The war between Russia and Ukraine has lasted nearly four years. Western sanctions aimed to isolate Russia economically. However, it led to adaptation.
In 2025, BeInCrypto began to monitor how Russia and entities operating in connection with Russia rebuilt payment routes using cryptocurrency. The result was not a single exchange or token, but a flexible system designed to withstand freezes, seizures, and delays in enforcement.
The research gathers the phases of the system in chronological order based on blockchain analysis and interviews with authorities.
The first warning signs were not criminal.
The first signs did not point to ransom schemes or darknet markets. They were related to trading.
Authorities began to ponder new questions about how money was transferred across borders for imports, how dual-use goods were paid for, and how payments were settled without banks.
At the same time, blockchain data showed that the activity of Russian OTC desks increased. Exchanges with Russian OTC liquidity also saw volume growth, especially in Asia.
At the same time, discussions about circumventing sanctions were openly held in Telegram groups and darknet forums. These were not hidden discussions. They described practical means of transferring value across borders without banks.
The method was simple. OTC desks accepted rubles domestically, sometimes in cash. In return, stablecoins or crypto were provided. This crypto was then settled abroad, where it could be exchanged for local currency.
Garantex operated as a hub for washing Russian cryptocurrency.
Garantex played an important role in this ecosystem. It acted as a liquidity hub for OTC players, cash workers, and trade-related payments.
Garantex continued its connections to regulated exchanges abroad even after the sanctions came into effect. This activity continued for months.
When oversight eventually tightened, it was assumed that operations would be disrupted. In reality, however, preparations began.
“Even those who left Russia continued to use Garantex to transfer money out. If you tried to move to, for example, Dubai, this became one of the main avenues for transferring funds when traditional banking routes were closed. For many departing Russians, Garantex was a practical exit. It was one of the few ways to transfer money abroad after banks and SWIFT were shut down,” said Lex Fisun, CEO of Global Ledger.
The seizure triggered a hoarding of reserves.
On the day of the Garantex infrastructure seizure in March 2025, the associated Ethereum wallet quickly consolidated over 3,200 ETH in assets. Within hours, nearly the entire balance was transferred to the Tornado Cash service.
This transfer was significant. Tornado Cash did not allow for fund withdrawals but broke the transaction history.
A few days later, a dormant Bitcoin reserve began to move. Wallets that had not moved since 2022 consolidated BTC. This was not panic selling but cash management under pressure.
It was clear that assets outside of stablecoins were still accessible.
The follow-up appeared almost immediately.
As the use of Garantex became more difficult, a new service emerged.
Grinex opened quietly and began supporting USDT. Tracked transfers utilized the TRON network and were linked to Grinex's infrastructure. Users reported their balances appearing under a new name.
“This was probably the most obvious rebranding we have seen. The name was nearly the same, the websites almost identical, and users who lost access to Garantex found their balances again in Grinex,” Fisun told BeInCrypto.
By the end of July 2025, Garantex publicly announced it would pay former users in Bitcoin and Ethereum. Blockchain data confirmed that the system was already operational.
At least $25 million in crypto had been distributed. A large portion of the assets remained untouched.
The payment structure followed a clear pattern: funds were routed layer by layer through mixers, aggregation wallets, and cross-chain bridges before arriving at users.
Ethereum payments used intentional obfuscation. Funds flowed through Tornado Cash into DeFi protocols and further to multiple blockchains. Transfers were made between Ethereum, Optimism, and Arbitrum before ending up in payment wallets.
Despite the complexity, only a small portion of ETH reserves reached users. Over 88% remained untouched, indicating that payments were still in the early stages.
Bitcoin payments revealed another weakness.
Bitcoin payments were simpler and more centralized.
Researchers identified several payment wallets linked to one aggregation node – nearly 200 BTC was received there. This node remained active for months after the seizure.
More revealing was where the funds moved next.
Source wallets repeatedly connected to deposit addresses belonging to one of the world's largest centralized exchanges. The change from transactions consistently returned to the same place.
Why Western sanctions failed to keep up.
Western sanctions were not completely absent. However, their implementation was slow, uneven, and delayed.
By the time Garantex was fully disrupted, researchers had already documented billions of dollars moving in its wallets.
Despite the sanctions, the exchange continued operations with regulated platforms abroad, exploiting delays in definitions, enforcement, and compliance updates.
The main issue was not a lack of legal jurisdiction. The problem was the speed gap between sanctions enforcement and crypto infrastructure. Regulators operated on a timeline of weeks or months, while crypto systems could direct liquidity in hours.
“Sanctions work in theory. The problem is implementation. Billions can still move because enforcement is slow, fragmented, and often lags behind the speed at which crypto systems adapt. It's not that sanctions don't exist, but rather that they are enforced too slowly in a system that operates at crypto speed,” said the CEO of Global Ledger.
This difference allowed Garantex to adapt. Wallets changed frequently. Hot wallets changed unpredictably. Remaining funds were transferred in a way that resembled normal exchange activity, complicating the operation of automated compliance systems.
The private sector struggled to keep pace. Banks and exchanges balanced compliance, transaction speed, customer experience, and operational costs.
In such an environment, activities subject to sanctions can occur if operations do not raise clear alarms.
In October 2025, the payment system was still operational. Reserves existed. Routes remained open.
This was not an exchange collapse but a developmental step in the system.
Russia's crypto strategy in 2025 showed how a sanctions-affected economy adapts by building parallel systems, maintaining liquidity, and rerouting paths when necessary.
