When the US Treasury blacklisted Moscow-based cryptocurrency exchange Garantex in 2022, Western officials touted the move as a major step in choking off Russia’s access to the global financial system. Estonian regulators soon revoked its license, and law enforcement agencies conducted raids on its servers and websites. But far from disappearing, Garantex mutated. Today, investigators describe it as a shape-shifting network of successor platforms and offshore entities that continues to funnel billions of dollars across borders, evading sanctions and enabling sensitive trade.

A new investigation by Transparency International Russia in Exile and the Organized Crime and Corruption Reporting Project (OCCRP) reveals how the blacklisted exchange has resurfaced under new banners-Exved, MKAN Coin, and Grinex-operating a sophisticated laundering system stretching from Moscow to Dubai, Kyrgyzstan, Hong Kong, and beyond. At its core, the network uses banks, shell companies, and encrypted Telegram channels to process vast sums of money that often blur the line between legitimate trade and illicit activity.

Founded in 2019, Garantex grew rapidly into one of Russia’s largest cryptocurrency exchanges. According to blockchain analytics firm Chainalysis, between 2019 and 2025 it processed nearly $96 billion, with at least $1.3 billion linked to criminal activity, including ransomware payouts, darknet markets, and sanctioned Russian entities.

In March 2025, coordinated raids targeted Garantex’s infrastructure, and the US Justice Department unsealed indictments against several administrators. Indian authorities even arrested a system administrator at Washington’s request. Yet, within weeks, successor platforms emerged, many sharing the same infrastructure, personnel, and wallets.

The most prominent reincarnation is Exved, headed by Garantex co-founder Sergey Mendeleev. Officially registered as a domestic “payment facilitator,” Exved operates from Moscow City, offering clients a way to move money seamlessly across borders. Russian customers pay in rubles, while foreign partners receive hard currency or stablecoins abroad.

Investigators posing as traders in Hong Kong described the onboarding process as “minimal,” requiring only basic documentation. Transactions are routed through Paysol, a Russian-registered firm that serves as Exved’s “agent.” Conversations with Exved representatives outlined the mechanics: rubles are sent to the Russian bank account of a foreign-registered intermediary-often a Hong Kong shell company-which then forwards equivalent sums in US dollars, yuan, or the stablecoin Tether (USDT) to suppliers abroad. Contracts omit any reference to cryptocurrency, masking the true nature of the transfers.

One Exved agent assured investigators: “No bank will know. It is visible only between us.”

Exved charges a three percent commission on transfers over $50,000, and Russian banks like T-Bank and Expobank were cited as key ruble-side partners. Offshore, JP Morgan, Deutsche Bank, and the Bank of China were mentioned as conduits, though these banks may be unwitting participants, handling flows that appear legitimate.

Investigators also found Exved’s network used to purchase dual-use goods-including microprocessors and telecommunications equipment-from China and Taiwan. Paysol staff admitted that invoices could be “adjusted” to evade customs restrictions, highlighting how the system potentially supports Russia’s sanctioned defense and tech sectors.

Blockchain data confirmed the ties: wallets linked to Exved and Paysol directly interacted with sanctioned Garantex addresses. One wallet processed over $563 million, including a $234,000 transfer from Garantex Europe on December 25, 2024, followed weeks later by $2.6 million to Paysol. Some funds even flowed back into Garantex, a classic layering tactic designed to obscure origins.

Beyond Moscow, Garantex’s footprint spread. MKAN Coin, led by former executive Mohammad Khalifa, operated across Dubai, Kyrgyzstan, Brazil, Spain, and Thailand, offering crypto-to-cash services via Telegram. Though Dubai regulators shut it down in 2024, Kyrgyz authorities later blacklisted affiliated entities for money laundering.

Not long after MKAN’s closure, another successor, Grinex, surfaced in early 2025. Analysts at TRM Labs and Global Ledger uncovered strong links to Garantex infrastructure, including shared bots and wallets. Grinex even launched a ruble-pegged stablecoin, A7A5, backed by accounts at Promsvyazbank, a sanctioned Russian state bank. In just four months, A7A5 processed $9.3 billion, demonstrating how quickly these networks adapt.

By August 2025, the US Treasury had expanded sanctions to include Exved, Grinex, and InDeFi Bank, along with executives Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky. The UK soon followed, specifically targeting the A7A5 token.

The investigation sheds light on the human actors sustaining this crypto laundromat. Sergey Kunitsa, head of Paysol, was previously involved in customs brokerage, giving him expertise in navigating trade restrictions. Aleksandr Mira Serda, also known by the alias Ntifo-Siao, remains active despite US indictments. Records show he purchased a $3 million villa in Dubai and even obtained a falsified Russian birth certificate listing a deceased Spanish citizen as his father-a move likely intended to complicate identification.

Throughout the network, Telegram serves as the primary operating layer. From onboarding new clients to drafting contracts, arranging payments, and coordinating shipments, everything is conducted in private chats and automated bots. The platform’s encryption and semi-anonymous structure make it ideal for such opaque operations.

As investigators concluded: “Telegram has become the central operating layer.”

Despite mounting sanctions, indictments, and raids, the Garantex-linked ecosystem shows remarkable resilience. Its decentralized design-spread across offshore intermediaries, shell companies, stablecoins, and encrypted communication channels-makes it hard to dismantle. The system thrives in legal gray zones, relying on state tolerance and weak regulatory enforcement in jurisdictions like Dubai and Kyrgyzstan.

Western governments hoped that targeting centralized exchanges like Garantex would cut off Russia’s illicit financial lifelines. Instead, the crackdown may have accelerated a pivot toward more decentralized, opaque, and resilient networks. Investigators describe it as a crypto laundromat: a constantly evolving machine that cleanses dirty rubles into usable dollars, yuan, or digital tokens, with little regard for the rules of the international financial system.

For now, from Moscow’s skyscrapers to Dubai’s villas, the network persists-an underground financial artery pulsing beneath the sanctions regime.

Please follow Blitz on Google News Channel