The US Treasury Department has re-designated
Moscow-based cryptocurrency exchange Garantex and sanctioned its successor,
Grinex, along with three executives and six associated companies in Russia and
the Kyrgyz Republic.
Officials say Garantex processed more than $100
million in illicit transactions since 2019, including funds tied to ransomware
attacks and darknet markets.
“Digital assets play a crucial role in global innovation and
economic development, and the United States will not tolerate abuse of this
industry to support cybercrime and sanctions evasion. Exploiting cryptocurrency exchanges to
launder money and facilitate ransomware attacks not only threatens our national
security, but also tarnishes the reputations of legitimate virtual asset
service providers,” John Hurley, the Under Secretary of the Treasury for Terrorism and
Financial Intelligence, said.
Coordinated Law Enforcement Operation
The action followed a March 6, 2025, operation by the
US Secret Service with German and Finnish authorities, which seized Garantex’s
web domain and froze over $26 million in cryptocurrency.
The next day, the Justice Department unsealed
indictments against executives Aleksandr Mira Serda and Aleksej Besciokov.
Besciokov was arrested in India.
According to Treasury, Garantex moved its customer
base and funds to Grinex after these measures, allowing it to continue
operations despite sanctions. Founded in Estonia in 2019, Garantex lost its license
in 2022 after regulators cited anti-money laundering failings and links to
criminal wallets.
Related: Russia and Stablecoin Use: Ruble-Pegged A7A5 Moved $9B on One Crypto Exchange
US officials say it maintained accounts for hundreds
of thousands of users and received millions from ransomware operations, including
Conti, LockBit, Black Basta, and Ryuk.
Treasury alleges the exchange built infrastructure to
conceal wallet ownership, enabling it to continue servicing sanctioned
individuals and entities.
Creation of Grinex to Evade Sanctions
Grinex was formed by Garantex officers following the
March law enforcement action. Treasury says it processed billions in
cryptocurrency transactions and used a ruble-backed A7A5 token, issued by
Kyrgyz firm Old Vector, to allow Garantex customers to recover frozen funds.
The token was linked to sanctioned Russian and
Moldovan entities accused of facilitating cross-border payments to bypass
sanctions.
Sanctioned individuals include co-founders Sergey
Mendeleev and Pavel Karavatsky, and co-owner Mira Serda. Partner firms InDeFi
Bank and Exved were also designated to facilitate illicit transactions and
trade aimed at circumventing US sanctions.
The sanctions block all US-linked assets belonging to
the designated individuals and entities. US persons are prohibited from
engaging in transactions with them, and non-U.S. firms risk secondary sanctions
for providing support.
Treasury said the measures are part of ongoing efforts
to disrupt cryptocurrency platforms used for cybercrime, following previous
actions against exchanges such as Cryptex, SUEX, and Chatex.
The US Treasury Department has re-designated
Moscow-based cryptocurrency exchange Garantex and sanctioned its successor,
Grinex, along with three executives and six associated companies in Russia and
the Kyrgyz Republic.
Officials say Garantex processed more than $100
million in illicit transactions since 2019, including funds tied to ransomware
attacks and darknet markets.
“Digital assets play a crucial role in global innovation and
economic development, and the United States will not tolerate abuse of this
industry to support cybercrime and sanctions evasion. Exploiting cryptocurrency exchanges to
launder money and facilitate ransomware attacks not only threatens our national
security, but also tarnishes the reputations of legitimate virtual asset
service providers,” John Hurley, the Under Secretary of the Treasury for Terrorism and
Financial Intelligence, said.
Coordinated Law Enforcement Operation
The action followed a March 6, 2025, operation by the
US Secret Service with German and Finnish authorities, which seized Garantex’s
web domain and froze over $26 million in cryptocurrency.
The next day, the Justice Department unsealed
indictments against executives Aleksandr Mira Serda and Aleksej Besciokov.
Besciokov was arrested in India.
According to Treasury, Garantex moved its customer
base and funds to Grinex after these measures, allowing it to continue
operations despite sanctions. Founded in Estonia in 2019, Garantex lost its license
in 2022 after regulators cited anti-money laundering failings and links to
criminal wallets.
Related: Russia and Stablecoin Use: Ruble-Pegged A7A5 Moved $9B on One Crypto Exchange
US officials say it maintained accounts for hundreds
of thousands of users and received millions from ransomware operations, including
Conti, LockBit, Black Basta, and Ryuk.
Treasury alleges the exchange built infrastructure to
conceal wallet ownership, enabling it to continue servicing sanctioned
individuals and entities.
Creation of Grinex to Evade Sanctions
Grinex was formed by Garantex officers following the
March law enforcement action. Treasury says it processed billions in
cryptocurrency transactions and used a ruble-backed A7A5 token, issued by
Kyrgyz firm Old Vector, to allow Garantex customers to recover frozen funds.
The token was linked to sanctioned Russian and
Moldovan entities accused of facilitating cross-border payments to bypass
sanctions.
Sanctioned individuals include co-founders Sergey
Mendeleev and Pavel Karavatsky, and co-owner Mira Serda. Partner firms InDeFi
Bank and Exved were also designated to facilitate illicit transactions and
trade aimed at circumventing US sanctions.
The sanctions block all US-linked assets belonging to
the designated individuals and entities. US persons are prohibited from
engaging in transactions with them, and non-U.S. firms risk secondary sanctions
for providing support.
Treasury said the measures are part of ongoing efforts
to disrupt cryptocurrency platforms used for cybercrime, following previous
actions against exchanges such as Cryptex, SUEX, and Chatex.
