The United States imposes sanctions on Garantex and Grinex due to ransomware involvement

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has renewed sanctions against the Russian cryptocurrency exchange platform Garantex for facilitating ransomware actors and other cybercriminals. Since 2019, Garantex has processed over $100 million in transactions linked to illicit activities. The Treasury has also imposed sanctions on Garantex’s successor, Grinex, along with three Garantex executives—Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky—and six associated companies in Russia and the Kyrgyz Republic. Under Secretary of the Treasury for Terrorism and Financial Intelligence, John K. Hurley, stated that the U.S. will not tolerate the abuse of digital assets to support cybercrime and sanctions evasion, emphasising that such exploitation threatens national security and tarnishes the reputations of legitimate virtual asset service providers.

Garantex was initially sanctioned by the U.S. in April 2022 for facilitating transactions from darknet markets and illicit actors, including Hydra and Conti. In March 2025, law enforcement seized Garantex’s website, and co-founder Aleksej Besciokov was arrested in India. Shortly after, TRM Labs reported that Garantex may have rebranded as Grinex to evade sanctions, continuing to process significant transactions, with 82% linked to sanctioned entities. Following Garantex’s takedown, Telegram channels began promoting Grinex, which was registered in Kyrgyzstan in December 2024. The U.S. Treasury indicated that Garantex was used by criminals to launder funds from various ransomware variants and that it moved its infrastructure to Grinex post-sanctions. Garantex reportedly assisted customers in regaining account access using a ruble-backed stablecoin called A7A5, which has been involved in substantial daily transfers, with Grinex estimated to have facilitated billions in cryptocurrency transactions in a short period.