From Moscow to Dubai: how blacklisted garantex evaded sanctions, funneling billions through new crypto guises
Despite global crackdowns and international sanctions, a Russian cryptocurrency network, originally blacklisted, has proven remarkably resilient, resurfacing under new names to funnel billions of dollars through sophisticated offshore networks and Telegram channels. This intricate web of financial operations has been uncovered in a recent investigation by Transparency International Russia in Exile and OCCRP.
The main part of this illegal operation is based in Moscow. It is called Garantex and is a company that lets people buy and sell cryptocurrency. In 2022, the U.S. Treasury put Garantex on a list of companies it does not accept as money. The Estonian authorities also took away its licence to do business. Despite these punitive measures, an analysis by blockchain analytics firm Chainalysis indicates Garantex processed approximately $96 billion between 2019 and 2025, with at least $1.3 billion directly linked to criminal activities. Even after the police raided its servers and websites in March 2025, new platforms popped up very quickly. The U.S. Justice Department has since announced legal action against its administrators, with Indian authorities arresting a system administrator at Washington’s request.
One prominent successor, Exved, is reportedly led by Garantex co-founder Sergey Mendeleev. Although officially registered as a domestic “payment facilitator,” Exved operates from Moscow City, offering Russian clients the ability to pay in rubles while ensuring their foreign partners receive hard currency or stablecoins abroad. Investigators, posing as traders in Hong Kong, discovered a strikingly minimal onboarding process. Transactions are discreetly routed through Paysol, a Russian-registered company acting as Exved’s “agent.”
When we spoke to Exved, we found out how the scheme works. First, rubles are put into a Russian bank account owned by a foreign company. This foreign company is often a shell company from Hong Kong. Then, the intermediary sends the same amount in U.S. dollars, yuan, or Tether (USDT) to the supplier in another country. It’s important to note that contracts often don’t mention cryptocurrency. One agent openly admitted, “No bank will know. It is only visible between us.” This structure cleverly makes it look like the money is in Russia’s banking system before it’s moved abroad. Exved charges a $300 fee for transfers over $50,000. Investigations showed that Russian banks like T-Bank and Expobank were being used to make payments in rubles. Other big foreign banks like J.P. Morgan, Deutsche Bank, and Bank of China in Hong Kong were also mentioned.
It is very worrying that investigators think Exved’s network has helped people to buy goods that can be used for both peaceful and military purposes, including microprocessors and telecommunications equipment, from China and Taiwan. Paysol’s legal team even admitted that their clients often deal in restricted items and that invoices can be changed to avoid being checked by customs. Blockchain analysis confirmed these findings, showing wallets linked to Exved and Paysol were connected to sanctioned Garantex addresses. One wallet processed over $563 million, including a $234,000 transfer from Garantex Europe in December 2024, followed by a $2.6 million transfer to Paysol just weeks later. Some of the money was even seen going back to Garantex, a common way of hiding the source of illegal money.
The network’s adaptability didn’t stop there. MKAN Coin emerged in Dubai, alongside operations in Kyrgyzstan, Brazil, Spain, and Thailand, providing crypto-to-cash services for Russians primarily via Telegram. This venture was reportedly managed by former Garantex executive Mohammad Khalifa. Although Dubai regulators shut down MKAN in 2024, Kyrgyz authorities subsequently blacklisted affiliated entities for money laundering.
Following MKAN’s demise, a new exchange named Grinex appeared in 2025. Analysts from TRM Labs and Global Ledger identified strong infrastructural ties to Garantex, including shared wallets and bots. Grinex notably launched a ruble-pegged stablecoin, A7A5, purportedly backed by accounts at Promsvyazbank, a sanctioned state-controlled bank. Within just four months, A7A5 processed a staggering $9.3 billion.
The international response has been swift. In August 2025, the U.S. Treasury expanded its sanctions to include Exved, Grinex, and InDeFi Bank, alongside executives Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky. Days later, the U.K. announced its own measures, specifically targeting the A7A5 token.
The investigation also revealed the key people behind these networks. Sergey Kunitsa, the head of Paysol, used to work for a customs brokerage firm. Aleksandr Mira Serda, also known as Ntifo-Siao, is still active despite the U.S. having filed charges against him. Public records show that he bought a $3 million villa in Dubai and got a new Russian birth certificate that falsely listed a dead Spanish citizen as his father.
During this whole situation, the people investigating decided that Telegram is still the main way of communicating. From setting up a client account to agreeing contracts, we use private chats and automated bots to manage every interaction. “Telegram has become the central operating layer,” their report states.
Despite sanctions, raids, and international pressure, the report paints a picture of a constantly adapting network. It describes this illicit operation as a “crypto laundromat”: decentralized, opaque, and remarkably resilient. Instead of relying on traditional centralized exchanges, the system now thrives on a complex web of offshore intermediaries, encrypted communication channels, and, in some cases, state tolerance.
