The U.S. Treasury doubles sanctions on the crypto assets exchange Garantex.

The U.S. Treasury's pursuit of Garantex's founder and their new exchange Grinex indicates that the initial sanctions only forced criminals to reshape their $100 million illegal financial network, rather than abandon it.

The U.S. Treasury has intensified its crackdown on illegal cryptocurrency activities, re-designating the cryptocurrency exchange Garantex Europe OU associated with Russia and sanctioning its successor platform Grinex. For years, Garantex has been accused of handling over $100 million in transactions related to ransomware groups, dark web markets, and other cybercriminal activities.

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) is taking action against Garantex leaders to combat cryptocurrency crime.

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has imposed sanctions on three executives of the cryptocurrency exchange Garantex and its six affiliates in Russia and Kyrgyzstan. These measures, announced by OFAC's cyber division on Thursday, accuse the platform of playing a significant role in laundering digital assets for cybercriminals.

Officials from the Ministry of Finance stated that although Garantex was sanctioned in April 2022 for operating in the Russian financial services sector, the company continues to provide services to ransomware operators.

John H. Hurley, the Deputy Secretary of Terrorism and Financial Intelligence in the United States, stated: "Using cryptocurrency exchanges for money laundering and ransomware attacks not only threatens our national security but also undermines the reputation of legitimate virtual asset service providers."

Authorities stated that the exchange is responsible for handling transactions related to the groups behind Conti, LockBit, and Black Basta ransomware, as well as the sanctioned money launderer Ekaterina Zhdanova.

This new operation was carried out after a joint action by the U.S. Secret Service with authorities in Germany and Finland on March 6, which seized the network domain of Garantex, froze $26 million worth of cryptocurrency, and dismantled its infrastructure.

The U.S. Department of Justice also released an indictment against executives Aleksandr Mira Serda ( and Aleksej Bešciokov ), charging them with conspiracy to commit money laundering, operating an unlicensed money transfer business, and violating U.S. sanctions.

Beshchokov was arrested while vacationing with his family in Kerala, India. Russian citizen, Garantex co-owner Mira Serda (Mira Serda) is still at large.

The prosecutor alleges that Garantex transferred wallets to evade investigation and provided misleading data to conceal account ownership, even in cases where Russian law enforcement sought information. If convicted, the two individuals could face up to 20 years in prison for money laundering, up to 20 years in prison for violation of sanctions, and 5 years in prison for operating without a license.

In addition, the U.S. State Department has announced two rewards under the Transnational Organized Crime Rewards Program, offering up to $5 million for information leading to the arrest and/or conviction of Mira Selda, and up to $1 million for information on other key leaders of Garantex.

The U.S. Treasury Department claims Garantex transferred funds to Grinex to evade sanctions.

U.S. Treasury officials stated that after the seizure actions in March, Garantex transferred its customer funds to the newly established exchange Grinex, attempting to circumvent sanctions. Grinex's promotional materials openly claim that its establishment is to respond to freezes and restrictions. Since its establishment, Grinex has processed billions of dollars in cryptocurrency transactions.

Investigators also found that Garantex and Grinex used the ruble-backed digital token A7A5 to return funds to Russian clients whose assets were frozen.

The token is linked to the Russian company A7 and its subsidiaries, which, according to U.S. officials, are controlled by sanctioned individuals, including Moldovan oligarch Ilan Shor and the Russian bank Promsvyazbank.

OFAC has now imposed sanctions on Grinex, A7, its subsidiaries, and Old Vector for assisting Garantex in evading sanctions.

Officials from the Ministry of Finance stated that the leadership of Garantex is key to the illegal operation of the exchange. It is alleged that co-founder Sergey Mendeleev (, co-owner Mira Serda ), and regional director Pavel Karavatsky ( procure infrastructure, register trademarks, and participate in business expansion to maintain its legitimacy.

Additionally, two other companies, InDeFi Bank and Exved, have also been sanctioned. Both companies are controlled by Mendeleev and are accused of facilitating cross-border cryptocurrency transactions that circumvent U.S. restrictions.

The new sanctions mean that all named individuals and entities have their property and property interests frozen within U.S. jurisdiction. Without authorization, U.S. citizens are generally prohibited from engaging in any transactions with them.

Financial institutions that continue to conduct business with sanctioned parties face the risk of enforcement actions.

The U.S. Treasury emphasized that sanctions are intended to change behavior, not merely to punish. OFAC has procedures in place to remove individuals who demonstrate compliance with U.S. law from the Specially Designated Nationals )SDN( list.

Garantex takes action after Biden Cash )BidenCash( and BlackSuit ransomware were banned.

The Garantex case is one of a series of actions recently taken by the United States against cybercrime infrastructure. On June 5, law enforcement seized cryptocurrency related to BidenCash. BidenCash is a dark web marketplace accused of selling over 15 million stolen credit cards and personal data.

This international operation involves the United States, the Netherlands, and other agencies, shutting down about 145 domains associated with the website.

The police also dismantled the BlackSuit ransomware group, seizing over $1 million in digital assets associated with the malware. BlackSuit is accused of targeting critical infrastructure sectors in the U.S. and abroad.

U.S. authorities have repeatedly emphasized the increasing connection between ransomware, the use of illicit cryptocurrencies, and state-related actors.

The United Nations estimates that North Korea's Lazarus Group has stolen over $3 billion in digital assets worldwide, most of which is used to fund weapons programs.