US updates sanctions on Russian cryptocurrency exchange Garantex

Sanctions on Russian cryptocurrency exchange Garantex were renewed on Thursday by U.S. officials who said the platform has directly helped ransomware gangs and cybercriminals launder more than $100 million since 2019.

Garantex was originally sanctioned by the Treasury Department in 2022 and officials redesignated the exchange this week alongside the company’s successor, Grinex; three executives; and six associated companies in Russia and the Kyrgyz Republic. 

“Exploiting cryptocurrency exchanges to launder money and facilitate ransomware attacks not only threatens our national security, but also tarnishes the reputations of legitimate virtual asset service providers,” said John Hurley, undersecretary of the Treasury for terrorism and financial intelligence.

Hurley said that Garantex continues to play a crucial role in supporting cybercrime and sanctions evasion through Grinex. 

The sanctions come months after the FBI and other U.S. agencies worked with Finnish and German law enforcement to seize servers that hosted Garantex’s operations. They also took down several of the company’s websites, replacing it with a law enforcement banner. 

Garantex was founded in 2019 and became one of the largest cryptocurrency exchanges in Russia, gaining further prominence after Russia’s invasion of Ukraine in 2022. 

The platform allowed people to circumvent sanctions on Russian banks by bringing rubles to the company’s offices in Moscow and St. Petersburg and getting cryptocurrency in return, which could then be exchanged for other fiat currencies. 

U.S. and European law enforcement agencies have repeatedly accused the platform of being used by cybercriminals as well as gangs and designated terrorist groups.

In announcing the Garantex takedown, the DOJ also revealed indictments of 46-year-old Lithuanian national Aleksej Besciokov and 40-year-old Russian Aleksandr Mira Serda — two people accused of running Garantex from 2019 to 2025. Serda is a co-founder of the company and is chief commercial officer.

Prosecutors said Besciokov and Mira Serda knew the platform was being used to process money obtained illegally and actively tried to hide this, even from Russian law enforcement.  

Besciokov was arrested later in India but Serda has still not been detained. The State Department issued a $5 million reward for information leading to the arrest of Serda and $1 million for information on any other key leaders of Garantex.

U.S. prosecutors said despite the 2022 Treasury Department sanctions, Besciokov and others continued to conduct transactions with U.S. entities — going so far as to redesign Garantex to evade the sanctions.  

Court documents say Garantex was able to evade sanctions by constantly moving the company’s operational cryptocurrency to different virtual wallets each day — making it nearly impossible for U.S. cryptocurrency exchanges to block transactions associated with Garantex accounts. 

The European Union announced its own sanctions on Garantex in March, writing that the platform was used to circumvent sanctions and had ties to Russian banks that had also been sanctioned. Europol told Recorded Future News that it provided forensic support for the March 2025 takedown operation.

Grinex and A7A5

On Thursday, U.S. officials said the March indictment prompted Garantex to move its customer base and funds to Grinex, “in an attempt to continue operating despite sanctions and law enforcement actions.”

Garantex has faced international scrutiny due to its prominent role in the Russian ransomware ecosystem. U.S. officials said investigators traced over $100 million in transactions that were associated with illicit actors and darknet markets, including nearly $6 million from Russian ransomware gang Conti. 

The Treasury Department also linked cryptocurrency on the platform to money obtained by the Black Basta, Ryuk, LockBit, NetWalker and Phoenix Cryptolocker ransomware variants. 

Grinex has largely taken over for Garantex since March, facilitating billions of dollars’ worth of cryptocurrency transactions overall, officials said. 

U.S. officials said Garantex worked with customers affected by the law enforcement action in March to regain access to their accounts using a ruble-backed digital asset called A7A5 token. The token is issued by a Kyrgyzstani firm called Old Vector. 

Garantex users who lost money were given the equivalent amount in A7A5 tokens. Old Vector and several other Russian companies are also being sanctioned alongside Garantex. The sanctions also list Garantex co-founder Sergey Mendeleev, co-owner Pavel Karavatsky and Mira Serda. 

Two shell companies owned by Mendeleev were added to the sanctions list as well. 

Blockchain security firm Elliptic published a blog post detailing the extensive web of companies that support Garantex’s operations and allow it to evade previous sanctions. Elliptic’s Tom Robinson lauded the Treasury Department’s latest action in comments to Recorded Future News.

“This is a positive move from [the Office of Foreign Assets Control] – we're increasingly seeing both US dollar and ruble-backed stablecoins being used to evade sanctions imposed on Russia,” he said.