Listen to this Post
Introduction: A New Name, Same Old Tactics?
The U.S. government has launched a fresh wave of sanctions aimed at Grinex, a cryptocurrency exchange accused of picking up where its sanctioned predecessor Garantex left off. While Grinex publicly claims to be a legitimate trading platform, investigative reports suggest it is deeply entangled with illicit financial networks, including ransomware gangs and dark web marketplaces. This move underscores Washington’s growing determination to choke off the financial lifelines of cybercriminal organizations that exploit digital assets for laundering massive sums of illicit money.
Overview of the Events
The U.S. Department of the Treasury has officially sanctioned Grinex, branding it the successor to Garantex, which was previously penalized for laundering money for ransomware groups. In April, a TRM Labs report identified strong operational links between the two exchanges, though it stopped short of proving direct involvement in illegal transactions.
Grinex emerged almost immediately after U.S. authorities seized Garantex’s domains in March 2025, following allegations of processing over \$100 million in illicit transactions. The exchange was promoted on Telegram channels tied to Garantex’s network, suggesting a coordinated effort to keep operations alive despite the crackdown. Two Garantex administrators, Aleksandr Mira Serda and Aleksej Besciokov, were charged shortly after the domain seizures, with Besciokov arrested while vacationing in India.
Garantex’s original sanction in April 2022 came due to its deep ties to cybercrime, including connections to the Hydra dark web market, Conti Ransomware-as-a-Service, and infamous ransomware gangs such as Black Basta, LockBit, NetWalker, Ryuk, and Phoenix Cryptolocker.
According to the Treasury’s Office of Foreign Assets Control (OFAC), Garantex executives quickly set up infrastructure to transfer customer deposits to Grinex, ensuring continuity of services for its illicit clientele. Promotional materials for Grinex openly state that the exchange was formed as a direct response to the sanctions and asset freezes targeting Garantex. Since its creation, Grinex has reportedly facilitated billions of dollars in cryptocurrency transactions.
The latest sanctions not only target Grinex but also renew penalties against Garantex, its three co-founders (Sergey Mendeleev, Aleksandr Mira Serda, Pavel Karavatsky), and six partner companies in Russia and Kyrgyzstan, including InDeFi Bank, Exved, Old Vector, A7, A71, and A7 Agent.
The U.S. State Department has further sweetened the enforcement effort by offering up to \$6 million for information leading to the arrest or conviction of Garantex executives. U.S. officials argue that exploiting cryptocurrency exchanges for laundering money and facilitating ransomware attacks undermines both national security and the reputation of legitimate crypto firms.
Between April 2019 and March 2025, Garantex processed over \$96 billion in cryptocurrency transactions — a staggering figure that highlights the scale of its operations before the takedown.
What Undercode Say:
This case illustrates a classic cat-and-mouse dynamic between law enforcement agencies and illicit cryptocurrency networks. Each time a platform like Garantex is dismantled, a successor emerges to maintain business continuity for criminal clients. The speed at which Grinex appeared following the domain seizures suggests preemptive contingency planning, possibly indicating a shadow network of replacement entities ready to activate once one is shut down.
The strategic use of Telegram for promotional activities highlights how social media ecosystems are leveraged to rebuild customer trust among criminal networks. These channels function as both marketing hubs and operational coordination points, reducing the dependency on public-facing websites that can be easily seized by authorities.
OFAC’s inclusion of partner companies in its sanctions list is a notable escalation. Targeting financial infrastructure beyond the exchange itself — such as affiliated banks and intermediaries — can create logistical bottlenecks that make it harder for these platforms to liquidate or move funds. However, the effectiveness of this tactic hinges on international cooperation, as many of these entities operate in jurisdictions reluctant to enforce U.S. sanctions.
The \$6 million bounty is a psychological pressure tactic as much as it is a financial incentive. Such rewards create paranoia within illicit organizations, fostering mistrust and the potential for insider betrayals. This method has been historically effective in dismantling cartel-like operations, though it is more challenging when dealing with decentralized online actors.
The sheer scale of Garantex’s \$96 billion transaction history paints a picture of industrial-scale laundering, with ransomware merely being one of multiple illicit revenue streams. Hydra’s involvement suggests an ecosystem that blends drug trafficking, financial fraud, and cyber extortion into a single operational pipeline.
From a policy perspective, the rapid reincarnation of Garantex into Grinex raises questions about the sustainability of sanctions as a primary enforcement tool. While these measures disrupt operations, they rarely eliminate the demand for such services, and criminals are quick to innovate around legal barriers.
For legitimate cryptocurrency firms, this crackdown is a double-edged sword. On one hand, it reinforces regulatory credibility and deters bad actors from entering the market. On the other, it risks stigmatizing the broader crypto industry, especially in regions where public understanding of blockchain technology remains limited.
Going forward, the Treasury’s challenge will be to develop multi-layered enforcement strategies that combine sanctions with technological monitoring, blockchain analytics, and real-time asset freezes. Without such innovations, the cycle of takedown-and-rebirth is likely to continue indefinitely.
🔍 Fact Checker Results:
✅ Grinex has documented operational links to Garantex.
✅ OFAC sanctions against Garantex date back to April 2022.
❌ No direct public evidence yet confirms Grinex’s involvement in illicit transactions.
📊 Prediction:
Grinex will likely fragment into multiple smaller exchanges if enforcement intensifies, making future crackdowns more difficult. Expect increased use of privacy coins and decentralized finance (DeFi) to obscure transaction trails, while law enforcement agencies will expand blockchain surveillance partnerships to counter these evolving tactics.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub:
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
