U.S. Renews Sanctions on Russian Crypto Exchange Garantex and Successor Grinex

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced a renewed wave of sanctions against the Russian cryptocurrency exchange Garantex and its successor Grinex. Since 2019, Garantex has allegedly facilitated over $100 million in illicit transactions, supporting ransomware operators, darknet markets, and other cybercriminal networks.

The sanctions also extend to three co-founders of Garantex and six associated companies in Russia and Kyrgyzstan that enabled its activities.

Who Is Being Sanctioned?

The new measures target both individuals and organizations tied to the laundering operation, including:

• Executives: Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky

• Affiliated Companies: InDeFi Bank, Exved, Old Vector, A7 LLC, A71 LLC, and A7 Agent LLC

U.S. officials stress that digital assets, while vital for global innovation, cannot be abused for criminal financing or sanctions evasion.

History of Garantex

Garantex was originally sanctioned in April 2022 for facilitating transactions tied to Hydra Market and ransomware gangs such as Conti. In March 2025, law enforcement seized its website and arrested co-founder Aleksej Besciokov in India.

However, shortly afterward, intelligence from TRM Labs revealed that Garantex had effectively rebranded as Grinex, with an almost identical platform registered in Kyrgyzstan. Despite sanctions, it continued processing transactions, with 82% linked to sanctioned entities.

Role of Stablecoins in Laundering

A key enabler in this network is the A7A5 stablecoin, issued by Old Vector and backed by the Russian ruble. Reports suggest it has facilitated over $1 billion per day in transfers, totaling $41.2 billion. By integrating A7A5 into Grinex, Garantex managed to maintain services for customers while evading restrictions.

Links to Ransomware and Money Laundering

Garantex and Grinex reportedly processed funds tied to major ransomware families, including Conti, Black Basta, LockBit, NetWalker, and Phoenix Cryptolocker. The exchange also supported money laundering operations involving Ekaterina Zhdanova, who has been sanctioned previously for laundering funds for Russian elites and groups like Ryuk ransomware.

Broader Enforcement Actions

The Treasury’s announcement coincided with the U.S. Department of Justice (DoJ) unsealing warrants to seize $2.8 million in cryptocurrency, $70,000 in cash, and a luxury vehicle tied to ransomware laundering operations. Assets were linked to Ianis Aleksandrovich Antropenko, accused of using Zeppelin ransomware.

Additionally, more than $300 million in cryptocurrency linked to fraud and pig butchering scams has been frozen globally.

Conclusion

Despite multinational efforts to shut down Garantex, its reappearance as Grinex highlights how crypto exchanges can quickly adapt to sanctions. The integration of ruble-backed stablecoins and global money laundering networks underscores the complex challenges regulators face in curbing illicit finance.

The U.S. has reaffirmed its stance that while digital assets play a transformative role in global finance, they must not serve as safe havens for cybercrime.