Blockchain intelligence company TRM Labs stated that although the cryptocurrency exchange Garantex Europe was sanctioned on Thursday, it may have already developed contingency plans to evade U.S. sanctions.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) again sanctioned Garantex and its successor Grinex on Thursday.

However, TRM Labs reported that these sanctions may be ineffective, as entities like Garantex appear to have been preparing contingency plans in advance, allowing them to swiftly relocate customers, infrastructure, and funds to successor platforms.

Garantex is one of the key channels used by ransomware gangs to launder illegal proceeds and is also involved in dark web market transactions and other illicit money flows. According to OFAC estimates, it processed at least $96 billion in cryptocurrency transactions from 2019 to March 2025.

The successor prepared a few months in advance

Authorities in the United States, Germany, and Finland took action against Garantex in March, but TRM Labs noted that according to Kyrgyz government records, Grinex was registered as early as December 2024, ready to take over its responsibilities.

Wallets associated with Garantex began transferring funds to the A7A5 stablecoin pegged to the Russian ruble in January 2025, indicating prior knowledge of the impending enforcement actions and an intention to establish a value transfer channel to resist sanctions.

Before being sanctioned in early 2022, Garantex had processed over $100 million in illegal transactions, and subsequently handled hundreds of millions more.

"The multinational actions in March 2025 failed to stop these activities, instead allowing Garantex to quickly activate contingency plans prepared months in advance," TRM Labs stated.

In the days following the crackdown on Garantex, Telegram channels related to the exchange began promoting Grinex as a similarly functional new platform.

Meer exchange may be another backup plan

Another cryptocurrency exchange, Meer, was one of the first to launch A7A5, and its features and trading interface are similar to those of Garantex and Grinex. According to TRM Labs, the site was also registered in December 2024, almost simultaneously with Grinex and A7A5.

This timing indicates 'coordinated development,' and the surge in trading volume after Garantex was shut down in March 2025 suggests 'it may be related to maintaining liquidity as an additional channel associated with the network's illicit financial activities.'

A7A5 also plays a core role in sanction evasion

The A7A5 token introduced in the transition from Garantex to Grinex played a role in facilitating the movement and recovery of frozen customer funds.

TRM Labs stated that the Garantex–Grinex–A7A5 system is a 'key case' for monitoring the migration of illegal activities and should prompt stricter due diligence for fiat-pegged tokens associated with opaque governance.

"This situation further illustrates that fiat-pegged tokens—often marketed as regular settlement or compensation tools—can be repurposed as a core part of sanction evasion strategies when associated with opaque corporate networks and sanctioned financial institutions," the company added.

Magazine: Everyone hates GPT-5, AI shows social media can't fix it: AI Research