Loading story…
U.S. authorities escalated action against the Russian cryptocurrency exchange Garantex after a March international law-enforcement operation seized its domains and servers, froze more than $26 million in cryptocurrency, and unsealed charges against alleged operators Aleksej Besciokov and Aleksandr Mira Serda. The Justice Department, Secret Service, FBI, Germany, and Finland said Garantex processed at least $96 billion in transactions since 2019 and was used to launder proceeds from hacking, ransomware, terrorism, drug trafficking, and sanctions violations, including activity that continued after OFAC sanctioned the exchange in 2022. The State and Treasury departments later expanded the pressure campaign by offering rewards of up to $6 million for information on Garantex leadership and sanctioning executives and affiliated firms.
Investigators and blockchain analysts say activity quickly shifted to replacement infrastructure in Kyrgyzstan, where Grinex emerged as Garantex’s successor and the ruble-backed stablecoin A7A5 became a major channel for cross-border transfers linked to Russian sanctions evasion. Reporting cited transfer volumes above $1 billion per day and $41.2 billion in cumulative value by late July 2025, with A7A5 marketed as a lower-freeze-risk route into USDT after the Garantex takedown. Treasury subsequently designated Grinex, while broader U.K. and U.S. scrutiny of Kyrgyz banks and crypto services underscored how sanctions-evasion networks are moving from traditional banking rails to regional exchanges, stablecoins, and decentralized liquidity pools.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-27, the UK sanctioned 18 cryptocurrency exchanges, banks, companies, and individuals accused of helping Russia bypass trade restrictions through digital assets. The action focused on the A7 network and A7A5 stablecoin and also included HTX over alleged flows involving previously sanctioned entities such as Grinex and Garantex.
On 2026-02-21, Elliptic published analysis tying Russia-linked cryptocurrency services to broader sanctions-evasion activity. The report connected exchanges and payment mechanisms including Garantex-related infrastructure and Kyrgyz-linked services into a wider illicit finance network.
On 2025-08-22, the UK rolled out additional sanctions against another Kyrgyz bank, reflecting continued pressure on Kyrgyz financial channels linked to Russian sanctions evasion. This followed earlier scrutiny of Kyrgyz banks and growing concern that crypto services were replacing restricted banking routes.
On 2025-08-14, the U.S. State Department and Treasury announced coordinated actions against Garantex, including rewards totaling up to $6 million for information leading to the arrest or conviction of key figures. Treasury also re-designated Garantex, designated Grinex as its successor exchange, and sanctioned three Garantex executives and six partner companies in Russia and Kyrgyzstan.
By 2025-07-28, Elliptic reported that A7A5 transfers exceeded $1 billion per day and had reached $41.2 billion in aggregate value, with market capitalization rising rapidly. The report said the token had become a major route into USDT through Grinex, Meer, and its own decentralized exchange.
After the March 2025 disruption of Garantex and the freezing of 26 million USDT, reporting identified Grinex as a successor exchange used alongside A7A5 and other services. It was described as a new channel for Russian users seeking access to international crypto markets.
On 2025-03-07, the Justice Department unsealed charges against Aleksej Besciokov and Aleksandr Mira Serda, alleging they controlled and operated Garantex between 2019 and 2025. Prosecutors said the pair knowingly enabled illicit transactions and concealed criminal activity on the platform.
On 2025-03-07, U.S., German, and Finnish authorities disrupted Garantex, seized its domains and supporting servers, and froze more than $26 million in cryptocurrency. U.S. officials said the exchange had processed at least $96 billion in transactions since April 2019 and facilitated laundering tied to ransomware, hacking, terrorism, drug trafficking, and sanctions evasion.
A7A5, a ruble-linked stablecoin tied in reporting to A7 LLC, launched in Kyrgyzstan in January 2025. Subsequent reporting described it as a vehicle that could help Russian users move funds across borders outside the traditional banking system.
In early 2025, the United States and United Kingdom sanctioned Keremet Bank for allegedly facilitating cross-border payments for Russia's Promsvyazbank. Kyrgyz regulators also pushed domestic banks to reduce dealings with sanctioned Russian entities.
In April 2022, the U.S. Treasury's Office of Foreign Assets Control sanctioned the Russian cryptocurrency exchange Garantex. Later court filings and government statements said the exchange continued operating and altered wallet infrastructure to evade sanctions detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
chainalysis.com
Open sourceelliptic.co
Open sourcethediplomat.com
Open sourcestate.gov
Open sourceeurasianet.org
Open sourceelliptic.co
Open sourcechainalysis.com
Open sourcejustice.gov
Open sourcesecretservice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grinex, a Kyrgyzstan-based cryptocurrency exchange tied by investigators to the sanctioned Russian platform Garantex, suspended operations after attackers stole roughly **$13.7 million to $15 million** from user wallets. The exchange alleged the intrusion was carried out by actors linked to Western intelligence services and said it had filed a criminal complaint, but no public technical evidence was provided to support that attribution. Reporting says the stolen assets belonged largely to Russian users, and the incident disrupted a platform associated with crypto-ruble activity, including the ruble-backed stablecoin **`A7A5`**. Blockchain analysis from TRM Labs and Elliptic found the stolen funds were moved across **TRON** and **Ethereum**, with large amounts of **USDT on TRON** swapped into **TRX** through **SunSwap** before being consolidated. TRM said it identified about **70 addresses** linked to the theft, exceeding the **54** publicly disclosed by Grinex, and assessed that Kyrgyzstan-based **TokenSpot** was likely compromised in the same operation after two of its addresses sent funds to the same consolidation wallet and the exchange suffered an outage. Investigators said both exchanges are part of a broader Russian sanctions-evasion ecosystem connected to **Garantex**, **Grinex**, **A7**, and **`A7A5`**.
Jun 29, 2026
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed **A7 network**, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated **Huobi Global S.A.**, the entity behind crypto exchange **HTX**, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows. Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across **TRON**, **Ethereum**, **BNB Smart Chain**, and **Solana**, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for **A7 LLC** and **Garantex** and to the UK National Crime Agency-led **Operation Destabilize**, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
Jul 24, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026