US Treasury Sanctions Grinex and Garantex: Inside the $100M Crypto Crime Network

The United States Department of the Treasury delivered a decisive blow against cryptocurrency-facilitated cybercrime on August 14, 2025, when its Office of Foreign Assets Control (OFAC) re-designated the Russian cryptocurrency exchange Garantex and sanctioned its successor platform Grinex. The coordinated action, involving the Secret Service, FBI, and international law enforcement partners, targets an exchange network responsible for processing over $100 million in transactions linked to ransomware operations, darknet markets, and sanctions evasion since 2019.

The Threat Landscape

The Garantex-Grinex network represents one of the most persistent threats in the cryptocurrency security ecosystem. Originally registered in Estonia in late 2019, Garantex operated primarily from Moscow and Saint Petersburg, building a user base of hundreds of thousands while systematically providing financial services to cybercriminals. Estonia’s Financial Intelligence Unit revoked Garantex’s digital asset license in February 2022 after discovering critical anti-money laundering deficiencies and connections to wallets used for criminal activity.

OFAC first designated Garantex in April 2022 under Executive Order 14024 for operating in Russia’s financial services sector. The March 2025 seizure of Garantex’s web domain by the U.S. Secret Service, in partnership with German and Finnish law enforcement, froze over $26 million in cryptocurrency controlled by the exchange. But rather than shutting down, Garantex migrated its entire customer base and remaining funds to Grinex, a platform specifically created to circumvent the sanctions and continue operations.

On August 14, with Bitcoin trading near $118,359 and the crypto market cap exceeding $3.5 trillion, OFAC escalated its response by designating both Garantex and Grinex under cyber authorities, while simultaneously targeting three Garantex executives and six associated companies across Russia and the Kyrgyz Republic.

Core Principles

Understanding how sanctions-evasion exchanges operate requires examining three core principles of their business model. First, these platforms exploit the pseudonymous nature of blockchain transactions to provide a haven for illicit funds. Most funds sent to Garantex originated from other cryptocurrency exchanges known for criminal conduct, creating a self-reinforcing ecosystem of money laundering.

Second, the rapid rebranding from Garantex to Grinex demonstrates the agility of illicit crypto operations. Within days of the March 2025 domain seizure, the exchange had migrated users and infrastructure to a new entity, complete with fresh branding and technical infrastructure. This whack-a-mole dynamic challenges traditional enforcement approaches.

Third, the network’s resilience depends on jurisdictional arbitrage. By operating across Russia, Estonia, and the Kyrgyz Republic, Garantex exploited gaps in international regulatory coordination to maintain operations despite being designated by the U.S. government.

Tooling and Setup

The enforcement action against Garantex and Grinex showcases the increasingly sophisticated tooling available to both sides of this conflict. On the government side, blockchain analytics firms like TRM Labs have developed the capability to trace transactions across multiple chains and protocols, identifying patterns that connect seemingly unrelated wallets to sanctioned entities.

The U.S. Secret Service’s Cyber Investigative Section employed cross-border coordination with German and Finnish law enforcement to execute the March 2025 domain seizure. The Department of Justice unsealed indictments against Garantex executives Aleksandr Mira Serda and Aleksej Besciokov, with Besciokov subsequently arrested in India.

For the exchanges, the tooling involves rapid infrastructure migration, the use of privacy-focused blockchain protocols, and exploitation of decentralized exchanges for fund conversion. The Grinex launch demonstrated pre-planned contingency infrastructure ready to deploy at a moment’s notice.

Ongoing Vigilance

The Department of State has announced rewards of up to $5 million for information leading to the arrest of Mira Serda and up to $1 million for other key Garantex leaders, signaling that this enforcement action is far from over. The message from Under Secretary John K. Hurley was unequivocal: “Digital assets play a crucial role in global innovation and economic development, and the United States will not tolerate abuse of this industry to support cybercrime and sanctions evasion.”

This action builds on a series of OFAC designations targeting cryptocurrency exchanges used for illicit purposes, including Cryptex (September 2024), SUEX (September 2021), Chatex, Bitpapa, NetEx24, and AWEX. Each designation provides new intelligence about the networks connecting cybercriminals to their financial infrastructure.

Final Takeaway

The Garantex-Grinex sanctions action demonstrates that while illicit cryptocurrency operations continue to evolve, so too does the enforcement response. For compliance officers and security professionals, the key lesson is the importance of continuous screening against updated sanctions lists and the need to monitor for rebranding and migration patterns. The crypto industry’s legitimacy depends on its ability to exclude bad actors, and enforcement actions like this one set the standard for what responsible platforms must detect and prevent.

Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Always conduct your own research and consult qualified professionals for compliance matters.