Russian crypto exchange popular among ransomware gangs is reborn two weeks after its crackdown


Founders of the Russia-based crypto exchange Garantex appear to have launched a new one called Grinex.

On March 7th, the US Department of Justice (DoJ) announced that it took down the infrastructure operated by the cryptocurrency exchange Garantex.

The exchange, run by Russian nationals, was used to facilitate various crimes, including hacking, ransomware, and terrorism, and often targeted US companies.

ADVERTISEMENT

Now, just two weeks later, the exchange has been reborn as Grinex, according to Switcherland-based blockchain analysis company Global Ledger.

Tried to cover tracks

Following the crackdown on Garantex, Tether, a company issuing stablecoins under the same name, blocked Garantex wallets holding $28 million worth of assets. The company then sent all of its stablecoins to a new address to avoid them being frozen, Global Ledger reports.

Garantex has also moved the liquidity of A7A5, its rouble-backed stablecoin, to Grinex. The founders tried to cover their tracks by manipulating supply, burning, and then reminting around 5 billion of the stablecoins.

Global Ledger says that 96% of the total stablecoin supply was reminted and transferred to a new wallet.

The authors of the report also claim to have spoken to one of Grinex's managers, who said that Garantex clients were moving their funds to the new exchange.

In addition, Grinex promos say that Garantex founders created the exchange in response to sanctions and frozen funds, while the user interace of the Grinex website resembles that of Garantex.

ADVERTISEMENT

According to Global Ledger, Garantex last year processed $14.5 billion worth of crypto.

“Garantex exposure is complex to identify. It changes patterns and uses one-time wallets, pass-through withdrawals, and other tactics to overload compliance officers,” Global Ledger claims in its report.

Niamh Ancell BW Ernestas Naprys Konstancija Gasaityte profile Marcus Walsh profile
Don't miss our latest stories on Google News

Officials seized servers

Meanwhile, JoD claims that since 2019, the exchange has processed at least $96 billion worth of crypto transactions.

“Garantex received hundreds of millions in criminal proceeds and was used to facilitate various crimes, including hacking, ransomware, terrorism, and drug trafficking, often with substantial impact to US victims,” JoD said in its press release.

During the exchange crackdown, JoD cooperated with Germany and Finland. Officials of the two European countries seized servers hosting Garantex’s operations, while the US obtained earlier copies of Garantex’s servers separately.

According to court documents, Garantex was controlled and operated by Russian nationals Aleksej Besciokov and Aleksandr Mira Serda between 2019 and 2025. Both of them are charged with money laundering and conspiracy.

Last year, US authorities cracked down on two crypto exchanges, PM2BTC and Cryptex, which were also operated by Russian nationals and widely used by ransomware gangs.

ADVERTISEMENT