TRM Labs report

On March 6, 2025 global law enforcement conducted one of the most significant international crackdowns on illicit cryptocurrency operations to date as it dismantled notorious exchange Garantex. Since its takedown a new exchange, Grinex , has emerged as a likely replacement.

TRM Labs analyzes this exchange’s links to Garantex and its use of stablecoin A7A5 potentially to evade sanctions, and examines other high-risk platforms that are positioning themselves to fill Garantex’s large void.

On March 6, 2025, Garantex announced on Telegram that it would be temporarily ceasing operations after Tether blocked approximately USD 28 million in USDT from the service. The exchange also shared 89 cryptocurrency addresses they claimed were frozen by Tether.

{{blogad-garantex-takedown-blog}}

Garantex, according to TRM , has been responsible for 82% of all crypto volumes associated with sanctioned entities worldwide and 70% since it was sanctioned by OFAC in April 2022.

The exchange has played a central role in facilitating illicit financial activity, sanctions evasion, and money laundering, processing over USD 100 million in transactions tied to darknet markets and ransomware groups like Conti and Hydra Market. The exchange has also been designated by the UK and the EU, marking the EU’s first ever sanctioning of specific cryptocurrency addresses.

Garantex was a major player in sanctions evasion, with 85% of crypto inflows to sanctioned entities and jurisdictions in 2024 linked to Garantex and Iranian exchange Nobitex, reinforcing its role as a persistent financial threat in the crypto ecosystem.

Although the Garantex domain was seized, only USD 28 million in assets were frozen — raising concerns that much of its infrastructure and funds remain active. Well-resourced sanctioned entities often re-emerge under new branding, in new jurisdictions, or via successor networks. TRM’s research found that one platform in particular looks likely to be a Garantex rebrand.

In the days following its takedown, Telegram channels linked to Garantex — particularly the Garantex-adjacent Satoshkin group — began promoting a new platform, Grinex. Though first mentioned in August 2022, Grinex resurfaced only after the Garantex seizure, with Satoshkin describing it as “a new platform with familiar functionality.”

The similarities run deeper than interface aesthetics. According to Kyrgyz government records, Grinex was registered on December 23, 2024, by Duulat-eldar Sagynbeki Subankulov. Although little is known Subankulov, open-source research suggests he may be a former professional gamer — adding another layer of ambiguity to Grinex’s origins.

Telegram users quickly noted the platform’s striking resemblance to Garantex, speculating that it may be a rebrand. Fueling this speculation, Grinex announced it had entered into an agreement with Garantex to onboard its clients and was considering hiring former Garantex employees. Even more revealing, Grinex began distributing former Garantex user assets through a new token, A7A5.

The A7A5 token, which claims to be pegged 1:1 to the Russian ruble, was announced on Telegram two weeks before the Garantex takedown. It is now available on Ethereum and TRON, and listed on the obscure exchange BiFinance, reportedly based in the British Virgin Islands and founded by an individual known only as “Bob.”

According to TRM Labs’ on-chain analysis, Garantex addresses began moving funds into A7A5 as early as January 2025, suggesting premeditated efforts to create a sanctions-resistant asset. The token promises daily profit-sharing to holders and has been advertised as a way for Garantex users to recover frozen assets. During an interview with Satoshkin, Garantex executives explicitly stated that A7A5 was developed to facilitate such transfers.

TRM observed transfers of this asset in January 2025, with large volumes of transfers among Garantex addresses in the weeks leading up to the operation targeting Garantex.

Kyrgyz records show A7A5 was launched by a company called Old Vector, registered on December 13, 2024 by Tatyana Sergeevna Menshikova. Another company, Trust Corporation, was registered on the same day, at the same address — a residential building on the outskirts of Bishkek, Kyrgyzstan that has hosted numerous shell entities. This raises further concerns the opaque network behind A7A5. Some sources suggest a possible link to Russian bank Promsvyazbank’s A7 platform, designed for cross-border trade — a potential mechanism for sanctions evasion.

Beyond Grinex, other high-risk platforms may be positioning themselves to capture displaced Garantex volume. Chief among them is ABCEX, a Russian exchange tied directly to Garantex founder Sergey Mendeleev and Garantex’s third-largest on-chain counterparty.

In the days surrounding the Garantex seizure, ABCEX suffered a distributed denial of service (DDoS) attack and reported technical difficulties, while rumors of a police raid in Moscow spread across Telegram. The exchange is under investigation for facilitating transactions linked to the March 2024 Crocus City Hall terrorist attack and has a history of enabling online gambling and illicit finance.

TRM Labs has recorded many former Garantex users transitioning to Rapira — a Russia-tied high-risk exchange with exposure to sanctioned entities. TRM Labs has also observed on-chain exposure to Grinex.

TRM’s on-chain analysis showed an increase in both the volume and number of transactions for both ABCEX and Rapira in March 2025, the month Garantex was taken down. Although these figures fell for ABCEX in April, they continued to rise for Rapira. We also observed that ABCEX had similar volumes in November 2024 — though they dropped following reports of legal actions against one or more of the exchange’s high-level members.

The speed with which Garantex rebranded to Grinex highlights the evolving nature of crypto-related financial crime. Sanctioned exchanges are no longer static targets; they adapt rapidly, use decentralized tools, and attempt to obfuscate ownership and transactions through complex layering tactics, including the use of stablecoins like A7A5.

For compliance teams, the case is a reminder to go beyond list-based monitoring. TRM Labs provides tools that enable real-time tracking of risk exposure, even through indirect paths. Whether via transaction monitoring, real-time alerts, or graph-based visualizations, TRM can help institutions detect exposure to sanctioned entities — even when funds pass through new platforms or tokens like A7A5.

The seizure of Garantex — the most prolific facilitator of sanctions evasion in the crypto ecosystem — was a landmark victory in the fight against crypto-enabled sanctions evasion and financial crime. But the story is far from over.

Whether it’s darknet markets or non-compliant virtual asset service providers (VASPS) like Garantex, when one is taken down others will rise to take its place — whether via a potential rebrand like Grinex or would-be successors like Rapira and ABCEX. Whatever happens in the wake of Garantex, the global compliance and enforcement community will need to stay one step ahead — and TRM Labs will continue to provide the intelligence and infrastructure to help them do so.