The U.S. Treasury Department sanctioned cryptocurrency exchange Garantex Europe OU and its successor Grinex on Thursday, targeting platforms that have processed over $100 million in transactions linked to ransomware attacks and cybercrime since 2019.
The action also designated three Garantex executives and six associated companies across Russia and Kyrgyzstan.
“Digital assets play a crucial role in global innovation and economic development, and the United States will not tolerate abuse of this industry to support cybercrime and sanctions evasion,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence John K. Hurley.
The sanctions build on Treasury’s September 2024 actions against cryptocurrency exchange Cryptex and other platforms facilitating illicit activities.
Garantex, originally registered in Estonia before losing its license in 2022, has received millions in cryptocurrency directly from Russia-linked ransomware groups. These include the Conti, Black Basta, LockBit, NetWalker, and Phoenix Cryptolocker variants.
The exchange also provided services to actors associated with the Ryuk ransomware gang. Money launderer Ekaterina Zhdanova, previously sanctioned in November 2023, exchanged over $2 million in Bitcoin for Tether through Garantex.
The Treasury’s action followed coordinated law enforcement efforts in March 2025. The U.S. Secret Service, working with German and Finnish authorities, seized Garantex’s web domain and froze over $26 million in cryptocurrency.
The Department of Justice unsealed indictments against Garantex executives Aleksandr Mira Serda and Aleksej Besciokov. Besciokov was subsequently arrested in India.
After these disruptions, Garantex quickly pivoted. The company transferred its customer base and funds to a new exchange called Grinex, attempting to circumvent sanctions and continue operations.
Grinex’s promotional materials explicitly state the exchange formed in response to sanctions affecting Garantex. Since its creation, the platform has facilitated billions of dollars in cryptocurrency transactions.
The scheme involved using the A7A5 token, a ruble-backed digital asset. Garantex users who lost funds received equivalent compensation in A7A5 tokens through this mechanism.
The token’s issuer, Kyrgyzstani firm Old Vector, collaborated with Garantex in its creation. Russian firm A7 Limited Liability Company and its subsidiaries, owned by sanctioned Moldovan oligarch Ilan Mironovich Shor and sanctioned Russian bank Promsvyazbank, also participated.
The Treasury designated Garantex co-founder Sergey Mendeleev, co-owner and chief commercial officer Aleksandr Mira Serda, and co-owner Pavel Karavatsky. Two companies controlled by Mendeleev—InDeFi Bank and Exved—were also sanctioned for facilitating cryptocurrency-mediated trade to subvert U.S. sanctions on Russia’s financial sector.
The State Department announced reward offers of up to $5 million for information leading to Mira Serda’s arrest or conviction. An additional $1 million in rewards was offered for other key Garantex leaders.
These designations freeze all U.S. property belonging to the sanctioned entities and individuals. Americans are prohibited from conducting transactions with them, and foreign financial institutions risk sanctions for engaging with the designated parties.