Despite being blacklisted in 2022 and repeatedly targeted by regulators and investigators, Garantex and its spin-offs have kept moving billions across borders. Between 2019 and 2025, blockchain analysis attributes roughly $96 billion in processed transactions to the network, of which at least $1.3 billion directly links to criminal activity. These flows were not isolated but deeply embedded in parallel payment structures designed to bypass financial oversight.

Money laundering through Garantex and its successors

Exved, Garantex’s most prominent successor, reveals how money laundering mechanisms evolve when confronted with restrictions. Officially registered as a payment facilitator in Russia, Exved masks its operations by channeling ruble deposits into offshore intermediaries that release equivalent funds abroad in hard currency or stablecoins. Contracts make no mention of cryptocurrency, and the layering process involves shell companies in Hong Kong and beyond. This approach exploits weaknesses in cross-border financial cooperation, allowing illicit value transfers to blend into legitimate trade payments.

The laundering cycle becomes even clearer through blockchain connections between sanctioned wallets and successor exchanges. Transfers from Garantex-affiliated addresses to Paysol and back again demonstrate deliberate layering to obscure origins. By combining onshore legitimacy with offshore disbursement, Garantex’s structure mirrors classic trade-based money laundering, but it is turbocharged by crypto infrastructure and the anonymity of messaging platforms like Telegram.

How Garantex Rebuilt Its Money Laundering Web After Raids

When investigators raided Garantex’s infrastructure in early 2025, seizing servers, freezing domains, and indicting administrators, the expectation was that the exchange’s laundering engine would be dismantled. Instead, within weeks, new entities appeared, rebranded but unmistakably connected to the original network. Exved emerged as the flagship successor, presenting itself as a domestic payment facilitator in Moscow City. By disguising itself as a legitimate settlement platform, it allowed ruble inflows to be mirrored by equivalent dollar, yuan, or stablecoin outflows abroad. This model preserved client trust and ensured continuity of services with only minimal disruption.

The rebuilding process relied on a mix of technical agility and social engineering. Blockchain wallets associated with Garantex were quietly repurposed to serve Exved and Paysol, the so-called “agent” firm that executed ruble-side transactions. Funds cycled back and forth between old and new addresses, a deliberate layering technique that gave the impression of new infrastructure while maintaining control of the same financial pipelines. Offshore shell companies in Hong Kong and elsewhere were used to sign trade contracts that omitted any mention of cryptocurrency, giving the transactions a veneer of legitimacy.

Grinex represented the next phase of the rebuild. By launching the ruble-pegged stablecoin A7A5, backed by accounts at a sanctioned Russian bank, the operators created a parallel settlement layer immune to conventional restrictions. Within months, billions had flowed through this token, underscoring how the rebuild was not only defensive but also expansionary. Telegram provided the glue throughout: private channels and bots ensured that clients knew where to migrate, offered real-time onboarding with minimal documentation, and maintained a sense of stability despite the apparent collapse. In effect, the raids forced Garantex to decentralize, making the laundering web more complex, resilient, and difficult to uproot than before.

Offshore intermediaries and banking channels

The resilience of these laundering schemes depends on their ability to exploit both domestic and international financial channels. Russian banks provide ruble-side settlement, while large foreign institutions in Hong Kong, Europe, and China appear as conduits for corresponding hard currency flows. The presence of recognizable banking brands highlights the systemic challenge: large institutions may process payments that appear clean but actually represent crypto-linked laundering schemes hidden through trade contracts and shell structures.

Offshore intermediaries such as Paysol embody the central risk. Their role as “agents” allows them to straddle both regulatory gaps and geographical loopholes. A Russian-registered firm can act as the face of a transaction, but the real flows are driven through foreign-registered shell entities that obscure counterparties. Invoices may be modified to disguise the nature of traded goods, a tactic long associated with trade-based laundering. The laundering process thus intertwines with sanctions evasion, since items purchased include microprocessors and telecom equipment with dual-use potential.

The move to issue ruble-pegged stablecoins, as seen with Grinex’s A7A5 token, further complicates oversight. By creating an instrument backed by sanctioned banks, the network re-establishes liquidity pathways cut off by traditional correspondent banking restrictions. Within four months of its launch, A7A5 processed $9.3 billion, showing how crypto-based solutions can rapidly fill the gap left by traditional payment systems and extend laundering capacity.

Adapting laundering networks across borders

Garantex’s ability to rebrand and relocate underscores a defining feature of crypto-enabled laundering: fragmentation. Successors like MKAN Coin in Dubai, Kyrgyzstan, and other jurisdictions illustrate the use of jurisdiction shopping. When one regulatory environment becomes hostile, operators shift to more permissive regions or exploit regulatory blind spots in smaller states. This fluidity ensures continuity of service for clients seeking discreet transfer channels.

The reliance on encrypted platforms like Telegram as the operational backbone further insulates these schemes. Every aspect, from onboarding to contractual agreements, is managed through bots and private chats. This creates a decentralized communication layer resistant to traditional compliance measures such as customer due diligence and transaction monitoring. Telegram, while not designed for financial services, has become the infrastructure of choice for laundering syndicates because of its ease of access, anonymity, and scale.

The persistence of individuals behind these networks also exposes a broader problem. Executives indicted in one jurisdiction continue to operate through alternative identities or offshore registrations. Ownership of luxury assets abroad, such as villas in Dubai, reflects how illicit profits cycle back into the legitimate economy. These personal acquisitions are not incidental but a direct outcome of laundering strategies that successfully reintroduce illicit capital into the global financial system.

Lessons for AML enforcement

The Garantex case demonstrates that even coordinated sanctions and enforcement actions face significant challenges against decentralized laundering networks. Traditional AML tools such as suspicious transaction reporting and correspondent banking oversight are often insufficient when layered with crypto transfers, shell companies, and encrypted communication platforms.

Key lessons emerge:

• Sanctions alone cannot disrupt networks that rapidly rebrand under new legal entities.
• Trade-based money laundering remains central, with crypto acting as a facilitator rather than a replacement.
• Messaging platforms like Telegram provide operational resilience, requiring closer monitoring of financial activity occurring outside traditional institutions.
• Stablecoins pegged to restricted currencies represent a new laundering frontier, bridging onshore and offshore flows with minimal transparency.

For regulators, the challenge lies in harmonizing enforcement across jurisdictions and sectors. Financial institutions must enhance their due diligence on counterparties involved in high-risk payment facilitation, while regulators must invest in real-time blockchain monitoring. Collaboration with messaging platforms may also be necessary to disrupt the communication channels that sustain these schemes. Without closing these gaps, laundering networks will continue to recycle illicit flows into the legitimate financial system.

---

Related Links

• U.S. Department of the Treasury
• European Banking Authority
• Financial Crimes Enforcement Network
• European Commission on Anti-Money Laundering
• FATF Official Website

Other FinCrime Central Articles About Garantex

• US Sanctions Hit Garantex And Grinex As Crypto Crime Network Unravels
• Garantex Cryptocurrency Exchange Brought Down: A Major Blow to Money Laundering Networks

Source: OCCRP

Some of FinCrime Central’s articles may have been enriched or edited with the help of AI tools. It may contain unintentional errors.

Want to promote your brand, or need some help selecting the right solution or the right advisory firm? Email us at info@fincrimecentral.com; we probably have the right contact for you.