# Treasury redesignates Garantex and its Grinex successor as the laundromat collapses
> OFAC names three executives and a Kyrgyz-Russian shell network; Grinex then halts, blaming a 'Western special services' hack

**Meta:** type: story · date: 2026-04-16 · heads: Whose Money, The Quiet Shift · 10 takes · 4 lenses · 4 regions

## Summary

On 16 April 2026 the [Russia](/ja/entity/russia)-linked exchange Grinex suspended operations,
claiming over 1bn rubles in user funds were stolen and blaming "special services" of
"unfriendly states." The collapse followed a US Treasury OFAC move
redesignating [Garantex](/ja/entity/crypto-laundering), which processed over $100m in illicit
transactions since 2019, laundering for the Conti [Ransomware](/ja/entity/ransomware) syndicate and the Hydra
darknet market, and designating its Grinex successor, three executives and six shell
companies in Russia and Kyrgyzstan. Investigators say Garantex officers moved customer
deposits to Grinex within days of the March 2025 seizure, kept liquid by the ruble-pegged
A7A5 token. The pattern, designate, rebrand, resume, is the core challenge.

## By the numbers

- $100m+, illicit transactions processed by Garantex since 2019 (Treasury).
- 1bn+, rubles Grinex claimed were stolen in the alleged hack.
- 3, Garantex executives newly designated, plus 6 Russian/Kyrgyz shell firms.
- Mar 2025, when Garantex deposits first migrated to the Grinex successor.

## Why it matters

Garantex was a load-bearing off-ramp for [Russian](/ja/entity/russia) ransomware and
sanctions-evasion crypto. Killing the successor too, if the halt is genuine and not an
exit scam, removes a major laundering venue, but the A7A5/rebrand playbook shows how
quickly the next one stands up.

## What to watch

- Whether a new successor exchange appears, or A7A5 migrates elsewhere.
- On-chain tracing of the "stolen" Grinex funds (hack vs exit scam).
- Knock-on liquidity strain for ransomware affiliates after [Endgame](/ja/n/operation-endgame-stealc-amadey-2026).

## Regional takes (batched by bias / lens)

### unlabelled
- **U.S. Department of the Treasury (OFAC)** (United States, en) — Treasury sanctions on the cryptocurrency exchange and network enabling sanctions evasion and cybercriminals, redesignating Garantex and naming its Grinex successor plus executives and Russian/Kyrgyz shell companies.
  Source: https://home.treasury.gov/news/press-releases/sb0225
- **Chainalysis** (United States, en) — 
  Source: https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/
- **ainvest** (United States, en) — 
  Source: https://www.ainvest.com/news/treasury-redesignates-garantex-sanctions-evasion-illicit-crypto-activity-2508/
- **CyberSecureFox** (Global, en) — 
  Source: https://cybersecurefox.com/en/us-treasury-sanctions-grinex-crypto-exchange-garantex-successor/
- **Lewis Baach Kaufmann Middlemiss** (United States, en) — 
  Source: https://www.lbkmlaw.com/news-events-ofac-sanctions-cryptocurrency-exchange-garantex.html
- **Transparency International Russia (Crypto Laundromat)** (Russia, en) — 
  Source: https://cryptolaundromat.ti-russia.org/
- **U.S. Department of Justice** (United States, en) — 
  Source: https://www.justice.gov/opa/pr/justice-department-announces-seizure-over-28-million-cryptocurrency-cash-and-other-assets

### blockchain-forensics
- **Elliptic** (United Kingdom, en) — Reports Grinex suspending operations after claiming over 1bn rubles in user funds were stolen, which it blamed on 'special services' of 'unfriendly states', and weighs whether the halt is genuine or an exit scam.
  > "Grinex halted operations, blaming a hack by the 'special services' of 'unfriendly states.'"
  Source: https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack

### blockchain-intelligence
- **TRM Labs** (United States, en) — Dissects the Garantex-Grinex-A7A5 token pipeline, showing how the ruble-backed stablecoin let the network keep clearing sanctioned value and how the successor inherited Garantex's customer deposits within days of the March 2025 seizure.
  > "Garantex's deposits flowed into Grinex within days, kept liquid by the ruble-pegged A7A5 token."
  Source: https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks

### investigative consortium
- **ICIJ** (United States, en) — Documents how Garantex kept operating long after its 2022 designation by rebranding and shifting infrastructure, a pattern the 2026 redesignation of its successor was meant to break.
  > "Garantex lived on despite sanctions, rebranding and moving infrastructure to keep clearing funds."
  Source: https://www.icij.org/news/2025/09/cryptocurrency-exchange-garantex-lives-on-despite-sanctions-new-report-unveils/

## Across the graph
- Related: [[operation-endgame-stealc-amadey-2026]], [[north-korea-crypto-theft-it-workers-2026]], [[russia-oil-revenue-squeeze-2026]], [[eu-russia-21st-sanctions-package-2026]]
- Entities: Crypto Laundering, Ransomware, Russia, United States

---
Canonical: https://rbtfl.xyz/ja/n/garantex-grinex-crypto-sanctions-2026