US Imposes Sanctions on Crypto Exchange Linked to Russian Ransomware

The U.S. Department of the Treasury has imposed sanctions against Garantex, a cryptocurrency exchange with Russian connections, as part of an initiative to disrupt criminal networks engaging in ransomware operations. This action specifically targets the exchange’s founder and co-owners, aiming to hinder their ability to launder extorted funds.

In conjunction with these sanctions, Grinex, the successor of Garantex launched shortly after an international law enforcement operation dismantled Garantex’s operations and froze approximately $26 million in illicit funds, has also been sanctioned.

According to Treasury officials, Garantex and Grinex conspired to create a digital asset pegged to the Russian ruble, known as A7A5, which was issued to compensate customers who had their funds immobilized in Garantex’s frozen accounts. This token is reportedly issued by a company led by a sanctioned Moldovan oligarch and backed by Promsvyazbank, also under sanctions, restricting any transaction involving A7A5 from accessing the U.S. financial system.

Research from Chainalysis indicates that the A7A5 token has facilitated over $51 billion in transactions through July. Originally registered in Estonia in 2019, Garantex primarily operated from Russia and lost its license in 2022 due to severe anti-money laundering deficiencies and connections to criminal activity, including ransomware operations attributed to groups like Conti, LockBit, and Ryuk. The Kremlin has also been utilizing cryptocurrency as a means to bypass sanctions imposed post-invasion of Ukraine.

The recent enforcement actions included sanctions against six entities aligned with the exchange located in both Russia and the Kyrgyz Republic. The Treasury has specifically targeted key personnel within Garantex, notably co-founder Sergey Mendeleev and chief commercial officer Aleksandr Mira Serda, with Serda previously indicted in February by U.S. federal prosecutors.

Analysis from TRM Labs in March revealed that Garantex was responsible for approximately 70% of cryptocurrency flows to and from sanctioned jurisdictions. Notably, law enforcement’s actions have not curtailed these activities, as Garantex’s leadership appears to have enacted premeditated contingency plans, revealing a concerning degree of foresight regarding the takedown.

Promotional content from Grinex suggests its establishment was primarily a reaction to the sanctions against Garantex. Under Secretary of the Treasury for Terrorism and Financial Intelligence, John Hurley, emphasized that the exploitation of cryptocurrency exchanges for money laundering and ransomware financing poses significant threats to national security and undermines the credibility of legitimate virtual asset services.