Garantex Reemerges: How a Sanctioned Crypto Network Continues to Launder Billions Across Borders

Despite being blacklisted in 2022 and repeatedly pursued by regulators and investigators, Garantex and its network of spin-offs have continued to move vast sums across borders. Between 2019 and 2025, blockchain analytics trace approximately $96 billion in transactions to entities linked to Garantex, with at least $1.3 billion directly associated with criminal activity. These flows were not isolated occurrences but part of a sophisticated, parallel payment ecosystem engineered to circumvent financial oversight.

Exved, the most visible successor to Garantex, demonstrates how laundering networks evolve under pressure. Though officially registered in Russia as a payment facilitator, Exved conceals its operations by channeling ruble deposits through offshore intermediaries that release equivalent sums abroad in foreign currency or stablecoins. Contracts omit any reference to cryptocurrency, while the layering of transactions relies on shell companies based in Hong Kong and other offshore hubs. This structure takes advantage of weak cross-border cooperation, allowing illicit transfers to blend seamlessly with legitimate commercial payments.

Blockchain data reveals how the laundering cycle functions in practice. Transfers between wallets associated with Garantex and successor platforms such as Paysol show deliberate attempts to obscure origins. By combining domestic legitimacy with offshore disbursement, the network replicates the dynamics of trade-based money laundering—only now powered by cryptocurrency and the anonymity offered by messaging platforms like Telegram.

When Garantex’s infrastructure was raided in early 2025—servers seized, domains frozen, and administrators charged—many believed the operation’s laundering apparatus had been dismantled. Instead, within weeks, new entities emerged that were rebranded but unmistakably connected to the original network. Exved became the flagship, posing as a Moscow-based settlement platform. Behind its legitimate facade, ruble inflows were mirrored by dollar, yuan, or stablecoin outflows abroad, ensuring continuity for clients with minimal disruption.

The rebuilding relied on both technical dexterity and social engineering. Wallets once tied to Garantex were quietly repurposed to serve Exved and Paysol—the so-called “agent” entity managing ruble-side settlements. Funds rotated between old and new wallets in a calculated layering process designed to give the illusion of new infrastructure while retaining control over existing channels. Offshore companies in Hong Kong and elsewhere signed trade contracts that avoided any mention of cryptocurrency, granting the operations a veneer of legality.

Grinex marked the next stage in this evolution. By issuing a ruble-pegged stablecoin known as A7A5—backed by accounts at a sanctioned Russian bank—the network created a parallel settlement layer immune to traditional restrictions. Within mere months, billions of dollars had circulated through this token, proving that the reconstruction was not merely defensive but expansive. Throughout the process, Telegram served as the connective tissue: private channels and bots guided users through the migration, provided instant onboarding with minimal documentation, and sustained confidence in the face of enforcement actions. The raids effectively forced Garantex to decentralize, creating a more intricate and resilient laundering system than before.

The durability of these schemes rests on their exploitation of both domestic and international banking channels. Russian financial institutions manage ruble settlements, while banks in Hong Kong, Europe, and China appear to facilitate the corresponding hard currency flows. The involvement of prominent banking names underscores the systemic risk—legitimate institutions may unknowingly process payments that, beneath trade paperwork and shell structures, represent crypto-linked laundering operations.

Offshore intermediaries like Paysol embody this vulnerability. Acting as “agents,” they navigate regulatory and jurisdictional gaps, presenting as local firms while conducting transactions through foreign-registered shells. Invoices are frequently altered to disguise the nature of goods traded—a long-standing tactic in trade-based laundering. The scheme’s overlap with sanctions evasion is clear: among the goods financed are microprocessors and telecom components with dual-use potential.

The launch of ruble-pegged stablecoins, such as Grinex’s A7A5, compounds the challenge. By tying a digital asset to accounts held at sanctioned banks, the operators effectively rebuilt liquidity channels cut off from conventional correspondent banking systems. Within just four months of launch, A7A5 processed $9.3 billion, illustrating how crypto-based mechanisms can quickly restore and even expand the flow of illicit funds.

Garantex’s ability to rebrand and relocate illustrates the defining trait of crypto-enabled laundering: fragmentation. Successors like MKAN Coin in Dubai, Kyrgyzstan, and other permissive jurisdictions demonstrate strategic “jurisdiction shopping.” When one regulatory environment tightens, the network swiftly moves to another, exploiting weaker oversight and smaller financial markets. This adaptability ensures uninterrupted service for clients seeking to move funds discreetly.

Encrypted communication platforms, especially Telegram, have become central to this model. Every operational element—from customer onboarding to contract negotiation—is conducted via bots and private channels. This decentralized communication network is largely beyond the reach of conventional compliance tools such as customer due diligence and transaction monitoring. Telegram’s accessibility, anonymity, and vast user base have turned it into the infrastructure of choice for laundering networks.

The persistence of the individuals behind these operations further complicates enforcement. Executives charged in one country continue to operate under new identities or offshore registrations elsewhere. The acquisition of luxury real estate, such as villas in Dubai, highlights how illicit profits are reintroduced into the legitimate economy. These assets are not incidental—they represent the successful end stage of laundering strategies that reintegrate tainted capital into lawful financial systems.

The Garantex case offers critical lessons for anti-money laundering enforcement. Even coordinated sanctions and law enforcement actions face serious limitations against decentralized, crypto-driven laundering ecosystems. Traditional AML tools—such as suspicious transaction reporting and correspondent banking controls—struggle against a network combining blockchain transactions, shell entities, and encrypted communications.

Several insights emerge from this case. Sanctions alone cannot dismantle networks capable of rapid rebranding under new legal identities. Trade-based money laundering remains central, with cryptocurrency acting as an enhancer rather than a replacement. Messaging platforms like Telegram now underpin operational resilience, necessitating regulatory attention to financial activities occurring outside the formal system. Stablecoins pegged to restricted currencies create new laundering avenues, bridging domestic and offshore markets with little transparency.

For regulators, the central challenge lies in harmonizing cross-border enforcement. Financial institutions must intensify due diligence on high-risk intermediaries, while authorities should invest in real-time blockchain analytics. Collaboration with messaging platforms may prove vital in disrupting the communications that sustain these operations. Without closing these gaps, laundering networks like Garantex’s will continue to recycle criminal proceeds through the legitimate global financial system—quietly, efficiently, and at staggering scale.

By fLEXI tEAM