Quick overview
This is some text inside of a div block.
Friday, October 9, 2026
UK sanctions Cryptomus, Heleket, and TokenSpot without listing wallet addresses
Global News.png){kind=logo}
Standfirst: The UK's notice names the platforms but not a single wallet. Scorechain already attributes 122,666 addresses to them, and one Cryptomus hot wallet sent 740,000 USDT in the 20 hours after the designation.
The UK added Cryptomus, Heleket, and TokenSpot to the UK sanctions list on October 8, 2026, in a package aimed at crypto and payment platforms it suspects Russia used to circumvent financial sanctions. The notice does not include a single wallet address, so detection depends on entity attribution, not address lists. Scorechain attributes 122,666 addresses to the three brands. Their on-chain record shows what the notice only describes: TokenSpot trading with sanctioned Russian exchanges, Cryptomus funds moving to Heleket, and a Cryptomus hot wallet still paying out after the announcement.
Yes. On October 8, 2026 the UK designated XELTOX ENTERPRISES LTD, also listed as Certa Payments Ltd, Cryptomus, and Heleket, under the Russia (Sanctions) (EU Exit) Regulations 2019. The designation took effect on publication and brings an asset freeze, Internet Services Sanctions, and a ban on UK financial institutions processing payments to, from, or via the company.
The Foreign, Commonwealth and Development Office (FCDO) added 38 designations to its Russia list that day, including three crypto exchanges, two payment platforms, and one linked individual. It says two of them "have processed and facilitated transactions with the A7 network". Scorechain covers two of the designated platforms: Xeltox, listed with the websites cryptomus.com and heleket.com, and TokenSpot CJSC, a closed joint stock company in Bishkek, Kyrgyzstan.
Both entries also carry Trust Services Sanctions, a Director Disqualification Sanction, and Correspondent Banking Sanctions. No general licence was issued to wind down dealings with the crypto platforms.
According to the UK Sanctions Notice, Cryptomus is owned by XELTOX ENTERPRISES LTD, a company registered in British Columbia (registration number BC1368872) with an address in Vancouver, Canada. The UK's statement of reasons cites "its ownership of CRYPTOMUS and activities linked to and continued via HELEKET", which places both brands under the same designated entity.
This is not the company's first regulatory action. In October 2025, Canada's Financial Transactions and Reports Analysis Centre (FINTRAC) imposed an administrative monetary penalty of C$176,960,190 on Xeltox Enterprises Ltd., operating as Cryptomus. FINTRAC found that the company failed to submit suspicious transaction reports on 1,068 occasions in July 2024, for transactions linked to fraud, ransomware payments, and sanctions evasion, among other offences.
Screen at entity level. When a designation names a platform but publishes no addresses, address-list matching flags nothing. Detection depends on whether the platform's addresses were already attributed to a known entity, and whether that entity is now marked as sanctioned, so that exposure to any of its addresses raises a sanctions alert.
In Scorechain, the three brands break down as follows:
Together they span 13 blockchains. All three entities now carry the UK designation in Scorechain, so exposure to any of these addresses triggers the Sanction List risk indicator in transaction monitoring and wallet screening.
Entity-level screening is one part of a wider control set. Scorechain's guide to crypto sanctions screening covers list management, alert handling, and how address and name screening work together.
The FCDO describes the A7 network as a Kremlin-backed illicit finance network used to circumvent sanctions against the Russian financial sector, and says it claimed to have moved more than $90 billion last year. Grinex, the exchange at the centre of the network, is sanctioned by the US, the UK, and the EU. The UK designated it in August 2025, alongside the infrastructure behind the rouble-backed A7A5 token.
TokenSpot's identified wallet received and sent about $1.97 billion in USDT on Tron between February 14, 2024 and June 21, 2026, across 20,880 USDT transfers. Scorechain's fund-flow analysis of its stablecoin activity shows exposure to sanctioned Russian exchanges in both directions:
That pattern fits the FCDO's statement that two of the designated platforms processed A7 transactions.
The largest inflows to the wallet came from addresses that TokenSpot's own wallet had funded first, the usual pattern for deposit addresses that sweep customer funds into a platform's main wallet. Four of these deposit addresses alone sent $417.6 million into it.
The UK designated Xeltox for its ownership of Cryptomus and for activities continued via Heleket, and the on-chain record shows funds moving between the two brands. One Cryptomus hot wallet, active since December 3, 2024, has received $341.8 million in USDT and sent $19.4 million to Heleket-attributed addresses over 97 transfers.
A second Cryptomus hot wallet received $376.6 million in USDT between June 2022 and August 2026. About $11.4 million of that USDT traces back to Garantex Europe, $7.7 million of it directly.
The Cryptomus hot wallet active since December 2024 kept moving funds after the FCDO published the designations at 11:21 UTC on October 8, 2026. It sent 190,000 USDT at 13:09 UTC, 50,000 USDT at 22:06 UTC to a deposit address at a centralised exchange, and 500,000 USDT at 06:51 UTC on October 9. That is 740,000 USDT in three transfers within 20 hours. On October 9 the wallet still held about 1.18 million USDT and 4.0 million TRX, roughly $2.5 million at that day's TRX price of about $0.33.
Scorechain attributes addresses to entities ahead of official lists and updates those entities when a designation names them. An action like this one, with no addresses published, still surfaces in transaction monitoring and wallet screening. Cryptomus.com, Heleket.com, and TokenSpot now carry the UK designation and the Sanction List risk indicator.
For investigations, the Exploration Tool, Flux Analysis, and Graph Analysis show who a sanctioned platform paid and who paid it. That is where the Grinex, Garantex, and Heleket links in this article came from.
To see how entity-level screening would flag exposure to Cryptomus, Heleket, and TokenSpot in your own flows, book a demo with Scorechain.
Yes. Since October 8, 2026 the UK has listed XELTOX ENTERPRISES LTD, with the aliases Certa Payments Ltd, Cryptomus, and Heleket, under its Russia sanctions regime.
XELTOX ENTERPRISES LTD, a British Columbia company based in Vancouver, Canada, according to the UK Sanctions Notice.
Not if they are UK persons or UK financial institutions: the asset freeze and payment ban apply, and no general licence was issued. Firms elsewhere should check their own obligations.
Screen at entity level, using addresses already attributed to the designated platform. In Scorechain, 122,666 addresses attributed to Cryptomus, Heleket, and TokenSpot now carry the Sanction List risk indicator.
