Russian crypto exchange popular among ransomware gangs is reborn two weeks after its crackdown
Founders of the Russia-based crypto exchange Garantex appear to have launched a new one called Grinex.
Image by Cybernews.
Founders of the Russia-based crypto exchange Garantex appear to have launched a new one called Grinex.
On March 7th, the US Department of Justice (DoJ) announced that it took down the infrastructure operated by the cryptocurrency exchange Garantex.
The exchange, run by Russian nationals, was used to facilitate various crimes, including hacking, ransomware, and terrorism, and often targeted US companies.
Now, just two weeks later, the exchange has been reborn as Grinex, according to Switcherland-based blockchain analysis company Global Ledger.
Tried to cover tracks
Following the crackdown on Garantex, Tether, a company issuing stablecoins under the same name, blocked Garantex wallets holding $28 million worth of assets. The company then sent all of its stablecoins to a new address to avoid them being frozen, Global Ledger reports.
Garantex has also moved the liquidity of A7A5, its rouble-backed stablecoin, to Grinex. The founders tried to cover their tracks by manipulating supply, burning, and then reminting around 5 billion of the stablecoins.
‼️Compliance alert: #Garantex founders launch a new platform
undefined Global Ledger (@GlobalLedger) March 19, 2025
1/ Following Garantex’s shutdown and #Tether freezing its wallets, the founders have launched Grinex. Here’s what we’ve uncovered 👇 pic.twitter.com/m28einnisn
Global Ledger says that 96% of the total stablecoin supply was reminted and transferred to a new wallet.
The authors of the report also claim to have spoken to one of Grinex's managers, who said that Garantex clients were moving their funds to the new exchange.
In addition, Grinex promos say that Garantex founders created the exchange in response to sanctions and frozen funds, while the user interace of the Grinex website resembles that of Garantex.
According to Global Ledger, Garantex last year processed $14.5 billion worth of crypto.
“Garantex exposure is complex to identify. It changes patterns and uses one-time wallets, pass-through withdrawals, and other tactics to overload compliance officers,” Global Ledger claims in its report.
Officials seized servers
Meanwhile, JoD claims that since 2019, the exchange has processed at least $96 billion worth of crypto transactions.
“Garantex received hundreds of millions in criminal proceeds and was used to facilitate various crimes, including hacking, ransomware, terrorism, and drug trafficking, often with substantial impact to US victims,” JoD said in its press release.
During the exchange crackdown, JoD cooperated with Germany and Finland. Officials of the two European countries seized servers hosting Garantex’s operations, while the US obtained earlier copies of Garantex’s servers separately.
According to court documents, Garantex was controlled and operated by Russian nationals Aleksej Besciokov and Aleksandr Mira Serda between 2019 and 2025. Both of them are charged with money laundering and conspiracy.
Last year, US authorities cracked down on two crypto exchanges, PM2BTC and Cryptex, which were also operated by Russian nationals and widely used by ransomware gangs.