UK Sanctions Cryptomus, Heleket and TokenSpot Over Links to Russia
Summary
The UK designated Cryptomus, Heleket and TokenSpot among 38 entities linked to Russia’s wartime economy and sanctions evasion. Chainalysis says the services received funds from illicit actors and traced TokenSpot-linked flows to an HTX deposit address.
Key points
- The UK’s Foreign, Commonwealth & Development Office designated 38 entities, including crypto processors Cryptomus and Heleket and Kyrgyzstani exchange TokenSpot.
- Chainalysis says Cryptomus and Heleket received funds from more than 15,000 illicit actors across tracked categories.
- The firm reports illicit counterparties using the two processors for activity linked to scams, fraud shops, ransomware groups and criminal marketplaces.
- Chainalysis found TokenSpot, Grinex and Meer funds converging on an HTX deposit address that received more than $308 million.
- The article links the exchange network to the A7A5 token and its instant swapper, and to addresses associated with AnyKey LLC.
- The UK sanctions package also targeted Russian oil companies, a bank, shadow-fleet tankers and entities tied to military supply chains.
Article Details
- Event Type
- UK sanctions designation of crypto payment processors Cryptomus and Heleket, Kyrgyzstani exchange TokenSpot, and other entities linked to Russia’s wartime economy, military supply chains, and sanctions evasion.
- Impact
- The UK designated 38 entities. Chainalysis reports that Cryptomus and Heleket received funds from more than 15,000 illicit actors across tracked categories, while funds from TokenSpot, Grinex, and Meer converged on an HTX deposit address that received more than $308 million. The designations also target Russian oil companies, a bank, shadow-fleet tankers, and military-industrial supply chains.
People
Threat Actors
Products
A7A5TokenSpot is closely connected to the A7A5 sanctions-evasion network.CryptomusThe UK designated crypto payment processors Cryptomus and Heleket, which operate under parent company Xeltox Enterprises Ltd., as well as Kyrgyzstani exchange TokenSpot CJSC.Garantextakedown of other illicit-friendly services, such as the 2025 dismantling of the Russian crypto exchange Garantex. Our data show that many users already had accounts on both Garantex and Cryptomus or HeleketGrinexChainalysis analysis shows funds from TokenSpot along with Grinex and Meer converging on the same HTX deposit address, which received more than $308 million.HeleketThe UK designated crypto payment processors Cryptomus and Heleket, which operate under parent company Xeltox Enterprises Ltd., as well as Kyrgyzstani exchange TokenSpot CJSC.HTXChainalysis analysis shows funds from TokenSpot along with Grinex and Meer converging on the same HTX deposit address, which received more than $308 million.MeerChainalysis analysis shows funds from TokenSpot along with Grinex and Meer converging on the same HTX deposit address, which received more than $308 million.TokenSpotThe UK designated crypto payment processors Cryptomus and Heleket, which operate under parent company Xeltox Enterprises Ltd., as well as Kyrgyzstani exchange TokenSpot CJSC.
Countries
KyrgyzstanTokenSpot, meanwhile, is part of a Kyrgyzstan-based sanctions evasion network with ties to the A7A5 token and its administrators, which Chainalysis has tracked since the Kyrgyzstani exchanges Grinex and Meer.kg wereNorth Koreaacross today’s illicit ecosystem. For example, funds from the $1.4 billion Bybit exploit attributed to North Korea’s Lazarus Group ultimately reached both services indirectly. And proceeds from ransomware groups suchRussiaThe UK’s latest sanctions target the broader infrastructure supporting Russia’s wartime economy.