The Russian cryptocurrency exchange Garantex, heavily sanctioned by the United States and the European Union for its role in facilitating ransomware and cybercrime money laundering, continues to operate through new entities despite international law enforcement efforts to dismantle it.
First targeted by U.S. Treasury sanctions in April 2022 for supporting darknet markets and ransomware actors, Garantex was further sanctioned by the European Union in March 2025, marking the EU’s first sanctions against a cryptocurrency exchange. The EU cited Garantex’s close ties to sanctioned Russian banks and links to Kremlin-affiliated companies such as Rosneft. The exchange found a niche converting rubles to other currencies amidst post-Ukraine invasion sanctions and capital controls, becoming the largest crypto exchange in Russia with prestigious office locations in Moscow.
Despite high-profile law enforcement action in March 2025, including coordinated operations by the U.S. Justice Department and agencies in Germany and Finland that seized domains, servers, and froze over $26 million in illicit funds, Garantex’s administrators—Aleksej Besciokov and Aleksandr Mira Serda—were charged for laundering hundreds of millions in cryptocurrency. The U.S. Secret Service also seized related websites to disrupt the exchange’s infrastructure.
However, investigations by TRM Labs and reports from the International Consortium of Investigative Journalists (ICIJ) reveal that Garantex rebranded as Grinex in late 2024, registering the new platform in Kyrgyzstan merely months after its takedown. Grinex reportedly processed over $100 million in suspicious transactions linked to ransomware groups like Conti, LockBit, and NetWalker, underscoring ongoing evasion of sanctions and continuing illicit activity.
The U.S. Department of the Treasury has imposed sanctions not only on Garantex and its successor Grinex but also on multiple affiliated companies and executives, including co-founders Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky, alongside entities operating in Russia and Kyrgyzstan. These firms facilitated laundering activities and aided sanctioned cybercriminal entities after the original sanctions were put in place.
Officials highlight the critical role that digital asset platforms play in both global financial innovation and exploitation by criminals. John K. Hurley, Under Secretary of the Treasury for Terrorism and Financial Intelligence, emphasized, “Digital assets play a crucial role in global innovation and economic development, and the United States will not tolerate abuse of this industry to support cybercrime and sanctions evasion.”
The extensive investigation also revealed troubling connections between Garantex and a debt-collection business co-owned by a convicted gang leader, deepening concerns about the organized crime elements intertwined with the exchange’s operations. Founded in 2019 by Russian tech specialist Stanislav Drugalev and Moscow politician Sergey Mendeleev, Garantex swiftly grew by catering to clients navigating the squeeze from Western sanctions on Russian financial institutions.
This persistence of Garantex despite sanctions signifies the challenges global regulators face in curbing illicit cryptocurrency activities. The continued existence of proxy platforms and rebranding efforts highlight the adaptability of illicit networks circumventing sanctions through decentralized finance avenues and third-country jurisdictions.
International law enforcement agencies remain committed to intensifying pressure on entities like Garantex and their affiliates; the EU’s recent sanction package underscores this resolve by explicitly naming crypto exchanges involved in sanction evasion operations. The unfolding saga illustrates the complex nexus of geopolitics, cybercrime, and the evolving regulatory landscape shaping the fate of digital currencies in sanctioned environments.