US Treasury Sanctions Garantex and Grinex Over $100 Million in Illicit Crypto Transactions

Highlights:

• The US Treasury has sanctioned Garantex and Grinex for laundering crypto funds.
• Authorities seized $26 million in crypto and dismantled Garantex’s infrastructure during a coordinated operation.
• TRM Labs noted that Garantex planned sanctions evasion months earlier by creating Grinex and using a ruble-backed token.

The United States Treasury Department has intensified its actions against illicit cryptocurrency operations by imposing fresh sanctions on Garantex Europe OU and its successor platform, Grinex. Officials accuse the Russian-linked exchange of processing more than $100 million in transactions connected to ransomware groups, darknet markets, and other cybercrime activities. The Office of Foreign Assets Control announced measures against Garantex executives and other related companies in Russia and Kyrgyzstan.

US SANCTIONS RUSSIAN CRYPTO EXCHANGES GARANTEX AND GRINEX

US Treasury redesignates Russian crypto exchange Garantex and its successor Grinex to the sanctions list.

Previous attempts to shut Garantex failed, with the exchange activating contingency plans to keep operating.

TRM…

— CryptoEdge (@EdGeraldX) August 15, 2025

Authorities state that Garantex continued servicing ransomware operators even after receiving sanctions three years ago for operating in Russia’s financial sector. The exchange is alleged to have transacted money on behalf of ransomware gangs and sanctioned groups. According to the Treasury, exploiting crypto exchanges for money laundering and ransomware use poses a national security risk and reflects badly on the honest reputation of legitimate virtual asset providers.

These US Treasury sanctions on Garantex follow a coordinated March 6 operation involving the U.S. Secret Service along with German and Finnish authorities. The partnership included taking over the Garantex web domain, freezing 26 million in cryptocurrency, and shutting down the company’s infrastructure. The DOJ has also unsealed indictments against two Russian executives who operated Garantex. Meanwhile, authorities have put a huge bounty on Mira Serda and other senior officials of the company.

Help us bring these Russian money launderers to justice! We are offering rewards totaling up to $6M for information leading to the arrests and/or convictions of the leaders of Garantex, a Russian virtual currency exchange. https://t.co/mUQe8czT2t pic.twitter.com/i2xA9rS7bI

— US Dept of State INL (@StateINL) August 14, 2025

Garantex Shifted Funds to Bypass Measures After Initial US Treasury Sanctions

Treasury officials allege that Garantex transferred customer funds to Grinex in a move that aimed to bypass the restrictions imposed in March. Promotional materials for the new exchange admitted it was established in response to the asset freezes.

Investigators found that Garantex and Grinex operated with a ruble-backed digital token, A7A5, to recover frozen funds for Russian clients. This token was attributed to the Russian entity A7 and its subsidiaries, which, according to U.S. officials, are under the control of sanctioned individuals. Grinex, A7, its subsidiaries, and Old Vector have now been sanctioned by OFAC due to their assistance in sanctions evasion.

Officials say Garantex executives Sergey Mendeleev, Mira Serda, and Pavel Karavatsky supported the exchange’s operations. They secured infrastructure, registered trademarks, and developed business activities to maintain an appearance of legitimacy. The sanctions also target InDeFi Bank and Exved, both controlled by Mendeleev, which allegedly facilitated cross-border crypto transfers outside U.S. restrictions.

TRM Labs Warns of Pre-Planned Sanctions Evasion

Blockchain intelligence firm TRM Labs stated that sanctions might not fully disrupt Garantex’s activities. The company believes Garantex prepared contingency plans long before enforcement measures. In Kyrgyzstan, records indicate that Grinex was registered in December, several months before the attack in March.

TRM Labs indicated that Garantex-related wallets started transferring funds into the A7A5 token in January this year. The move indicates that Granatex may have known earlier about the sanctions by the US Treasury and acted to set up a sanctions-resistant transfer framework. The U.S. has recently cracked down on other cybercrime operations, such as BidenCash and seized the assets of the BlackSuit ransomware group.