit at the junction of broader illicit networks and infrastructure supporting Russia’s wartime economy, and that continued monitoring would track how actors adapt.
On LinkedIn, Snir Levi of Nominis observed that his firm had flagged Cryptomus and related low-control processors as early as 2024, well before regulatory fines or the latest listings, and that flows simply shifted to Heleket once scrutiny on the first brand increased.
He argued that on-chain patterns surface the risk before formal designations and that rebrands rarely signal a change in underlying behavior.
The October package sits within a longer series of UK actions against crypto channels tied to Russian evasion, including earlier designations of Grinex and related Kyrgyz infrastructure. Compliance teams are now expected to screen the named brands and related addresses, and to watch for new services that inherit the same wallets or liquidity.