U.S. sanctions Garantex successor Grinex as A7A5 fuels Russian crypto sanctions evasion
U.S. authorities escalated action against the Russian cryptocurrency exchange Garantex after a March international law-enforcement operation seized its domains and servers, froze more than $26 million in cryptocurrency, and unsealed charges against alleged operators Aleksej Besciokov and Aleksandr Mira Serda. The Justice Department, Secret Service, FBI, Germany, and Finland said Garantex processed at least $96 billion in transactions since 2019 and was used to launder proceeds from hacking, ransomware, terrorism, drug trafficking, and sanctions violations, including activity that continued after OFAC sanctioned the exchange in 2022. The State and Treasury departments later expanded the pressure campaign by offering rewards of up to $6 million for information on Garantex leadership and sanctioning executives and affiliated firms.
Investigators and blockchain analysts say activity quickly shifted to replacement infrastructure in Kyrgyzstan, where Grinex emerged as Garantex’s successor and the ruble-backed stablecoin A7A5 became a major channel for cross-border transfers linked to Russian sanctions evasion. Reporting cited transfer volumes above $1 billion per day and $41.2 billion in cumulative value by late July 2025, with A7A5 marketed as a lower-freeze-risk route into USDT after the Garantex takedown. Treasury subsequently designated Grinex, while broader U.K. and U.S. scrutiny of Kyrgyz banks and crypto services underscored how sanctions-evasion networks are moving from traditional banking rails to regional exchanges, stablecoins, and decentralized liquidity pools.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
11 events from the most recent confirmed update back to the earliest known activity.
UK sanctions 18 crypto-linked entities tied to Russia evasion network
On 2026-05-27, the UK sanctioned 18 cryptocurrency exchanges, banks, companies, and individuals accused of helping Russia bypass trade restrictions through digital assets. The action focused on the A7 network and A7A5 stablecoin and also included HTX over alleged flows involving previously sanctioned entities such as Grinex and Garantex.
Elliptic details Russia-linked crypto sanctions-evasion ecosystem
On 2026-02-21, Elliptic published analysis tying Russia-linked cryptocurrency services to broader sanctions-evasion activity. The report connected exchanges and payment mechanisms including Garantex-related infrastructure and Kyrgyz-linked services into a wider illicit finance network.
UK imposes fresh sanctions on another Kyrgyz bank
On 2025-08-22, the UK rolled out additional sanctions against another Kyrgyz bank, reflecting continued pressure on Kyrgyz financial channels linked to Russian sanctions evasion. This followed earlier scrutiny of Kyrgyz banks and growing concern that crypto services were replacing restricted banking routes.
U.S. announces rewards and new sanctions targeting Garantex network
On 2025-08-14, the U.S. State Department and Treasury announced coordinated actions against Garantex, including rewards totaling up to $6 million for information leading to the arrest or conviction of key figures. Treasury also re-designated Garantex, designated Grinex as its successor exchange, and sanctioned three Garantex executives and six partner companies in Russia and Kyrgyzstan.
A7A5 usage surges as sanctions-evasion channel
By 2025-07-28, Elliptic reported that A7A5 transfers exceeded $1 billion per day and had reached $41.2 billion in aggregate value, with market capitalization rising rapidly. The report said the token had become a major route into USDT through Grinex, Meer, and its own decentralized exchange.
Grinex emerges after Garantex takedown
After the March 2025 disruption of Garantex and the freezing of 26 million USDT, reporting identified Grinex as a successor exchange used alongside A7A5 and other services. It was described as a new channel for Russian users seeking access to international crypto markets.
U.S. unseals indictment against alleged Garantex operators
On 2025-03-07, the Justice Department unsealed charges against Aleksej Besciokov and Aleksandr Mira Serda, alleging they controlled and operated Garantex between 2019 and 2025. Prosecutors said the pair knowingly enabled illicit transactions and concealed criminal activity on the platform.
International operation disrupts Garantex and seizes assets
On 2025-03-07, U.S., German, and Finnish authorities disrupted Garantex, seized its domains and supporting servers, and froze more than $26 million in cryptocurrency. U.S. officials said the exchange had processed at least $96 billion in transactions since April 2019 and facilitated laundering tied to ransomware, hacking, terrorism, drug trafficking, and sanctions evasion.
A7A5 ruble-backed stablecoin launches in Kyrgyzstan
A7A5, a ruble-linked stablecoin tied in reporting to A7 LLC, launched in Kyrgyzstan in January 2025. Subsequent reporting described it as a vehicle that could help Russian users move funds across borders outside the traditional banking system.
U.S. and UK sanction Kyrgyzstan's Keremet Bank
In early 2025, the United States and United Kingdom sanctioned Keremet Bank for allegedly facilitating cross-border payments for Russia's Promsvyazbank. Kyrgyz regulators also pushed domestic banks to reduce dealings with sanctioned Russian entities.
OFAC sanctions Garantex for illicit finance activity
In April 2022, the U.S. Treasury's Office of Foreign Assets Control sanctioned the Russian cryptocurrency exchange Garantex. Later court filings and government statements said the exchange continued operating and altered wallet infrastructure to evade sanctions detection.
Sources
9 references tracked. Mallory keeps watching after this page renders.
UK Sanctions Crypto Companies With Russia Ties
chainalysis.com
Open sourceRussia-linked cryptocurrency services and sanctions evasion
elliptic.co
Open sourceUK Rolls Out Fresh Sanctions Against Another Kyrgyz Bank - The Diplomat
thediplomat.com
Open sourceU.S. Targets Cryptocurrency Exchange, Offering Rewards Totaling Up to $6 Million - United States Department of State
state.gov
Open sourceAs sanctions hamper Kyrgyz banking sector, crypto trading booms | Eurasianet
eurasianet.org
Open sourceThe rise of A7A5: the Ruble stablecoin now transfers $1 billion per day
elliptic.co
Open sourceInternational Action Dismantles Notorious Russian Crypto Exchange Garantex - Chainalysis
chainalysis.com
Open sourceOffice of Public Affairs | Garantex Cryptocurrency Exchange Disrupted in International Operation | United States Department of Justice
justice.gov
Open sourceU.S. Secret Service Seizes Russian Cryptocurrency Exchange Websites | United States Secret Service
secretservice.gov
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grinex and TokenSpot Linked to $15 Million Crypto Theft
Grinex, a Kyrgyzstan-based cryptocurrency exchange tied by investigators to the sanctioned Russian platform Garantex, suspended operations after attackers stole roughly **$13.7 million to $15 million** from user wallets. The exchange alleged the intrusion was carried out by actors linked to Western intelligence services and said it had filed a criminal complaint, but no public technical evidence was provided to support that attribution. Reporting says the stolen assets belonged largely to Russian users, and the incident disrupted a platform associated with crypto-ruble activity, including the ruble-backed stablecoin **`A7A5`**. Blockchain analysis from TRM Labs and Elliptic found the stolen funds were moved across **TRON** and **Ethereum**, with large amounts of **USDT on TRON** swapped into **TRX** through **SunSwap** before being consolidated. TRM said it identified about **70 addresses** linked to the theft, exceeding the **54** publicly disclosed by Grinex, and assessed that Kyrgyzstan-based **TokenSpot** was likely compromised in the same operation after two of its addresses sent funds to the same consolidation wallet and the exchange suffered an outage. Investigators said both exchanges are part of a broader Russian sanctions-evasion ecosystem connected to **Garantex**, **Grinex**, **A7**, and **`A7A5`**.
May 5, 2026
Crypto Sanctions Evasion and Illicit Finance via Digital Assets
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Apr 29, 2026
US Charges Russian Operators of Cryptex and PM2BTC in Cybercrime Laundering Crackdown
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
May 25, 2026