The US Treasury has sanctioned a sprawling Russian crypto network, including Garantex, its successor Grinex, and the ruble backed stablecoin A7A5, for laundering billions in illicit funds tied to ransomware and sanctions evasion.
Key Takeaways
- 1Garantex and successor Grinex processed billions in crypto linked to cybercrime and sanctions evasion
- 2Ruble pegged stablecoin A7A5 handled over $51 billion in transactions via a Kyrgyzstan based shell network
- 3$26 million seized, Garantex website shut down, one executive arrested in India
- 4US Treasury and law enforcement offer up to $6 million for information on sanctioned figures
What Happened?
The US Treasury’s Office of Foreign Assets Control (OFAC) has imposed sweeping new sanctions on a network of Russian linked cryptocurrency entities accused of laundering ransomware proceeds and evading global financial sanctions. This includes Garantex, its rebranded successor Grinex, and the A7A5 stablecoin platform, which together processed tens of billions in crypto transactions. The sanctions come as part of a broader international crackdown coordinated with US, German, and Finnish authorities and mark one of the most aggressive US actions to date against state tied crypto laundering infrastructure.
Garantex and Grinex: From Shutdown to Rebranding
Garantex, a crypto exchange originally licensed in Estonia but later relocated to Moscow, was first sanctioned by OFAC in April 2022 for facilitating over $100 million in illicit transactions. These included ransomware payments from gangs like Conti, Ryuk, and LockBit, and darknet dealings tied to Hydra Market. In March 2025, authorities seized Garantex’s web domain and froze $26 million in crypto assets. But within days, its leadership launched Grinex, a nearly identical platform promoted on Garantex linked Telegram channels and designed to help users recover funds using alternative methods. Grinex was incorporated months earlier in Kyrgyzstan by an individual with no crypto background, suggesting long term planning. Since its launch, Grinex facilitated billions in crypto transfers and attracted former Garantex clients by offering the same interface and services.
The Rise of A7A5: A Ruble Pegged Escape Hatch
Central to this migration was the A7A5 stablecoin, a ruble backed digital token issued by Kyrgyz based firm Old Vector and tied to Russian financial institutions under US sanctions.
Key facts about A7A5:
- Backed by Promsvyazbank, a state owned Russian bank already sanctioned
- Associated with sanctioned Moldovan oligarch Ilan Shor
- Used as a compensation tool to restore Garantex users’ frozen funds
- Handled up to $1 billion daily, totaling $51 billion in transaction volume
TRM Labs and Chainalysis flagged wallet addresses showing Garantex preemptively moving assets into A7A5 as early as January 2025, underscoring coordinated evasion planning. Another exchange, Meer, helped onboard the token in late 2024 and surged in volume after the March crackdown, functioning as another pillar in the sanctions evading network.
In our latest blog, we examine today’s sanctions by OFAC and look into A7A5, the Russian ruble-backed token, and Grinex, the Garantex successor. See how these entities operate within the Russian crypto economy and their connections to previously sanctioned exchange Garantex:… pic.twitter.com/F3eH4MDYS2
,Chainalysis (@chainalysis) August 14, 2025
Executive Indictments and Enforcement Action
Three Garantex executives were sanctioned: Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky. Mendeleev’s companies InDeFi Bank and Exved were also listed for enabling sanctioned trade using crypto channels.
- Mira Serda was indicted and remains at large. A US court issued a new arrest warrant on August 6, 2025.
- Aleksej Besciokov, another Garantex figure, was arrested in India and charged with conspiracy to commit money laundering and operate an unlicensed money services business.
To aid enforcement, the US State Department is offering up to $6 million in rewards for information leading to the capture of these individuals.
Kyrgyzstan’s Role as a Crypto Sanctions Gateway
Following Russia’s invasion of Ukraine, Kyrgyzstan’s crypto sector exploded due to a 2022 law formalizing digital asset regulation. Between January and July 2024, licensed platforms processed $4.2 billion in crypto. But the same framework also attracted shell companies and networks involved in sanctions evasion. Companies like Old Vector and its affiliates used residential addresses and overlapping ownership structures to mask illicit activities. With its position as a trade hub between Russia and China, Kyrgyzstan became a strategic point for rerouting restricted technology and laundering crypto linked funds.
CoinLaw’s Takeaway
This isn’t just about another crypto crackdown. It’s a wake up call for the whole digital asset space. Watching Garantex rebrand into Grinex and funnel billions through a ruble backed stablecoin shows how fast bad actors can adapt. The A7A5 token wasn’t some obscure project. It moved more than $50 billion and was tied to state banks and sanctioned oligarchs. We’ve got to stop thinking of crypto laundering as just hackers in a basement. This is coordinated, state linked financial warfare. And the fact that one executive got arrested on vacation while others got slapped with multimillion dollar bounties? That’s real pressure. If regulators and exchanges don’t start catching these warning signs earlier, we’re going to see this same pattern repeat again and again.
