Reward of up to $6 million offered by the US Department of Justice for the leaders of defunct exchange Garantex
Garantex, a Russian cryptocurrency exchange accused of facilitating cybercrime and money laundering, was effectively shut down in a coordinated multinational law enforcement action led by U.S. authorities in March 2025. However, the exchange's management had contingency plans in place, quickly shifting operations to a successor platform named Grinex to continue illicit activities and evade sanctions.
The U.S. Department of State's Office of the Spokesperson issued a statement regarding the crypto exchange Garantex, stating that it had been used to receive hundreds of millions in proceeds from criminals using it for various crimes, including terrorism, drug trafficking, ransoms, and others. Garantex processed at least $96 billion in crypto transactions between April 2019 and March 2025.
The US Treasury imposed sanctions on Garantex, related entities, and executives linked to laundering ransomware proceeds and evading sanctions. This block included shutting down Garantex, seizing its web domain, and freezing $26 million in assets during the March 2025 takedown.
Shortly after the takedown, Garantex employees established Grinex, which facilitated the transfer of Garantex customer deposits and resumed operations through the ruble-backed stablecoin A7A5. Grinex was designed expressly to circumvent sanctions and maintain the illicit financial flows previously handled by Garantex.
The A7A5 token, backed by Russian institutions and issued by a Kyrgyzstan-based firm, was used to process up to $1 billion in daily transactions and served as a sanctions-resistant transfer channel for illicit funds connected to ransomware and cybercrime groups.
U.S. authorities remain actively engaged in dismantling this network and have made the pursuit and arrest of its leaders a priority. The Transnational Organized Crime Rewards Program (TOCRP) of the US Department of State has prepared a reward of up to $6 million for information leading to the arrest or conviction of Garantex executives.
Ekaterina Zhdanova, a known money launderer, funneled over $2 million in Bitcoin to the USDT stablecoin using the exchange. Wallets linked to criminal activity were discovered following the enforcement by Estonia's Financial Intelligence Unit (EFIU). The exchange lost its license for providing digital asset services after the EFIU unveiled serious deficiencies in its laws against money laundering and terrorist financing.
OFAC, the Treasury's Office of Foreign Assets Control, is taking steps to redesignate Garantex and designate its successor, Grinex. OFAC will also be naming three executives from the exchange and six affiliated companies in Russia and the Kyrgyz Republic. The US DOJ unsealed indictments against Garantex's CCO and Aleksej Besciokov in March 2025.
While Besciokov was arrested in India following the indictment, the CCO remains at large. German and Finnish authorities have seized Garantex's domain and frozen over $26 million in digital assets controlled by the exchange. These criminal activities often caused significant harm to victims from the United States.
It is crucial to note that Grinex, the successor of Garantex, remains operational. Another exchange, Meer, registered in late 2024 and with features similar to Garantex and Grinex, likely acted as a further contingency channel to sustain illicit operations after enforcement actions.
Sources: 1. CoinDesk 2. Reuters 3. Bloomberg 4. US Department of State 5. CyberScoop
- The U.S. Department of State's statement revealed that Garantex, an accused crypto exchange, had processed over $96 billion in cryptocurrency transactions, a large portion of which were linked to various criminal activities such as terrorism, drug trafficking, and ransomware.
- Following the shutdown of Garantex, its employees established a successor platform named Grinex, which continued illicit operations through the ruble-backed stablecoin A7A5, designed to circumvent sanctions and maintain financial flows from ransomware and cybercrime groups.
- The US Department of the Treasury's Office of Foreign Assets Control (OFAC) is planning to redesignate Garantex and designate its successor, Grinex, and name several executives and affiliated companies in Russia and the Kyrgyz Republic.
- While the CCO of Garantex was indicted in March 2025, another exchange, Meer, registered in late 2024, is suspected of acting as a contingency channel for illicit operations, similar to Garantex and its successor, Grinex. These exchanges operate in the general-news and crime-and-justice sectors, illustrating the intersection of technology, finance, and cybersecurity.
