The U.S. Department of the Treasury has announced sweeping sanctions against Grinex, a Russian-linked cryptocurrency exchange identified as the direct successor to the previously sanctioned Garantex. Garantex, operational since 2019, was a major hub for laundering billions of dollars in criminal proceeds, including payments from some of the world’s most prolific ransomware gangs—Conti, LockBit, Ryuk, and Black Basta among them. Despite being sanctioned in 2022 for anti–money laundering failures and ties to cybercrime, Garantex continued to operate in defiance of U.S. restrictions until a coordinated March 2025 international law enforcement action seized its domains, froze over $26 million, and charged its top administrators.
Almost immediately, Garantex’s operators rebranded as Grinex, transferring customer funds and operations to the new platform. Promoted openly on Telegram and even by Garantex co-founders, Grinex mirrors the old exchange’s interface and has already facilitated billions in cryptocurrency transactions. On-chain analysis shows seamless continuity between the two, underscoring its role as a deliberate sanctions evasion tool.
A central part of this network is the A7A5 token—a ruble-backed digital asset issued by sanctioned Kyrgyzstani company Old Vector and backed by sanctioned Russian bank Promsvyazbank. Intended for cross-border settlements, A7A5 is traded primarily on sanctioned platforms like Grinex, Bitpapa, and Meer, with more than $51 billion in processed volume. Analysts warn that its integration with a decentralized exchange creates a dangerous bridge to mainstream cryptocurrency services, raising further sanctions evasion concerns.
In the latest action, the U.S. renewed sanctions on Garantex and imposed new ones on Grinex, its co-founders—including Sergey Mendeleev and Aleksandr Mira Serda—and six partner companies in Russia and Kyrgyzstan. The State Department has also put up to $6 million in rewards for information leading to the arrests of Garantex executives. Officials stress that dismantling this shadow financial infrastructure is vital to combating ransomware, money laundering, and other illicit cyber activity.
Grinex’s rapid rise after Garantex’s takedown highlights how adaptable cybercriminal enterprises have become—and how closely they align with Russia’s broader strategy to develop alternative financial channels that bypass Western sanctions. In a cat-and-mouse game where illicit networks reappear as quickly as they are disrupted, the fight against crypto-enabled cybercrime is becoming a battle of persistence, intelligence sharing, and rapid enforcement.
#Grinex #Garantex #CryptoSanctions #USDepartmentofTreasury #OFAC #A7A5Token #SanctionsEvasion #RussianCybercrime #MoneyLaundering #Cryptocurrency #Ransomware #Conti #LockBit #Ryuk #BlackBasta #OldVector #Promsvyazbank #CryptoExchange #DOJ #Cybersecurity #IllicitFinance
