A payment processor introduces identity checks. Activity falls. A parallel service grows, offering a route that researchers say remains usable without those checks. Months later, authorities sanction the corporate entity and explicitly name both services.

That is the central thread in the Cryptomus–Heleket case. It makes this more useful than another headline about cryptocurrency and Russian money: the evidence shows how investigators can follow an operation across corporate names, customer-facing brands, and changing transaction flows.

Brian Krebs brought renewed attention to the case in his October 14 report on the UK sanctions. The strongest starting point for understanding what changed is the designation itself.

The Official Record Connects the Names

On October 8, 2026, the UK designated Xeltox Enterprises Ltd., reference RUS3755. Its entry lists Certa Payments Ltd., Cryptomus, and Heleket as name variations. The stated grounds concern suspected support for Russia through the financial-services sector, specifically mentioning ownership of Cryptomus and activities continued through Heleket. This is an administrative sanctions designation based on reasonable grounds for suspicion, not a criminal conviction. Source: UK sanctions notice, pages 4–5.

The entry imposes an asset freeze and additional measures covering trust services, director disqualification, internet services, and correspondent banking and payment processing. Its internet provisions concern specified providers, including social media, internet access, and application stores; they should not be paraphrased as an undifferentiated ban on every internet service. Source: UK sanctions notice.

For investigators, that official connection is valuable. A screening system that recognizes only the consumer brand can miss the contracting company. A vendor review that checks only the company name can miss the service actually handling payments.

Store those identities as a connected record, with the designation reference, source date, and provenance. They should remain searchable individually without losing the relationship between them.

What Canada Had Already Found

Canada’s financial intelligence unit, FINTRAC, confirmed a CAD 176,960,190 administrative monetary penalty against Xeltox on October 16, 2025, and published it on October 22. Its notice records 2,593 instances across six violation types, including 1,068 failures to submit suspicious transaction reports and 1,518 failures to report qualifying large virtual-currency receipts. It says Xeltox appealed to the Federal Court. The notice does not establish the appeal’s eventual outcome. Source: FINTRAC penalty notice.

FINTRAC described suspicious transactions involving darknet markets, ransomware proceeds, fraud, child sexual abuse material, and suspected sanctions evasion. It also found inadequate compliance policies and risk assessment. The regulator said the Vancouver operating address was associated with a mailbox service and that the company had no employees working in Canada during its March 2025 examination. Source: FINTRAC.

These are findings about reporting and compliance failures. The penalty amount is not a measurement of money laundered, and incorporation in Canada does not by itself establish where operational decisions were made.

For a counterparty assessment, a registration entry answers one question: which entity registered? It does not answer whether the institution actually identifies customers, investigates suspicious payments, or maintains usable records.

The Timeline Changes the Story

There is an important trap in describing Heleket as a service launched after the Canadian fine.

TRM Labs’ profile, last updated April 20, 2026, places Heleket’s launch between January and March 2025. It dates Cryptomus’s mandatory know-your-customer (KYC) controls to February 2025. Both precede the October penalty confirmation. The defensible sequence is regulatory pressure and identity checks, followed by evidence of parallel activity; the public chronology does not support saying the confirmed fine caused Heleket’s creation. Source: TRM Labs.

TRM assessed a common operation using shared liquidity relationships, distinctive website language, personnel overlap, and transaction patterns. It reported that Heleket activity increased as Cryptomus volumes declined, and that payment processing remained possible without identity documents despite Heleket’s published policy. These are attributed research observations, not tests performed by Hive Security. Source: TRM Labs.

The analytical lesson is to combine evidence types. Similar web design alone is weak: businesses reuse templates. A common upstream provider alone is also inconclusive. When independent operational, personnel, and financial observations align, the connection becomes more persuasive.

That still leaves boundaries. Evidence connecting two platforms does not identify every beneficial owner, establish every customer’s intent, or prove that every transfer was criminal.

Why a Payment Processor Matters to Network Defenders

Chainalysis reported on October 8 that the services had handled payments for malicious infrastructure vendors, including providers of bulletproof hosting, proxies, malware, and distributed denial-of-service services. It also described ransomware-related flows. This places the processors in the purchasing infrastructure of cybercrime, beyond the final movement of stolen funds. Source: Chainalysis.

That distinction changes the investigation. When examining an abusive hosting account, a payment receipt can connect infrastructure purchases to an account identifier or another service. When examining extortion, a transaction can become a lead into the supporting payment network. Neither observation requires assuming that the processor conducted the intrusion.

The relevant chain is:

Victim or infrastructure payment → transaction → receiving service → merchant or customer account → related records.

Each arrow needs evidence. A public blockchain can expose transfers, while the mapping from a deposit address to a particular customer may require provider records or lawful investigative access. A service-level attribution must not silently become attribution to an individual.

This complements the evidence-preservation approach in How Europol Is Catching Cybercriminals in 2026: payment details become more useful when retained alongside messages, infrastructure records, and reliable timestamps.

Read the Blockchain Numbers Carefully

Chainalysis says the two services received more illicit funds than all mixers it tracked combined within the categories used in its comparison. That does not establish a comparison against every mixer, every asset, or all laundering worldwide. Its report also warns that new sanctions designations can cause historical transactions to enter illicit-counterparty counts. A rising count can therefore reflect new classification as well as new activity. Source: Chainalysis.

Before using a number in an escalation, record the measurement date, time window, attribution source, direct or indirect exposure, and category definition. Keep total platform volume separate from identified illicit volume.

Otherwise, a dashboard can turn an indirect historical connection into an apparently current criminal payment. That is poor evidence for an investigator and a poor basis for restricting a customer.

Sanctions Create Pressure; Shutdown Requires Evidence

An administrative penalty and a sanctions designation work differently. The former penalizes compliance failures. The latter imposes restrictions that counterparties must implement within the relevant legal scope.

OFSI’s general guidance says UK financial sanctions apply within UK territory and to UK persons worldwide, cover cryptoassets, and can extend to entities owned or controlled by designated persons. An asset freeze does not transfer ownership or itself confiscate the assets. Specific prohibitions, exceptions, and licensing provisions require separate assessment. Source: OFSI general guidance.

Operationally, sanctions can put pressure on an ecosystem by changing which counterparties can continue serving it. They do not provide a global switch that prevents blockchain transfers.

To claim the operation has stopped, investigators would need subsequent evidence: sustained transaction changes, inaccessible processing infrastructure, loss of counterparties, or other verified disruption. A designation announcement alone proves the legal action. It does not prove its eventual operational effect.

What Teams Should Change

The following are operational recommendations derived from the case. They are intended for organizations with relevant payment, supplier, or incident exposure.

OwnerActionEvidence that the action worked
Sanctions complianceReconcile the designated legal entity, aliases, and reference with the screening system; have counsel determine applicable restrictions and ownership or control questions.Controlled screening cases recognize each listed name and reach the documented review workflow.
Finance and procurementIdentify whether an existing merchant, supplier, or payment integration uses either service, including through an intermediary. Escalate matches before further affected activity.The inventory names the actual processor, contracting entity, business owner, and disposition for each match.
Payment engineeringImplement compliance-approved holds at the transaction authorization layer, including scheduled jobs and retries. Preserve the records needed for review.Synthetic tests show that affected transactions cannot leave through an alternate integration or retry queue.
Incident responsePreserve payment requests, receipts, transaction hashes, asset and network, addresses, UTC timestamps, and associated communications.An analyst can reconstruct the payment request and transfer without relying on an explorer screenshot alone.
Threat intelligenceMaintain sourced relationships between brands, entities, and attributed infrastructure; distinguish official aliases from analytical hypotheses.Every relationship has a source and date, and analysts can explain its confidence and limits.

Do not send a test payment to a designated service to verify a control. Use synthetic cases and internal records. If funds are already held, route handling to compliance; do not automatically refund, withdraw, or move them as a cleanup action. OFSI’s guidance explains the restrictions on dealing with frozen assets and the licensing framework. Source: OFSI.

For a ransomware response, transaction tracing supports investigation and sanctions assessment. It does not remediate the intrusion. Keep the financial evidence work connected to the incident while continuing containment, entry-point investigation, and recovery.

Follow the Operation Across the Name Change

The useful question is what remains continuous when the name changes: who operates the service, which customers move, where liquidity comes from, and which records connect the old and new identities.

In this case, the UK designation supplies an official identity connection. Regulatory findings and blockchain research add different parts of the operational picture. Keeping those evidence types distinct makes the account stronger and the resulting decisions more defensible.

For defenders, the practical result should be a connected counterparty record, a payment control that can be verified, and an evidence trail that survives the next rebrand.

Sources