Cryptomus Rebrands as Heleket to Evade Canadian Sanctions

Blockchain analysts from TRM Labs reveal a covert rebranding of Cryptomus as Heleket, designed to perpetuate crypto laundering activities following substantial penalties in Canada.

In a recent study, a leading blockchain intelligence firm has uncovered that a Russian-affiliated cryptocurrency payment service may have undergone a stealthy transformation. TRM Labs has linked Cryptomus with a newly emerged platform, Heleket, suggesting these two entities share critical infrastructure, personnel, and a similar clientele involved in illicit activities.

TRUSTED PARTNER

5.0 ★★★★★

Review and Opinions →

🔥 Bonus 2.400 $

Bonus Instant + 150 FS 🏆

Open an account

TRM Labs expressed a high degree of confidence in their findings, indicating that the operators behind Cryptomus likely established Heleket to circumvent stringent identity verification processes. This development raises significant concerns about the adaptability of platforms facing sanctions and regulatory pressure.

Following a historic penalty of nearly CAD 177 million imposed by Canada’s financial intelligence unit, FINTRAC, in October 2025 for multiple violations related to money laundering, Cryptomus had previously implemented mandatory user identity checks in early 2025. However, this move led to a sharp drop in transaction volume, which decreased from USD 153 million in January to USD 86 million by March, prompting the launch of Heleket just as Cryptomus increased its regulatory measures.

Heleket’s growth appears staggering, with TRM’s analysis revealing that its illicit exposure to illegal activities is nearly five times the average observed among payment service providers. Approximately 60% of funds flowing through Heleket were traced back to Garantex, a now-defunct Russian cryptocurrency exchange that had faced sanctions.

Despite claims of requiring identity verification, TRM found that users could still engage in transactions without submitting necessary documentation. From January to May 2025, the share of illicit inflows associated with Heleket surged, accounting for over 80% of the total illicit activities linked to both platforms.

TRM has also noted a concerning trend of documented cybercriminal behavior transitioning between Cryptomus and Heleket. This transition included individuals involved in child exploitation and other cybercrime-related activities, aligning closely with the implementation of stricter controls on Cryptomus.

TRUSTED PARTNER

5.0 ★★★★★

Review and Opinions →

🔥 Bonus 2.400 $

Bonus Instant + 150 FS 🏆

Open an account

Operating primarily within the European Union, Heleket appears to be embedded in a wider network aiming to evade sanctions, despite its assertions. Initial liquidity for Heleket came from Garantex, a connection deemed unusual for a legitimate financial service.

Further reinforcing the links between Cryptomus and Heleket, both platforms utilize the same privacy-centric domain registrar, and their websites exhibit matching design features and uncommon phrases not prevalent in the crypto industry. They also charge an identical processing fee of 0.4% and require users to undergo an unusual onboarding process known as “project moderation,” diverging from standard practices within regulated finance.

Evidence of overlapping personnel has also surfaced, with indications suggesting that a shared administrator is likely operating from the Baltics. A technology forum post indicated that users could access Heleket with their Cryptomus login information. Moreover, a Cryptomus administrator acknowledged on Telegram the existence of agreements between the two services, while insisting they remain separate entities.

TRM’s report aligns with its broader analysis, which characterizes 2026 as a period marked by Russian platforms rebranding in response to regulatory actions. Currently, Xeltox Enterprises Ltd., the parent company of Cryptomus, is appealing the significant fine imposed by FINTRAC.