Cointelegraph
--
Garantex had ‘contingency plans’ last time authorities tried to shut it down
Cryptocurrency exchange Garantex Europe, which was sanctioned on Thursday, could already have a contingency plan allowing it to skirt the impact of US sanctions, says blockchain intelligence firm TRM Labs.
On Thursday, the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Garantex a second time, along with its successor, Grinex.
However, TRM Labs said in a report on Thursday that the sanctions may turn out to be ineffective, as entities like Garantex “appear to prepare contingency plans well in advance of anticipated enforcement measures” which allow them to quickly migrate clients, infrastructure and funds to successor platforms.
Garantex was a key conduit used by ransomware gangs for laundering ill-gotten gains, darknet market transactions, and the movement of other illicit funds. OFAC estimates it processed at least $96 billion in crypto transactions from 2019 to March 2025.
Successors lined up months in advance
US, German and Finnish authorities took down Garantex infrastructure in March, but according to TRM Labs, Kyrgyz government records show Grinex was incorporated in December 2024, well before the seizure and was ready to take up the mantle.
Wallets connected to Garantex began moving funds into Russian ruble pegged stablecoin A7A5 in January 2025, weeks before the takedown, “underscoring foreknowledge of impending enforcement and the intent to establish a sanctions-resistant value-transfer channel,” the blockchain intelligence firm said.
Funds from Garantex were moved weeks before the takedown of its infrastructure in March 2025. Source: TRM Labs
Garantex was estimated to have processed more than $100 million in illicit transactions until its initial sanctions by OFAC in 2022, and hundreds of millions of dollars more following the designation.
“The March 2025 multinational takedown did not halt these activities. Instead, Garantex’s leadership quickly activated a contingency plan that appears to have been in place for months,” TRM Labs said.
“In the days following the Garantex disruption, Telegram channels linked to the exchange began promoting Grinex as a new platform with familiar functionality.”
Meer exchange possibly another backup plan
Another crypto exchange known as Meer was among the first to list A7A5 and has similar features and trading interfaces to Garantex and Grinex, according to TRM Labs.
The site was also registered in December 2024, around the same time as both Grinex and A7A5.
The timing points to “coordinated development,” TRM Labs said, and its surge in trading volume following the March 2025 enforcement action on Garantex suggests “it may have served as an additional channel for sustaining flows,” connected to the network’s illicit financial activity.
Meer could also be connected to Garantex’s operators. Source: TRM Labs
A7A5 central to sanctions evasion too
A key part of the transition from Garantex to Grinex after the takedown was the introduction of the A7A5 token, which helped facilitate the movement and recovery of frozen customer funds.
TRM Labs said the Garantex–Grinex–A7A5 nexus is a “critical case study” in monitoring illicit activity migration and should prompt enhanced due diligence to fiat-pegged tokens with non-transparent governance.
“The case further illustrates how fiat-pegged tokens—often marketed as routine settlement or compensation instruments—can be repurposed into core components of sanctions-evasion strategies when linked to opaque corporate networks and sanctioned financial institutions,” the firm added.
Magazine: Everybody hates GPT-5, AI shows social media can’t be fixed: AI Eye
On Thursday, the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Garantex a second time, along with its successor, Grinex.
However, TRM Labs said in a report on Thursday that the sanctions may turn out to be ineffective, as entities like Garantex “appear to prepare contingency plans well in advance of anticipated enforcement measures” which allow them to quickly migrate clients, infrastructure and funds to successor platforms.
Garantex was a key conduit used by ransomware gangs for laundering ill-gotten gains, darknet market transactions, and the movement of other illicit funds. OFAC estimates it processed at least $96 billion in crypto transactions from 2019 to March 2025.
Successors lined up months in advance
US, German and Finnish authorities took down Garantex infrastructure in March, but according to TRM Labs, Kyrgyz government records show Grinex was incorporated in December 2024, well before the seizure and was ready to take up the mantle.
Wallets connected to Garantex began moving funds into Russian ruble pegged stablecoin A7A5 in January 2025, weeks before the takedown, “underscoring foreknowledge of impending enforcement and the intent to establish a sanctions-resistant value-transfer channel,” the blockchain intelligence firm said.
Funds from Garantex were moved weeks before the takedown of its infrastructure in March 2025. Source: TRM Labs
Garantex was estimated to have processed more than $100 million in illicit transactions until its initial sanctions by OFAC in 2022, and hundreds of millions of dollars more following the designation.
“The March 2025 multinational takedown did not halt these activities. Instead, Garantex’s leadership quickly activated a contingency plan that appears to have been in place for months,” TRM Labs said.
“In the days following the Garantex disruption, Telegram channels linked to the exchange began promoting Grinex as a new platform with familiar functionality.”
Meer exchange possibly another backup plan
Another crypto exchange known as Meer was among the first to list A7A5 and has similar features and trading interfaces to Garantex and Grinex, according to TRM Labs.
The site was also registered in December 2024, around the same time as both Grinex and A7A5.
The timing points to “coordinated development,” TRM Labs said, and its surge in trading volume following the March 2025 enforcement action on Garantex suggests “it may have served as an additional channel for sustaining flows,” connected to the network’s illicit financial activity.
Meer could also be connected to Garantex’s operators. Source: TRM Labs
A7A5 central to sanctions evasion too
A key part of the transition from Garantex to Grinex after the takedown was the introduction of the A7A5 token, which helped facilitate the movement and recovery of frozen customer funds.
TRM Labs said the Garantex–Grinex–A7A5 nexus is a “critical case study” in monitoring illicit activity migration and should prompt enhanced due diligence to fiat-pegged tokens with non-transparent governance.
“The case further illustrates how fiat-pegged tokens—often marketed as routine settlement or compensation instruments—can be repurposed into core components of sanctions-evasion strategies when linked to opaque corporate networks and sanctioned financial institutions,” the firm added.
Magazine: Everybody hates GPT-5, AI shows social media can’t be fixed: AI Eye
Disclaimer: Includes third-party opinions. No financial advice. May include sponsored content. See T&Cs.