The Russia-Ukraine war has been ongoing for nearly 4 years now. The purpose of the Western sanctions was to financially isolate Russia. However, it has led to results that force adaptation.
In 2025, BeInCrypto began documenting the process of Russia and Russian-related entities rebuilding payment channels through cryptocurrency. What emerged was not a single exchange or token, but a robust system designed to withstand freezing, seizure, and execution delays.
This investigation reconstructs the system chronologically based on on-chain forensic analysis and interviews with investigators tracking liquidity flows.
The first warning signal, not a crime
The early signals did not point to ransomware or darknet markets. Trade was at the center.
Authorities raised new questions about how funds for imports crossed borders, how dual-use items were paid for, and how settlements occurred without banks.
At the same time, on-chain data showed active trading at Russian OTC desks. Exchanges with Russian OTC liquidity, especially in Asia, saw a surge in trading volume.
Meanwhile, Telegram groups and darknet forums openly discussed sanctions evasion. These were not secretive conversations. Practical methods for moving assets across borders without banks were shared.
The method was simple. OTC desks received rubles domestically, sometimes in cash. They then issued stablecoins or cryptocurrencies. These cryptocurrencies were settled abroad and could be converted into local currency.
Garantex, operating as a Russian cryptocurrency laundering hub
Garantex played a key role in this ecosystem. It functioned as a liquidity hub for OTC desks, migrant workers, and trade-related payments.
Even after the initial sanctions, Garantex continued to trade with regulated exchanges abroad. This activity persisted for several months.
When sanctions enforcement was finally strengthened, chaos was expected. In reality, thorough preparations followed.
"Even people leaving Russia still used Garantex to transfer funds abroad. When trying to relocate to places like Dubai, this became the primary means of transferring money after traditional banking routes were blocked. For many Russians, Garantex became a practical exit channel. After banks and SWIFT became unavailable, it was one of the few ways to move money abroad." – Lex Pisun, CEO of Global Ledger
Seizures triggered a competition for securing reserves
In March 2025, the day Garantex's infrastructure was seized, linked Ethereum wallets quickly liquidated over 3,200 ETH. Within hours, nearly all balances moved to Tornado Cash.
This measure was critically important. Tornado Cash does not have a direct payment function but separates transaction histories.
Days later, long-dormant Bitcoin reserves began to move. Wallets that had not been touched since 2022 liquidated BTC. This was not panic selling, but asset management under pressure.
That is, it became clear that assets outside stablecoin control were still accessible.
Successor, appearing immediately
As access to Garantex gradually weakened, new services emerged.
Grinex quietly launched and began supporting USDT. The tracked liquidity was routed through TRON to Grinex's associated infrastructure. Users reported that their balances reappeared under the new name.
"Perhaps the most obvious rebranding to date. The name was almost the same, and the website was nearly identical. Users who lost access to Garantex confirmed that their balances reappeared at Grinex." – Pisun, revealed to BeInCrypto.
By the end of July 2025, Garantex officially announced payments to all users in Bitcoin and Ethereum. On-chain data had already confirmed that the system was operational.
At least $25 million worth of cryptocurrency was distributed. More assets remained.
The payment structure exhibited distinct patterns. Reserves were delivered to users after passing through mixers, aggregation wallets, and cross-chain bridges.
Ethereum payments intentionally concealed traces. Funds moved through Tornado Cash before reaching DeFi protocols and multiple blockchains. Transactions traversed Ethereum, Optimism, and Arbitrum before arriving at the payment wallet.
Despite the complexity, the actual ETH reserves delivered to real users were only a fraction. More than 88% remained unused, indicating that the payments were still in the early stages.
Bitcoin payments... another weakness revealed
The Bitcoin payment process was simpler and more centralized.
Investigators identified several payment wallets linked to a single aggregation hub. That hub received about 200 bitcoins and remained active for several months after the seizure.
The more important point was the subsequent movement of funds.
Original wallets repeatedly interacted with deposit addresses of one of the world's largest centralized exchanges. The “change” from transactions was consistently returned to that exchange.
Western sanctions, reasons for lack of effectiveness
Western sanctions also existed. However, these sanctions were late, unevenly applied, and had a very slow execution speed.
By the time Garantex was completely halted, investigators had already confirmed that billions of dollars had moved through that wallet.
Even after sanctions were applied, the exchange continued to trade with foreign regulated platforms, exploiting the time lag between designation, enforcement, and regulatory updates.
The core issue was not a lack of legal authority. The disparity in the speed of sanctions enforcement and cryptocurrency infrastructure was fundamental.
"Sanctions are effective on paper. The problem is enforcement. Enforcement is slow, fragmented, and lags behind the speed of the cryptocurrency system, allowing billions of dollars to still move. It’s not that there are no sanctions, but they are not applied in line with the speed of cryptocurrency." – Global Ledger CEO
Such gaps allowed Garantex's adaptation. Wallets frequently cycled, and hot wallets changed unpredictably. Residual funds moved similarly to regular transactions, reducing the efficiency of automated compliance systems.
The private sector struggled to respond. Banks and exchanges had to balance compliance obligations with transaction speed, customer inconvenience, and operational costs.
In this environment, sanctioned transactions can exit the system without clear warning signals.
By October 2025, the payment infrastructure was still operational. Reserves remained, and payment routes were still maintained.
This was not the collapse of the exchange, but the evolution of the system.
Russia's cryptocurrency strategy in 2025 demonstrated how a sanctioned economy built parallel structures, preserved liquidity, and adapted by creating new routes when blocked.
