TRM Labs has connected Cryptomus to Heleket, a hidden platform reportedly created to help launder cryptocurrency following a $177 million penalty imposed in Canada.
A leading company that analyzes blockchain data has discovered that a cryptocurrency payment processor with ties to Russia recently relaunched its services discreetly.
TRM Labs released a report showing connections between Cryptomus and a new platform, Heleket. The report indicates they use the same technical setup, have employees in common, and serve similar customers involved in illegal activities.
The company determined with strong certainty that the people running Cryptomus probably created Heleket to continue handling transactions without thoroughly verifying users’ identities. This suggests a concerning trend of platforms connected to sanctioned entities finding ways to evade responsibility.
Cryptomus Faces Record Canadian Penalty Over Money Laundering
As a crypto investor, I was pretty shocked to learn that Cryptomus got hit with a massive penalty – almost CAD 177 million – from FINTRAC, Canada’s financial intelligence unit, back in October 2025. It’s a huge fine and definitely something to pay attention to in this space.
Related reading:
Crypto News: Canada Fines Cryptomus Record $126M for AML Violations
The company was fined for breaking rules designed to prevent money laundering and the funding of terrorism. Before the fine was issued, Cryptomus had already started requiring users to verify their identities, beginning in February 2025.
TRM noted that move triggered immediate concern among users and led to a sharp volume drop.
Transaction activity on the blockchain decreased from $153 million in January 2025 to $86 million in March.
TRM believes the recent market drop created an opportunity for Heleket. This new platform launched just as Cryptomus increased its restrictions, and TRM suggests this wasn’t accidental.
Heleket Shows Illicit Exposure Nearly Five Times the Industry Average
TRM’s research shows Heleket has nearly five times more illicit activity compared to the average payment service provider in TRM’s data.
Approximately 60% of the illegal money came through Garantex, a Russian exchange that has since been shut down and sanctioned by the U.S. While Heleket stated it required identification for transactions, TRM Labs found that people could still send money without providing it.
From January to May 2025, Heleket became responsible for over 80% of the illegal activity happening across both platforms.
Recent analysis suggests that Cryptomus, a payment processor with ties to Russia, probably created a new service called Heleket to continue processing illicit cryptocurrency transactions after being fined a record CAD $177 million by FINTRAC.
The amount of funds linked to illicit activity associated with Heleket is almost five times higher than the average for other payment services tracked by TRM, with 60% of those funds originating from…
— TRM Labs (@trmlabs)
TRM observed many cybercriminals shifting from the Cryptomus platform to Heleket. This group included individuals involved in the distribution of child sexual abuse material, as well as those offering cybercrime services. This move happened around the same time Cryptomus began requiring more thorough identity verification.
Heleket states it mainly does business within the European Union. However, a report from TRM suggests it’s actually part of a larger scheme to avoid sanctions.
In January 2025, Garantex supplied Heleket with a significant amount of funding, a pattern TRM Labs identified as unusual for a properly regulated financial service.
Shared Infrastructure and Branding Tie Both Platforms Together
Off-chain evidence adds weight to TRM’s on-chain findings.
Cryptomus and Heleket have a lot in common. They both use the same service to register their web addresses, and their websites look remarkably similar, even using unusual wording that’s uncommon among competitors.
For instance, the phrase “set discount to payment method” seems to appear exclusively on these two platforms, according to TRM.
Both services have the same 0.4% processing fee and a unique sign-up process called “project moderation.” This requires users to explain what their business will do, which isn’t a typical step in standard business verification procedures within the financial industry.
Our research revealed that the groups share staff, and we identified one administrator who appears to be located in the Baltic states.
In March 2025, I discovered through a technology forum that users were able to access Heleket simply by using their existing Cryptomus login information. It seemed like a straightforward integration.
A Cryptomus admin on Telegram confirmed they had agreements with another group, but stated that the two are separate organizations.
TRM’s report shows this trend aligns with what their 2026 Crypto Crime Report termed the “year of the Russian rebrand.” This means that when authorities take action against illegal crypto activity, criminals often just launch new platforms instead of actually changing their behavior to comply with the law.
Xeltox Enterprises Ltd., the company behind Cryptomus, is currently appealing the FINTRAC fine.
Read More
- Brent Oil Forecast
- Gold Rate Forecast
- Stablecoins: The New Corporate Opium or Financial Revolution?
- Silver Rate Forecast
- POWER’s 90% Crash: The Crypto Tale You Won’t Believe
- Gold vs. Bitcoin: Which Is More Likely to Cause a Champagne Shortage?
- Brazil Ditches Cash?! 💸
- Whale Bets $61M on ETH: Bet Your Boots This Is a Grander Stew! Whales! 🐋
- South Korea’s Bold Move: Digital Won Tests and Crypto Regulations Set to Transform Finance!
- Bitcoin’s Plunge: Doctor Profit’s Dire Predictions Will Make You Clutch Your Wallet
2026-04-21 11:12