The war between Russia and Ukraine has been ongoing for almost 4 years now. At the same time, the sanctions from Western countries aim to cut Russia off from the global financial system. However, these measures have instead forced Russia to adapt.
In 2025, BeInCrypto began recording data on how Russia and groups linked to Russia are creating new payment paths through crypto. What is happening is not just a single exchange or a single token but a robust system designed to withstand freezing, asset seizures, and delays in law enforcement.
This investigation has chronologically woven such systems based on blockchain transaction analysis and interviews with investigators tracking these financial flows.
The first warning signs are not of crime.
Early signals do not point to ransomware or dark web markets but instead target trading.
Regulatory bodies are beginning to question how money crosses borders for imports, how two-way goods are paid for, and debts incurred without going through banks.
Meanwhile, on-chain transaction data shows that Russian OTC desks have seen increased activity. Additionally, the crypto market serving Russian OTC has also seen a surge in trading volume, particularly in Asia.
Meanwhile, Telegram groups and forums on the dark web are openly discussing ways to evade sanctions, and these conversations are not secret. They describe practical methods for transferring value across borders without going through banks.
This method is very straightforward: the OTC desk receives rubles domestically, sometimes in cash, then issues stablecoins or crypto, which is then used to pay abroad and can be immediately converted into local currency.
Garantex operates Russia's crypto money laundering center.
Garantex plays a crucial role in this ecosystem as it serves as a liquidity hub for OTC desks, migrants, and payment channels linked to trading.
Even under initial sanctions, it continues to operate with licensed exchanges abroad, and these activities have persisted for many months.
But as the enforcement of legal measures intensifies, many parties are waiting for turmoil to occur; however, what actually happens is preparedness.
Even those who have left Russia continue to use Garantex to transfer money out. If you attempt to relocate to places like Dubai, this has become the primary solution for transferring money when traditional banking options are closed. Among many Russians trying to leave the country, Garantex thus serves as a viable solution and one of the few ways to move money out of the country after banks and SWIFT are no longer available,” Lex Fisun, CEO of Global Ledger, stated.
Seizure events have led to a scramble for reserves.
On the day Garantex's infrastructure was seized in March 2025, the linked Ethereum wallet quickly amassed over 3,200 ETH. Within hours, almost all of the balance was transferred to Tornado Cash.
The transfer is significant. Tornado Cash does not facilitate withdrawals, but it makes transaction history untraceable.
A few days later, unused Bitcoin reserves began to move. Wallets that had not been touched since 2022 held all BTC. This was not a panic sell-off but a management of reserves under pressure.
As a result, it is clear that assets outside of stablecoin control remain accessible.
The successor appeared almost immediately.
As access to Garantex has been increasingly blocked, new services have emerged.
Grinex launched quietly and began supporting USDT. The flow of funds is tracked through TRON and linked to Grinex's infrastructure. Many users have reported that their balances reappeared under this new name.
It is likely the most obvious rebranding we have ever seen. The name is almost the same, the website is similar, and users who had lost access to Garantex are seeing their funds return in Grinex,” Fisun said in an interview with BeInCrypto.
At the end of July 2025, Garantex publicly announced payments to old users in Bitcoin and Ethereum, and on-chain data confirmed that the system had started operating.
At least over 25 million USD in crypto has been distributed, and there is still much money that remains untouched.
The payment structure follows a clear pattern, with layers of reserves divided through mixers, aggregated wallets, and cross-chain bridges before reaching users.
Ethereum payments deliberately use obfuscation methods, where funds move through Tornado Cash, then into DeFi protocols, and spread across multiple chains. Transfers are relayed between Ethereum, Optimism, and Arbitrum before being deposited into payment wallets.
Even though the process is complex, only a small portion of the ETH reserves have reached users, while over 88% remains unspent, indicating that payouts are still in the early stages.
Bitcoin payments reveal another vulnerability.
Payment through Bitcoin is simpler and more centralized.
Investigators have identified several payment wallets linked to a single hub that received nearly 200 BTC, with that hub continuing to operate for months after being seized.
But the more interesting point is where that money is being sent next.
The source wallet has repeated transactions with a deposit address linked to one of the world's largest centralized exchange platforms, with 'change' from transactions often continuously returning there.
Why are Western sanctions lagging?
Western sanctions have not disappeared, they have just come late and are not comprehensive in their application.
When Garantex was fully obstructed, officials had already documented the movement of billions of USD through its wallets.
Despite the sanctions being imposed, exchange platforms continue to interact with regulated platforms abroad, taking advantage of delays between the stages of setting, enforcing, and updating compliance.
The main issue is not the legal powers but the differing speeds between enforcing sanctions and the crypto infrastructure. While regulators may take weeks or months, crypto systems can move liquidity within hours.
Sanctions are theoretically effective, but the problem lies in practice. There are still billions of USD that can be moved due to enforcement lagging and being scattered, often failing to keep pace with changes in the crypto system. In fact, it is not that there are no sanctions, but because enforcement is slower than the rapidly developing crypto systems, the CEO of Global Ledger stated.
This very gap is what allows Garantex to continuously adapt. They frequently rotate wallets, and hot wallets change unpredictably, while the remaining balances are moved in ways that mimic the normal activities of exchange markets, causing the compliance system to become less efficient.
The private sector itself is also struggling to cope, as banks and exchanges try to balance legal obligations with transaction speed, customer inconvenience, and operational costs.
In such an environment, touching sanctions can happen if such activities do not show clear signs of irregularity.
As of October 2025, the infrastructure for payments continues to operate, with reserves still remaining and pathways still open for transactions.
This is not the collapse of the exchange market, but rather the evolution of a system.
Russia's crypto strategy in 2025 shows that a sanctioned economy can adapt by creating parallel systems, maintaining liquidity, and rerouting when intercepted.
