The Imitation Game: Following Garantex’s Takedown, Are These High-Risk Exchanges Copying Its Playbook?

On August 14, 2025, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced actions targeting the founder and co-owners of the previously sanctioned cryptocurrency exchange Garantex — one of the most prolific high-risk cryptocurrency exchanges in the world. The actions also targeted one of its successor platforms, Grinex, and the ruble-backed A7A5 token. 

This followed global law enforcement dismantling Garantex on March 6, 2025. In the aftermath, TRM Labs has identified a network of Kyrgyz-registered platforms likely connected to Garantex and used by Russia for sanctions evasion. These entities displayed similar on-chain behavior and featured identical user interfaces (UIs). Around the time of the law enforcement operation targeting Garantex, the entities received Garantex-linked funds, indicating they are highly likely associated with the exchange. 

These developments come amid renewed activity around other high-risk exchanges. Another exchange, ABCex, went offline due to a distributed denial of service (DDoS) attack around the time of the Garantex takedown. Then on July 31, 2025, ABCex announced on Telegram that it had resumed operations. Just weeks before its return, a platform called AEXbit, featuring an identical UI to ABCex, appeared in Garantex-linked channels, suggesting it may be a successor service. 

This blogpost explores the on-chain and behavioral connections between ABCex and AEXbit — including their use of tactics previously employed by Garantex and Grinex — and how this will likely impact the behavior of other high-risk exchanges facing heightened law enforcement pressure.

Key takeaways

• In the weeks following the Garantex takedown, TRM observed a sharp increase in inbound flows to ABCex from Garantex-linked sources. This surge coincided with ABCex experiencing a DDoS attack and temporarily going offline, suggesting it may be connected to Garantex. 
• AEXbit, a likely rebrand of ABCex, emerged in July 2025, sharing an identical UI and being promoted in a near-identical fashion on Telegram
• TRM has identified addresses attributed with near certainty to ABCex and AEXbit co-spending, which indicates they are almost certainly controlled by the same entity
• ABCex and AEXbit’s tactics closely mirror those previously employed by Garantex and its partial successor platform Grinex. This underscores how high-risk exchanges emulate other bad actors’ tactics in an attempt to evade law enforcement attention.

An overview of Garantex, Grinex, ABCex, and AEXbit

Garantex: The exchange has played a central role in facilitating illicit financial activity, sanctions evasion, and money laundering, processing over USD 100 million in transactions tied to ransomware groups like Conti and darknet markets such as the now-defunct Hydra Market. According to TRM, Garantex has been responsible for 82% of all crypto volumes associated with sanctioned entities worldwide and 70% since it was sanctioned by OFAC in April 2022.

Grinex: Likely a rebrand or partial successor to Garantex. Soon after Garantex’s takedown, Grinex emerged via Telegram channels closely tied to Garantex affiliates, featuring an identical UI and similar promotional narratives. 

ABCex: The exchange has historic ties to Garantex co-founder Sergey Mendeleev and was Garantex’s third-largest on-chain counterparty at one point. It has faced allegations of facilitating transactions linked to the March 2024 Crocus City Hall terrorist attack in Moscow, as well as enabling illicit gambling activity. Russian authorities were also rumored to have detained Mendeleev in late 2024 for his ties to this illicit gambling activity. However, he has since made frequent guest appearances on social media, suggesting the rumor was false. 

AEXbit: A new platform, announced in July 2025, with an identical interface to ABCex’s, leading to speculation that it’s a rebrand.

Is AEXbit an ABCex rebrand?

AEXbit’s timing, design, and promotional rollout have led Telegram users to speculate that the platform is a rebranded version of ABCex. The exchange even offers the same limited choice of coin swaps: TRON, Bitcoin, Ethereum, and Ruble. These factors suggest the operators are re-using ABCex’s infrastructure for continuity purposes — a tactic also employed by Garantex with Grinex in the wake of law enforcement actions.

Furthermore, TRM Labs has identified co-spending by addresses attributed with near certainty to AEXBit and ABCex, indicating that they are almost certainly controlled by the same entity. 

But what prompted ABCex to set up an alternate, identical exchange? It likely did so for one of the following reasons:

• Concerns over additional DDoS attacks
• Potentially being targeted by law enforcement

However, the latter approach to law enforcement evasion is unlikely to work given the successful uncovering of the connections between Garantex and Grinex.

‍

ABCex’s post-takedown activity suggests operational overlap with Garantex

In the weeks following the Garantex takedown, TRM observed a notable rise in Garantex-linked funds flowing to ABCex. While transaction volumes for ABCex dropped in April 2025, they had reached similar highs in November 2024 — before falling after reports of legal actions against senior members of the exchange. 

ABCex has since resumed operations, following a period marked by repeated DDoS incidents and “technical work” announcements. The timing of the initial DDoS attack and subsequent increase in Garantex-linked flows to ABCex suggest a potential operational link between the two services. 

How are ABCex and AEXbit emulating Garantex and Grinex’s tactics?

ABCex and AEXbit’s behavior mirrors that of Garantex and Grinex in two ways:

• Allegedly separate entities displaying identical UIs echoes the tactics Garantex used following its law enforcement takedown. Garantex launched Grinex, a similarly designed platform, to facilitate ongoing fund movements and sustain operational continuity.
• Both Garantex and Grinex displayed identical and unique structural indicators — signatures that advanced blockchain analytics can detect. The overlaps between ABCex and AEXbit are even stronger — they don’t appear to be using identical infrastructures, but are operating within the same infrastructure.

These similarities indicate that ABCEx and Garantex may have shared management. 

Conclusion

There’s insufficient information to confidently assess whether Garantex is directly linked to ABCex or AEXbit. However, the timing and tactics surrounding these platforms are consistent with Garantex’s behavior following its law enforcement takedown.

ABCex and AExbit likely following Garantex’s playbook underscores how bad actors’ law enforcement evasion tactics can act as a template for other criminals. We will likely continue to see other illicit actors borrowing techniques from one another to adapt to enforcement pressure, including replicating infrastructure, rebranding services, or shifting operational models to maintain access to client assets.

TRM will continue to monitor on-chain activity associated with these entities to assess potential overlap in infrastructure, funding mechanisms, and user behavior.

{{horiztonal-line}}

Frequently asked questions (FAQs)

What happened to Garantex, and why does it matter for high-risk exchanges?

Garantex, one of the world’s most prolific high-risk cryptocurrency exchanges, was dismantled by global law enforcement on March 6, 2025, after facilitating over USD 100 million in transactions linked to ransomware and darknet markets. The exchange had accounted for 82% of all crypto volumes associated with sanctioned entities globally. Its takedown marked a pivotal moment in enforcement against crypto-enabled illicit finance and prompted a wave of activity among similar platforms — some of which now appear to be adopting Garantex’s tactics to maintain continuity.

Is AEXbit a rebrand of ABCex?

AEXbit emerged in July 2025 with a nearly identical user interface and promotional rollout to ABCex, leading many Telegram users to speculate that it is a continuation of the same service. TRM Labs identified co-spending behavior involving addresses attributed with near certainty to both platforms — a strong signal that they are almost certainly operated by the same entity. These overlaps mirror the tactics used by Garantex when it launched Grinex following its takedown, suggesting a recurring pattern of rebranding to maintain continuity.

How are high-risk exchanges using rebranding to avoid enforcement scrutiny?

Some high-risk exchanges appear to be mirroring Garantex’s playbook by replicating platforms with identical interfaces and minimal technical variation. This tactic — designed to preserve access to user funds and infrastructure — may help operators evade initial enforcement actions or buy time before additional scrutiny. However, on-chain analysis often reveals overlaps in transaction flows and wallet activity that can expose such connections, as seen with ABCex and AEXbit.

Why is Kyrgyzstan emerging in the post-Garantex ecosystem?

TRM Labs has observed a cluster of Kyrgyz-registered entities that are highly likely connected to Garantex, including Grinex — a platform that helped users recover large TRON-denominated balances following the takedown. These entities displayed strong on-chain links to Garantex, mirrored its user interface, and were promoted via affiliated Telegram channels. Their emergence highlights the use of jurisdictional arbitrage by illicit actors seeking operational footholds outside major enforcement regimes.

What are the implications for sanctions evasion and law enforcement?

In the months following the Garantex takedown, platforms like ABCex and AEXbit have exhibited on-chain behaviors and operational patterns that closely resemble those previously used by Garantex and its successor, Grinex. While there is no confirmed link between ABCex or AEXbit and Garantex, their use of shared infrastructure, similar user interfaces, and co-spending activity suggests these platforms may be drawing from a common set of tactics. For law enforcement and compliance teams, this highlights the importance of monitoring behavioral signals — not just entity names — as high-risk exchanges adapt to enforcement pressure.