Billions Washed Through Garantex’s Shadow Crypto Web Despite Raids and Sanctions

Even after being sanctioned in 2022 and repeatedly struck by regulators and investigative agencies, Garantex and its offshoots have continued to funnel vast sums across borders.

From 2019 to 2025, blockchain forensics attribute roughly $96 billion in transactions to the network, of which at least $1.3 billion has been directly connected to criminal activities. These flows were not isolated but deeply embedded in alternative payment structures deliberately designed to bypass financial oversight.

Laundering Through Garantex and Its Offshoots

Exved, the most visible heir to Garantex, illustrates how laundering operations adapt when pressure mounts. Though formally registered in Russia as a payment facilitator, Exved conceals its true purpose by channeling ruble deposits through offshore intermediaries that later disburse equivalent amounts abroad, whether in hard currency or in stablecoins. Its contracts never explicitly mention cryptocurrency, while the layering process is driven through shell corporations in Hong Kong and other jurisdictions. This setup exploits weaknesses in cross-border financial coordination, allowing illicit transfers to masquerade as conventional trade payments.

Connections visible on-chain between sanctioned wallets and new exchanges reveal the laundering cycles at work. Transfers flowing between Garantex-linked addresses and Paysol show calculated layering efforts aimed at obscuring origins. By combining seemingly legitimate onshore transactions with offshore payouts, Garantex’s operation mirrors “classic trade-based money laundering,” but, as one investigator put it, “it is turbocharged by crypto infrastructure and the anonymity of messaging platforms like Telegram.”

How Garantex Rebuilt After Raids

When enforcement teams raided Garantex’s infrastructure in early 2025—seizing servers, freezing domains, and indicting key administrators—the expectation was that the laundering machinery had finally been broken. Yet within weeks, new entities appeared, rebranded but unmistakably tied to the old network. Exved surfaced as the flagship replacement, presenting itself as a domestic settlement service in Moscow City. By posing as a legitimate payments platform, it enabled ruble inflows to be mirrored by dollar, yuan, or stablecoin outflows abroad. This “allowed client trust to be preserved and services to continue with minimal disruption,” according to one insider.

The reconstitution relied on technical maneuvering and social engineering. Blockchain wallets once tied to Garantex were quietly recycled to serve both Exved and Paysol, the so-called “agent” firm handling ruble transactions. Funds were cycled repeatedly between legacy and new wallets, a deliberate layering process meant to create the illusion of fresh infrastructure while retaining control of the original financial arteries. Offshore shell firms in Hong Kong and elsewhere signed trade contracts that conspicuously avoided any mention of cryptocurrency, giving operations a veneer of legitimacy.

Grinex marked the next evolution in the rebuild. By issuing a ruble-pegged stablecoin called A7A5, backed by accounts held at a sanctioned Russian bank, operators created a parallel settlement system immune to traditional restrictions. Within a matter of months, billions had flowed through the token, showing that the rebuild was not merely defensive but aggressively expansionary. Telegram was the glue that held the network together: private channels and automated bots guided clients to the new platforms, offered near-instant onboarding with minimal documentation, and reassured users amid what looked like collapse. “In effect, the raids forced Garantex to decentralize,” said one analyst, “making the laundering network more complex, resilient, and harder to uproot than before.”

Offshore Channels and Banking Networks

The persistence of these schemes hinges on exploiting both domestic and global financial pipelines. Russian banks continue to provide ruble settlement, while major institutions in Hong Kong, Europe, and China serve as conduits for corresponding hard currency flows. The involvement of recognizable international banking names underscores the systemic challenge: such institutions may unknowingly process payments that appear legitimate but are in fact tied to crypto-linked laundering hidden behind trade contracts and shell entities.

Offshore firms such as Paysol represent the core vulnerability. As “agents,” they straddle regulatory blind spots and geographic loopholes. A Russian-registered entity may appear as the transaction face, but real movement is routed through foreign shell companies designed to obscure counterparties. Invoices are sometimes altered to conceal the true nature of goods, a tactic long known in trade-based laundering. These mechanisms also double as sanctions evasion tools, with purchases including microprocessors and telecommunications equipment that carry dual-use potential.

The introduction of ruble-pegged stablecoins like Grinex’s A7A5 token adds another complication. By using an instrument backed by sanctioned banks, the network has re-established liquidity routes blocked by correspondent banking restrictions. In just four months, A7A5 processed $9.3 billion, proof of how rapidly crypto-based instruments can fill voids left by traditional payment systems and extend laundering capabilities.

Cross-Border Adaptations

Garantex’s ability to rebrand and relocate illustrates a key trait of crypto-enabled laundering: fragmentation. Successors such as MKAN Coin in Dubai, Kyrgyzstan, and other jurisdictions demonstrate the use of “jurisdiction shopping.” Whenever one country’s regulations turn hostile, operators pivot to more permissive regions or exploit regulatory gray zones in smaller states. This mobility guarantees continuity for clients seeking discreet transfer channels.

Encrypted platforms like Telegram form the operational backbone, further shielding these schemes. Everything from onboarding to contractual arrangements takes place in bots and private chats, creating a decentralized communications infrastructure resistant to conventional compliance measures such as KYC and transaction monitoring. While not intended as a financial platform, “Telegram has become the infrastructure of choice for laundering syndicates,” said one investigator, “because of its ease of access, anonymity, and scale.”

The resilience of the individuals behind these networks highlights a broader issue. Executives indicted in one country resurface through alternative identities or offshore registrations. Proceeds are often funneled into high-end assets abroad, including villas in Dubai. These acquisitions are not incidental—they represent the successful reintegration of laundered funds into the legitimate global economy.

Enforcement Lessons

The Garantex saga underscores the limits of even coordinated sanctions and enforcement when faced with decentralized laundering webs. Traditional AML mechanisms—such as suspicious activity reporting or correspondent banking oversight—struggle against layered systems that combine crypto transfers, shell entities, and encrypted communications.

Several lessons stand out:

• “Sanctions alone cannot disrupt networks that rapidly rebrand under new legal identities.”

• “Trade-based money laundering remains central, with crypto acting as a facilitator rather than a replacement.”

• “Messaging platforms like Telegram provide operational resilience, requiring closer monitoring of financial activity occurring outside traditional institutions.”

• “Stablecoins pegged to restricted currencies represent a new laundering frontier, bridging onshore and offshore flows with minimal transparency.”

For regulators, the core challenge lies in aligning enforcement across jurisdictions and sectors. Financial institutions must sharpen due diligence around high-risk payment facilitators, while authorities need to invest in real-time blockchain tracking. “Collaboration with messaging platforms may also be necessary to disrupt the communication channels that sustain these schemes,” one expert said. Without closing these structural gaps, laundering networks will continue to recycle illicit wealth into the legal economy.

By fLEXI tEAM