On March 6, 2025 global law enforcement conducted one of the most significant international crackdowns on illicit cryptocurrency operations to date as it dismantled notorious exchange Garantex. Since its takedown a new exchange, Grinex, has emerged as a likely replacement.
TRM Labs analyzes this exchange’s links to Garantex and its use of stablecoin A7A5 potentially to evade sanctions, and examines other high-risk platforms that are positioning themselves to fill Garantex’s large void.
Key takeaways
- Despite being sanctioned by the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) since April 2022, Garantex processed over USD 100 billion in transactions — with 82% of its total volume linked to sanctioned entities worldwide — and remained a major node in ransomware, darknet markets, and other illicit activity.
- Days after Garantex’s takedown, Telegram channels affiliated with the exchange began promoting Grinex, a platform with a nearly identical interface, registered in Kyrgyzstan in December 2024.
- According to TRM’s on-chain analysis, from as early as January 2025, Garantex began moving funds into A7A5, a purported stablecoin pegged to the Russian ruble. Promoted as a means to recover frozen user assets, A7A5 appears engineered to evade sanctions, offering daily profit-sharing and anonymity through platforms like TRON and Ethereum.
- Beyond Grinex, TRM’s on-chain analysis shows that the exchanges ABCEX and Rapira experienced increases both in volume and number of transfers in March 2025, suggesting they are seeking to capture market share left by Garantex.
What led to Garantex’s takedown?
On March 6, 2025, Garantex announced on Telegram that it would be temporarily ceasing operations after Tether blocked approximately USD 28 million in USDT from the service. The exchange also shared 89 cryptocurrency addresses they claimed were frozen by Tether.
{{blogad-garantex-takedown-blog}}
Garantex, according to TRM, has been responsible for 82% of all crypto volumes associated with sanctioned entities worldwide and 70% since it was sanctioned by OFAC in April 2022.
The exchange has played a central role in facilitating illicit financial activity, sanctions evasion, and money laundering, processing over USD 100 million in transactions tied to darknet markets and ransomware groups like Conti and Hydra Market. The exchange has also been designated by the UK and the EU, marking the EU’s first ever sanctioning of specific cryptocurrency addresses.
Garantex was a major player in sanctions evasion, with 85% of crypto inflows to sanctioned entities and jurisdictions in 2024 linked to Garantex and Iranian exchange Nobitex, reinforcing its role as a persistent financial threat in the crypto ecosystem.
Although the Garantex domain was seized, only USD 28 million in assets were frozen — raising concerns that much of its infrastructure and funds remain active. Well-resourced sanctioned entities often re-emerge under new branding, in new jurisdictions, or via successor networks. TRM’s research found that one platform in particular looks likely to be a Garantex rebrand.
Grinex: Garantex 2.0?
In the days following its takedown, Telegram channels linked to Garantex — particularly the Garantex-adjacent Satoshkin group — began promoting a new platform, Grinex. Though first mentioned in August 2022, Grinex resurfaced only after the Garantex seizure, with Satoshkin describing it as “a new platform with familiar functionality.”
The similarities run deeper than interface aesthetics. According to Kyrgyz government records, Grinex was registered on December 23, 2024, by Duulat-eldar Sagynbeki Subankulov. Although little is known about Subankulov, open-source research suggests he may be a former professional gamer — adding another layer of ambiguity to Grinex’s origins.
Telegram users quickly noted the platform’s striking resemblance to Garantex, speculating that it may be a rebrand. Fueling this speculation, Grinex announced it had entered into an agreement with Garantex to onboard its clients and was considering hiring former Garantex employees. Even more revealing, Grinex began distributing former Garantex user assets through a new token, A7A5.
A7A5: A new stablecoin or sanctions evasion tool?
The A7A5 token, which claims to be pegged 1:1 to the Russian ruble, was announced on Telegram two weeks before the Garantex takedown. It is now available on Ethereum and TRON, and listed on the obscure exchange BiFinance, reportedly based in the British Virgin Islands and founded by an individual known only as “Bob.”
According to TRM Labs’ on-chain analysis, Garantex addresses began moving funds into A7A5 as early as January 2025, suggesting premeditated efforts to create a sanctions-resistant asset. The token promises daily profit-sharing to holders and has been advertised as a way for Garantex users to recover frozen assets. During an interview with Satoshkin, Garantex executives explicitly stated that A7A5 was developed to facilitate such transfers.
TRM observed transfers of this asset in January 2025, with large volumes of transfers among Garantex addresses in the weeks leading up to the operation targeting Garantex.
Kyrgyz records show A7A5 was launched by a company called Old Vector, registered on December 13, 2024 by Tatyana Sergeevna Menshikova. Another company, Trust Corporation, was registered on the same day, at the same address — a residential building on the outskirts of Bishkek, Kyrgyzstan that has hosted numerous shell entities. This raises further concerns about the opaque network behind A7A5. Some sources suggest a possible link to Russian bank Promsvyazbank’s A7 platform, designed for cross-border trade — a potential mechanism for sanctions evasion.
ABCEX, and Rapira: Rising replacements or next targets?
Beyond Grinex, other high-risk platforms may be positioning themselves to capture displaced Garantex volume. Chief among them is ABCEX, a Russian exchange tied directly to Garantex founder Sergey Mendeleev and Garantex’s third-largest on-chain counterparty.
In the days surrounding the Garantex seizure, ABCEX suffered a distributed denial of service (DDoS) attack and reported technical difficulties, while rumors of a police raid in Moscow spread across Telegram. The exchange is under investigation for facilitating transactions linked to the March 2024 Crocus City Hall terrorist attack and has a history of enabling online gambling and illicit finance.
TRM Labs has recorded many former Garantex users transitioning to Rapira — a Russia-tied high-risk exchange with exposure to sanctioned entities. TRM Labs has also observed on-chain exposure to Grinex.
TRM’s on-chain analysis showed an increase in both the volume and number of transactions for both ABCEX and Rapira in March 2025, the month Garantex was taken down. Although these figures fell for ABCEX in April, they continued to rise for Rapira. We also observed that ABCEX had similar volumes in November 2024 — though they dropped following reports of legal actions against one or more of the exchange’s high-level members.
Implications for compliance and enforcement
The speed with which Garantex rebranded to Grinex highlights the evolving nature of crypto-related financial crime. Sanctioned exchanges are no longer static targets; they adapt rapidly, use decentralized tools, and attempt to obfuscate ownership and transactions through complex layering tactics, including the use of stablecoins like A7A5.
For compliance teams, the case is a reminder to go beyond list-based monitoring. TRM Labs provides tools that enable real-time tracking of risk exposure, even through indirect paths. Whether via transaction monitoring, real-time alerts, or graph-based visualizations, TRM can help institutions detect exposure to sanctioned entities — even when funds pass through new platforms or tokens like A7A5.
Conclusion
The seizure of Garantex — the most prolific facilitator of sanctions evasion in the crypto ecosystem — was a landmark victory in the fight against crypto-enabled sanctions evasion and financial crime. But the story is far from over.
Whether it’s darknet markets or non-compliant virtual asset service providers (VASPS) like Garantex, when one is taken down others will rise to take its place — whether via a potential rebrand like Grinex or would-be successors like Rapira and ABCEX. Whatever happens in the wake of Garantex, the global compliance and enforcement community will need to stay one step ahead — and TRM Labs will continue to provide the intelligence and infrastructure to help them do so.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
