Russia Leveraging Kyrgyzstan’s Crypto Ecosystem to Evade Sanctions

Since Kyrgyzstan rapidly emerged as a crypto hub in 2022, TRM Labs has identified a growing pattern of Russian actors exploiting the country to evade sanctions and procure dual-use goods for the war in Ukraine. Kyrgyz-registered exchanges have repeatedly facilitated transactions linked to sanctioned Russian entities. Many of these virtual asset service providers (VASPs) show indicators of being shell companies — including the reuse of identical residential addresses, founders, and contact information across multiple entities.

Several of these Kyrgyz exchanges, according to TRM, also exhibit similar on-chain heuristics to Garantex — pointing to coordinated efforts by the Russian illicit finance ecosystem to rebuild infrastructure and circumvent sanctions. As TRM Labs previously reported, the high-risk exchange Grinex — likely a rebranded successor to Garantex — was also registered in Kyrgyzstan. Just weeks after Garantex was disrupted by law enforcement in March 2025, Grinex began facilitating withdrawals using the Russian stablecoin A7A5. On-chain analysis suggests that Grinex and other Kyrgyz-based exchanges may have played a role in moving funds after the takedown, underscoring Kyrgyzstan’s growing importance as a conduit for post-sanctions Russian financial activity.

Key takeaways

• Russia has increasingly turned to Kyrgyzstan as a conduit for sanctions evasion and to procure dual-use goods since the outset of its war in Ukraine
  
• Kyrgyzstan is also serving as a registration hub for services likely linked to high-risk Russian exchange Garantex, with some entities potentially operated by the same individuals behind the original platform
  
• Many Kyrgyz-registered VASPs display clear indicators of shell company behavior, including repeated use of the same residential addresses, founders, and contact information across multiple entities

Russia and Kyrgyzstan’s economies increasingly intertwined since Ukraine war

Since Russia’s invasion of Ukraine in 2022, its economic ties with Kyrgyzstan have deepened significantly. Bilateral trade reached USD 3.5 billion in 2024, while Russian investment in Kyrgyzstan jumped 23% in early 2024 to nearly USD 200 million. Parallel imports into Russia via third countries like Kyrgyzstan surged to USD 20 billion by early 2023, straining regional warehouse capacity. According to recent reporting, Chinese exports of 45 specific dual-use goods to Kyrgyzstan and Kazakhstan rose 64% between 2022 and 2023, totaling USD 1.3 billion.

TRM Labs has engaged with multiple Chinese entities that expressed willingness to supply Russia with dual-use goods — including semiconductors, anti-unmanned aerial vehicles (UAV) equipment, and drones commonly deployed on the battlefield in Ukraine — often routing shipments through Kyrgyzstan.

Against this backdrop, Russia’s expanding economic and on-chain ties to Kyrgyzstan take on added significance, pointing to the growing use of Kyrgyzstan’s crypto infrastructure as a conduit for sanctions evasion.

Kyrgyzstan’s emergence as a crypto hub

Following the enactment of Kyrgyzstan’s "On Virtual Assets" law in January 2022 — just one month before Russia’s invasion of Ukraine — the country’s crypto sector expanded from virtually nonexistent levels to more than USD 600,000 in recorded activity by March 2022. The law created a legal foundation for the digital asset industry, formally defining virtual assets as "civil rights objects" under Kyrgyz civil law. This classification treats digital assets similarly to property rights — recognizing them as legally protected assets that can be owned, transferred, and inherited.

In addition, the legislation introduced a formal licensing regime for VASPs, granting them the status of financial institutions and placing them under regulatory supervision for the first time

By October 2024, Kyrgyzstan had issued 126 VASP licenses, fueling a sharp rise in digital asset activity. Transaction volume by licensed VASPs surged from USD 59 million in 2022 to USD 4.2 billion in just the first seven months of 2024.

Kyrgyzstan launching stablecoin

In parallel with its regulatory push, Kyrgyzstan is preparing to launch USDKG — a gold-backed stablecoin pegged 1:1 to the US dollar. Developed in collaboration with the Ministry of Finance, USDKG is intended to streamline payments, settlements, and cross-border transactions. As TRM Labs noted in its recent blog, GENIUS Act Passes Senate, Paving the Way for Landmark US Crypto Legislation, over 99% of stablecoin activity is licit. Still, their speed, liquidity, and relative price stability continue to make stablecoins an appealing tool for illicit actors, including those engaged in sanctions evasion.

How Kyrgyzstan’s crypto economy helps Russia evade sanctions and purchase dual-use technologies

Several VASPs registered in Kyrgyzstan share suspicious on- and off-chain overlap, including: 

• Identical registration addresses at private residences
• Phone numbers and emails tied to freight companies or other VASPs
• Named founders linked to multiple other providers or with no discernible background in business or crypto
• No functional user registration processes

Additionally, many Kyrgyz-registered exchanges have been linked to cryptocurrency assets associated with sanctioned Russian entities. Envoys Vision Digital Exchange (EVDE), for example, registered a crypto wallet address tied to the Rusich Group, a Russian paramilitary organization sanctioned by the US Treasury’s Office of Foreign Assets Control (OFAC) in 2022 for its involvement in the war in Ukraine. Rusich has fought alongside Wagner Group forces, now formally integrated into the Russian state apparatus.

EVDE describes itself as a “platform for traders and investors that includes stock, currency, commodity, and cryptocurrency markets.” Beyond its on-chain exposure, the exchange also shows several off-chain links to cross-border logistics firms and a Chinese financial institution, suggesting a wider support infrastructure that warrants further scrutiny.

TRM Labs also identified a distinctive transaction pattern associated with wallet addresses used by Garantex, the sanctioned Russian exchange. Following Garantex’s takedown, several Kyrgyz-registered entities began exhibiting the same behavioral heuristics. In one instance, wallet infrastructure used by two of these firms overlaps with that of a third Kyrgyz-registered company — strongly suggesting shared control or coordination across all three entities.

Grinex also uses the same spending heuristic previously associated with Garantex. In May 2025, TRM Labs reported that Grinex facilitated the movement of funds from Garantex by enabling withdrawals via Russian stablecoin A7A5. Users with balances exceeding USD 50,000 were able to extract funds through Grinex using A7A5 shortly after Garantex’s takedown by law enforcement.

Notably, both Grinex and A7A5’s issuer, Old Vector, were registered in Kyrgyzstan within two weeks of each other — months ahead of the enforcement action against Garantex. Meer, another Kyrgyz exchange and one of the first platforms to list A7A5, was registered on the exact same day as Old Vector and exhibits the same transaction heuristic originally observed with Garantex.

Both Grinex and Meer experienced a sharp rise in on-chain volume immediately following the takedown of Garantex, indicating they may have played a role in offloading or transferring funds previously held on the sanctioned exchange.

What’s next?

Russia has long demonstrated a capacity to adapt and exploit vulnerabilities — whether on the battlefield in Ukraine, in cyberspace, or through transnational criminal networks. Its approach is opportunistic, leveraging existing loopholes and weak points in foreign jurisdictions to blunt the impact of international sanctions. Kyrgyzstan’s rapid embrace of cryptocurrency may be driven by domestic priorities, but Russia has clearly seized the opportunity to use the country’s growing crypto ecosystem as a sanctions evasion conduit.

If Kyrgyzstan is being exploited rather than complicit, it still has meaningful tools to raise the cost of abuse. Today, foreign nationals can register VASPs in Kyrgyzstan without ever being physically present — though there are local hosting requirements. Stronger ownership requirements, such as mandating the physical presence or local residency of company principals, would raise barriers for foreign bad actors. Similarly, increasing transparency around funding sources — such as requiring disclosure of ultimate fund originators or restricting financing to Kyrgyz residents — would reduce the appeal of Kyrgyzstan as a destination for shell entities.

Critically, authorities should increase scrutiny of VASP registrations to detect and disrupt networks of shell companies. TRM Labs’ analysis has identified dozens of Kyrgyz VASPs reusing the same addresses, contact information, founders, and infrastructure — classic hallmarks of a coordinated network designed to obfuscate illicit flows.

Governments and law enforcement agencies seeking to counter Russia’s sanctions evasion toolkit need to urgently engage directly with Kyrgyz authorities on compliance. Without proactive intervention, the model Russia has implemented in Kyrgyzstan can be easily exported. Kazakhstan and Uzbekistan have already begun to adopt similar crypto-friendly frameworks. If left unchecked, Russia could replicate these same playbooks in neighboring jurisdictions — further weakening the global sanctions regime and enabling the continued flow of funds to fuel aggression, procurement, and destabilization.

{{horizontal-line}}

FAQs on Kyrgyzstan’s crypto economy

Why is Kyrgyzstan emerging as a crypto hub of interest?

Kyrgyzstan’s introduction of the “On Virtual Assets” law in early 2022 laid a legal foundation for the rapid growth of its digital asset ecosystem. By October 2024, the country had issued 126 VASP licenses. The regulatory framework created a formal licensing regime and recognized digital assets as “civil rights objects” under Kyrgyz law, encouraging new market entrants.

How is Russia leveraging Kyrgyzstan’s crypto sector?

TRM Labs has observed increasing instances of Russia-linked actors exploiting Kyrgyz-registered exchanges to circumvent international sanctions and move funds. Some of these exchanges display behavioral heuristics similar to the sanctioned Russian exchange Garantex and appear to have served as conduits for funds following law enforcement action against Garantex in 2025.

What role do shell companies play in this activity? 

Many Kyrgyz-registered VASPs display red flags commonly associated with shell entities. These include the reuse of residential addresses, contact information, and named principals across multiple exchanges. In some cases, those listed as founders have no apparent background in crypto or business operations. These patterns suggest a coordinated effort to obfuscate control and facilitate illicit financial flows.

Is there on-chain evidence linking Kyrgyz platforms to sanctioned entities?

Yes. TRM Labs identified wallet activity at several Kyrgyz-based VASPs overlapping with infrastructure previously associated with Garantex. Notably, EVDE, a Kyrgyz-registered platform, was found to have exposure to wallet addresses linked to Rusich Group, a sanctioned Russian paramilitary entity. Other exchanges, including Grinex and Meer, saw spikes in volume following Garantex’s disruption, suggesting possible roles in fund migration.

What actions can regulators or law enforcement take in response?

While Kyrgyzstan’s current rules allow foreign nationals to register VASPs without being physically present, several measures could raise the cost of abuse. These include stricter ownership disclosure requirements, closer scrutiny of common control indicators, and enhanced transparency around funding sources. Without proactive intervention, similar models could be replicated in neighboring countries — posing broader risks to global sanctions enforcement efforts.