Loading story…
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed A7 network, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated Huobi Global S.A., the entity behind crypto exchange HTX, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows.
Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain, and Solana, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for A7 LLC and Garantex and to the UK National Crime Agency-led Operation Destabilize, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-23, the Council of the European Union adopted its 21st sanctions package against Russia, adding 218 listings and extending transaction bans to 14 crypto-related service platforms outside the EU. The package also included four designations tied to the A7 network and introduced authority to ban crypto-asset services from third countries hosting platforms that facilitate Russian sanctions evasion.
After the UK’s 2026-05-26 designation, HTX remained operational under the same brand and rapidly rotated hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain, and Solana. This post-designation activity was cited as evidence that static address blocklists were insufficient for sanctions screening.
On 2026-05-26, the UK announced a sanctions package with 18 designations targeting Russia’s sanctions-evasion infrastructure, including the Kremlin-backed A7 network, a Kyrgyz bank, Georgian exchange operators, and Huobi Global S.A., the entity behind HTX. The measures took effect immediately as part of efforts to disrupt Russian war financing and illicit financial flows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
trmlabs.com
Open sourcescworld.com
Open sourcetrmlabs.com
Open sourcegov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities escalated action against the Russian cryptocurrency exchange **Garantex** after a March international law-enforcement operation seized its domains and servers, froze more than **$26 million** in cryptocurrency, and unsealed charges against alleged operators **Aleksej Besciokov** and **Aleksandr Mira Serda**. The Justice Department, Secret Service, FBI, Germany, and Finland said Garantex processed at least **$96 billion** in transactions since 2019 and was used to launder proceeds from hacking, ransomware, terrorism, drug trafficking, and sanctions violations, including activity that continued after OFAC sanctioned the exchange in 2022. The State and Treasury departments later expanded the pressure campaign by offering rewards of up to **$6 million** for information on Garantex leadership and sanctioning executives and affiliated firms. Investigators and blockchain analysts say activity quickly shifted to replacement infrastructure in Kyrgyzstan, where **Grinex** emerged as Garantex’s successor and the ruble-backed stablecoin **`A7A5`** became a major channel for cross-border transfers linked to Russian sanctions evasion. Reporting cited transfer volumes above **$1 billion per day** and **$41.2 billion** in cumulative value by late July 2025, with **`A7A5`** marketed as a lower-freeze-risk route into **USDT** after the Garantex takedown. Treasury subsequently designated **Grinex**, while broader U.K. and U.S. scrutiny of Kyrgyz banks and crypto services underscored how sanctions-evasion networks are moving from traditional banking rails to regional exchanges, stablecoins, and decentralized liquidity pools.
Jun 29, 2026
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026
The UK government sanctioned **Xinbi**, a Chinese-language cryptocurrency marketplace, under its Global Human Rights sanctions regime for allegedly enabling large-scale online fraud, money laundering, and human exploitation linked to scam centers in Southeast Asia. Authorities said Xinbi supported **#8 Park** in Cambodia, a major scam compound reportedly housing up to 20,000 trafficked or indentured workers and associated with pig-butchering and other cyber-enabled fraud schemes. The UK also sanctioned **Legend Innovation Co**, identified as the operator of #8 Park, along with two officials connected to the **Prince Group**. Blockchain analysis cited by the government said Xinbi processed more than **$19.9 billion** in cryptocurrency between 2021 and 2025 and served as a central hub for escrow services, unlicensed OTC trading, sales of compromised personal data, and other scam-enabling services. Researchers also linked the platform to other illicit Chinese-language marketplaces including **Huione** and **Tudou**, and said Xinbi remained resilient after 2025 Telegram takedowns by shifting to the **SafeW** messaging app and launching **XinbiPay**. The move marks a notable escalation in efforts to disrupt the financial infrastructure behind transnational scam operations rather than targeting only individual fraudsters.
Jun 29, 2026