Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
The Russian-Ukrainian war has been going on for almost four years. Western sanctions were intended to isolate Russia financially. Instead, they were forced to adapt.
In 2025, BeInCrypto began documenting how Russia and Russia-related entities rebuilt payment methods using cryptocurrencies. What emerged was not just a single exchange or token, but a resilient system designed to survive freezes, seizures and implementation delays.
These investigations reconstruct this system in chronological order, based on chain forensic analysis and interviews with investigators following the flows.
The first warning sign was not a crime
The first signs did not point to ransomware markets or dark web. They were referring to trade.
Sponsored
Sponsored
Authorities have begun to ask new questions about how money crosses borders for imports, how dual-use goods are paid for, and how balances are made without banks.
Meanwhile, the series data showed High activity in Russian OTC offices . Experienced exchanges that host Russian stock exchange liquidity Also an increase in the volume of operations, especially in Asia.
At the same time, I argued Telegram groups Darknet forums openly avoid sanctions. These were not hidden conversations. They described practical ways to move value across borders without banks.
The method was simple. OTC offices accept rubles locally, sometimes as cash. They issue stablecoins or digital currencies. These digital currencies settled abroad, where they could be converted into local currency.
Garantex operated a cryptocurrency laundry center in Russia
Garantex has played a crucial role in this ecosystem. It acts as a liquidity hub for OTC desks, migrations and trade-related payments.
Even after the first sanctions, it continued to interact with regulated exchanges abroad. This activity continued for months.
When enforcement action finally increased, the expectation was disruption. But what follows is preparation.
“Even people who were leaving Russia still use Garantex to move their money. If you are trying to move to places like Dubai, this has become one of the main ways to transfer money once the traditional banking routes have been cut off. For many Russians who were trying to leave the country, Garantex has become a practical way. Ledger.
The seizure led to the smuggling of spare parts
On the day the Garantex infrastructure was resumed in March 2025, the linked Ethereum wallet quickly consolidated more than 3,200 ETH. Within hours, almost the entire balance was transferred to Tornado Cash.
Sponsored
Sponsored
This step was important. Tornado Cash does not facilitate payments. This breaks the transaction history.
Days later, it started Dormant Bitcoin Reserves In motion. Wallets have not been touched since 2022 Bitcoin was integrated. This was no panic sale. This is due to treasury management under pressure.
Therefore, it was clear that assets outside the control of stablecoins were still available.
And with access to Garantix it disappearsA new service has appeared.
Grinks shot softly Started supporting USDT. The traced flows passed through TRON and connected to the infrastructure associated with Grinex. Users have reported that the credits appear again under the new name.
“This was probably the most obvious rebranding we’ve ever seen. The name was pretty much the same, the location was pretty much the same, and users who had lost access to Garantex saw their balances reappear on Grinex,” Faison told BeInCrypto.
At the end of July 2025, Garantex publicly announced payments to former users in Bitcoin and Ethereum. The chain data confirmed that the system was indeed active.
At least $25 million worth of cryptocurrency has been distributed. Much remains untouched.
Sponsored
Sponsored
The distribution structure followed a clear pattern where reserves were distributed through nuts, pool wallets, and cross-chain bridges before reaching users.
Ethereum payments are based on complexity
Ethereum payments used deliberate crypto. The money moved Tornado Cashafter the DeFi protocol, and then in several chains. Transfers traveled between Ethereum, Optimum and Arbitrum before reaching payment wallets.
Despite the complexity, only a small part of the ETH reserves reached the users. More than 88% have not changed, indicating that payments are still in their early stages.
Bitcoin payments exposed a different vulnerability
Bitcoin payments were simpler and more centralized.
Investigators identified several payment cards linked to a single collection center that received approximately 200 bitcoins (BTC). That center remained active months after the seizure.
More revealing was where the money touched next.
Issuers’ wallets interact repeatedly with deposit addresses linked to one of the world’s largest centralized trading platforms. The “Change” transaction was constantly changing.
Sponsored
Sponsored
Because Western sanctions have had difficulty maintaining
It wasn’t Western sanctions absent They were late, uneven and slow to implement.
By the time Garantix was fully decommissioned, investigators had already documented billions of dollars passing through its wallets.
Even after the sanctions were implemented, the exchange continued to interact with regulated platforms abroad, exploiting delays between classification updates, implementation and compliance.
The fundamental problem was not a lack of legal authority. It was because Speed ​​mismatch between sanctions enforcement and encryption infrastructure. While regulators work over weeks or months, cryptocurrency systems redirect liquidity within hours.
“Sanctions work on paper. The problem is the implementation. Billions can still move because the implementation of the regime is slow, fragmented, and often lags the speed at which the crypto systems adapt. The problem is not that the sanctions do not exist. It is that they are imposed too slowly for a system that moves at the speed of crypto,” said the Global Ledger CEO.
This hiatus allowed Garintics to adapt. Wallets rotated frequently. Hot wallets have changed unexpectedly. Remaining balances were moved in ways that mimic natural exchange activity, making automated compliance systems less effective.
The private sector has struggled to keep up. Banks and exchanges balance compliance obligations with transaction speed, customer attrition and operational costs.
In this setting, approved exposure may occur when activities do not raise obvious warning signs.
As of October 2025, the payment architecture was still active. Reserves remain. The roads remain open.
This was not the collapse of an exchange, but the development of a system.
Russia’s cryptocurrency strategy in 2025 showed how the sanctioned economy adapts by building parallel lines, maintaining liquidity and redirecting when blocked.
