RU

Garantex and Grinex Sanctions: What Holders Should Know

By TopAML editorialPublished 29 Oct 20264 min read

Garantex has been on the US sanctions list since April 2022. US and European authorities took down its websites and servers in March 2025, and in August 2025 the US Treasury named its successor, Grinex, and the ruble-backed A7A5 token's issuer as well. Funds that come from addresses on these listings are sanctions exposure, and many exchanges treat them that way.

The 2022 designation

On 5 April 2022, the Treasury's Office of Foreign Assets Control (OFAC) designated Garantex under Executive Order 14024, for operating in Russia's financial services sector.[1] Treasury described it as an exchange founded in late 2019 and first registered in Estonia, with most of its operations in Moscow and St. Petersburg. It lost its Estonian licence in February 2022.[1]

Treasury said over $100 million of Garantex transactions were linked to illicit actors and darknet markets. That included nearly $6 million from the Conti ransomware group and about $2.6 million from the Hydra darknet market.[1]

The SDN list entry for Garantex Europe OU included three digital currency addresses: one bitcoin, one Ethereum and one USDT address.[2]

The March 2025 takedown

On 6 March 2025, the US Secret Service seized three Garantex domains: garantex.org, garantex.io and garantex.academy. German and Finnish law enforcement seized servers that hosted the exchange.[3] Over $26 million in cryptocurrency was frozen.[4]

On 7 March 2025, the Justice Department unsealed charges against two men. Aleksej Besciokov, a Lithuanian national living in Russia, was described as the main technical administrator. Aleksandr Mira Serda, a Russian national living in the UAE, was described as co-founder and chief commercial officer.[4] Both are charged with conspiracy to commit money laundering. Besciokov is also charged with conspiracy to violate sanctions and to run an unlicensed money transmitting business.[4] Charges are allegations; a defendant is presumed innocent until proven guilty.

According to the Justice Department, Garantex processed at least $96 billion in crypto transactions since April 2019.[4] Treasury later said Besciokov was arrested in India after the indictment was unsealed.[5]

August 2025: Grinex, A7 and A7A5

On 14 August 2025, OFAC re-designated Garantex, adding a cyber-related authority, E.O. 13694, to the 2022 one.[5] The same action covered:

  • Grinex. Treasury called it Garantex's successor, created by Garantex staff to help it evade sanctions. Its infrastructure was set up right after the March 2025 takedown, and Garantex customer deposits were moved to it.[5]
  • Three executives: Sergey Mendeleev, Aleksandr Mira Serda and Pavel Karavatsky.[5]
  • Six companies: A7, A71, A7 Agent, Old Vector, InDeFi Bank and Exved.[5]

A7 is a Russian firm that Treasury said runs cross-border settlement platforms used for sanctions evasion. Old Vector, a Kyrgyz company, issues A7A5, a ruble-backed token. Treasury said Garantex users who lost funds were given the equivalent of their losses in A7A5.[5]

The updated SDN entries list wallet addresses. Garantex has 12, across bitcoin, Ethereum, USDT and Tron. Grinex has seven Tron addresses. Old Vector has two.[6]

On 1 October 2026, Treasury went further and sanctioned the A7 Network as a transnational criminal organisation. That release calls A7A5 a blocked, ruble-backed token.[7]

Why linked funds get flagged

A sanctions listing with wallet addresses gives screening tools something exact to match. When a payment comes from a listed address, or passed through one earlier in its path, checkers can put it in the sanctions category. See what a risk score means for how direct and indirect exposure differ.

The legal effect is broad. Property of blocked persons in the US or controlled by US persons is blocked and must be reported to OFAC. Companies 50% or more owned by blocked persons are blocked too.[5] OFAC says these rules apply the same way to virtual currency, and that US exchanges and wallet providers generally cannot handle transactions involving blocked persons.[8]

Many non-US exchanges and stablecoin issuers screen against the same list. That is why a deposit with a Garantex, Grinex or A7A5 trail can be held or refused, even far from the US.

What to do

  1. Do not move old Garantex balances through Grinex. Treasury treats Grinex as part of the same sanctions evasion scheme.[5]
  2. Be careful with A7A5. It is described by Treasury as a blocked token. Converting it or sending it on can carry the same exposure.[7]
  3. Check incoming funds before you accept them, especially in P2P trades with Russian or Kyrgyz counterparties. Our free AML check list covers basic options.
  4. Keep records. Save trade history, chats and transaction IDs. An exchange that holds a deposit will ask where it came from. Our guide on exchange freezes explains the usual process.
  5. Ignore "unfreeze" offers. No private service can remove an address from the SDN list. Only OFAC decides listings and licences.
  6. Get legal advice if you held significant funds on Garantex. This article is not legal advice.

For a case where sanctions were later lifted, see our post on Tornado Cash.

General information, not legal or financial advice. Rules differ by country and change; check the linked sources.

Sources

  1. U.S. Department of the Treasury — Treasury Sanctions Russia-Based Hydra, World's Largest Darknet Market, and Ransomware-Enabling Virtual Currency Exchange Garantex (5 Apr 2022). Checked 4 Nov 2026.
  2. Office of Foreign Assets Control — Russia-related Designation; Cyber-related Designation (5 Apr 2022). Checked 4 Nov 2026.
  3. U.S. Secret Service — U.S. Secret Service Seizes Russian Cryptocurrency Exchange Websites (7 Mar 2025). Checked 4 Nov 2026.
  4. U.S. Department of Justice — Garantex Cryptocurrency Exchange Disrupted in International Operation (7 Mar 2025). Checked 4 Nov 2026.
  5. U.S. Department of the Treasury — Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals (14 Aug 2025). Checked 4 Nov 2026.
  6. Office of Foreign Assets Control — Counter Narcotics and Counter Terrorism Designations and Designation Updates; Cyber-related Designations (14 Aug 2025). Checked 4 Nov 2026.
  7. U.S. Department of the Treasury — Operation Economic Outcast Takes Unprecedented Action Against Sanctions Evasion Network Used by Iran (1 Oct 2026). Checked 4 Nov 2026.
  8. Office of Foreign Assets Control — FAQ 1021: Russia-related sanctions and virtual currency. Checked 4 Nov 2026.