Grinex, a cryptocurrency exchange considered the successor to the sanctioned Russian platform Garantex, has reportedly transferred over $16.6 billion in cryptocurrency through the exchange, despite warnings from blockchain analysis firm Global Ledger.
The infrastructure of Garantex was dismantled in March by authorities in the United States, Germany, and Finland, and it has since been reported that its operations have shifted to Grinex.
Global Ledger initially informed Cointelegraph that as of early May, various cryptocurrency exchanges had approximately $1 billion in exposure to Grinex.
However, Swiss blockchain data experts indicated that the flow of funds has not stopped. By May 30, researchers had raised their estimates due to the inflow and outflow of funds related to Grinex.
"You can see that the [amount is] devastating [and] it is growing every day," Yury Serov, head of investigative research at Global Ledger, told Cointelegraph.
According to compliance company Bitrace, $649 billion in stablecoins are expected to flow to high-risk addresses in 2024. The company stated that over 70% of potential illegal stablecoin transactions are conducted through Tether (USDT) on the Tron network.
The observed outflow of funds from Grinex is also in USDT based on Tron. As of the time of writing, Global Ledger has recorded $2.41 billion in exposure from crypto services and wallet transactions. Of this, $1.66 billion is flowing between 180 cryptocurrency exchanges (also known as virtual asset service providers, VASPs).
"Assuming one VASP sends funds and another VASP receives them. According to the travel rule recommendations, the receiving VASP must obtain key details, such as the name of the sending VASP and other relevant identification information," Serov said.
Global Ledger declined to disclose the names of exchanges exposed to Grinex transfers but stated that it has notified some of these exchanges about its analysis of suspicious fund flows.
"We received some feedback indicating they have confirmed the information we provided," Serov said, adding that some of their communication attempts went unanswered.
Cointelegraph independently contacted six major global crypto companies to inquire whether they had received or detected fund flows from Grinex.
Among the contacted exchanges, only Binance responded, stating that it monitors and blocks direct and indirect exposure to sanctioned individuals and entities.
"While we cannot prevent deposits, we take action against customers. We also block users from sending funds to addresses related to sanctions," a spokesperson for the exchange said.
Many of the transactions identified by Global Ledger are direct interactions, meaning that no intermediary addresses or obfuscation techniques were used to transfer funds from Grinex to exposed exchanges.
Cointelegraph attempted to contact Grinex but did not receive a response by the time of publication.
In March, U.S. and European authorities announced a coordinated international action to dismantle Garantex's services. As part of the crackdown, Tether froze $27 million in stablecoins that were held at the sanctioned Russian exchange.
U.S. law enforcement stated that it had seized domain names associated with Garantex, while German and Finnish authorities confiscated servers hosting the exchange's infrastructure. U.S. officials also indicated that they had obtained early server copies containing customer and accounting data. Garantex has reportedly processed approximately $96 billion in crypto transactions since April 2019.
Days later, the Central Bureau of Investigation in India arrested Aleksej Bešciokov, who was accused of operating Garantex under U.S. money laundering charges.
According to on-chain and off-chain data analyzed by Global Ledger, Garantex has since reportedly re-emerged in the form of Grinex. The company reported that Garantex transferred over $60 million in ruble-backed stablecoins to Grinex, referring to it as the "complete successor" to the exchange.
Global Ledger added that a manager from Grinex claimed that clients had visited Garantex's office in person and actively transferred funds from Garantex to Grinex.
Garantex was sanctioned by the U.S. Treasury in 2022 and by the European Union in February 2025.
In the early stages of blockchain technology, cryptocurrencies provided a convenient means for cybercriminals to transfer funds due to their decentralized and largely unregulated nature.
Today, this asset class has matured, attracting increasing attention from institutions and even nations. This shift has accelerated regulatory discussions and driven the development of advanced security tools to track illegal transactions. Several countries have now established dedicated crypto units.
Despite these advancements, significant blind spots remain, allowing illegal actors to continue exploiting regulatory arbitrage.
For example, some USDT traffic from Grinex has been associated with licensed cryptocurrency exchanges targeting Europe. In the EU, exchanges have begun delisting USDT trading pairs to comply with the bloc's Markets in Crypto-Assets (MiCA) regulatory framework, which imposes strict requirements on stablecoin issuers.
"These entities are indeed licensed in Europe, but they are also actively operating in countries outside the EU, which have become major destinations for Russian immigrants after the war," Serov said. "Our assumption is that many people still legally reside there, holding documents that allow them to interact with euro-facing VASPs."
Despite the recent shutdown of sanctioned platforms and illegal crypto operations, Alex Katz, CEO of security firm Kerberus, warned in a previous interview with Cointelegraph that these entities often rename themselves and continue to operate under new names.
Recently, eXch, a no-KYC cryptocurrency exchange, was dismantled by German authorities, who seized $38 million and related infrastructure. However, security monitors reported that fund flows involving the related wallets continue, indicating that the platform may still be secretly serving key clients.
Original article: “Global Ledger: Garantex Successor Moves $1.66B to Crypto Exchanges”
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
