How Garantex helped create a shadow crypto network for sanctions evasion
The United Kingdom has imposed sanctions on a range of crypto exchanges, banks, and companies that authorities believe helped facilitate transactions supporting the Russian economy. The investigation reveals how, within months of the collapse of one major platform, a new network of financial routes emerged to take its place.
01.06.2026
81
12 min
0
The Russian crypto market has adopted a new strategy: instead of relying on a few dominant players, it is now serviced by a large number of smaller exchanges and financial platforms. This fragmentation accelerated after the sanctioned crypto exchange Garantex was dismantled in March 2025. GetBlock AML Research examines the structure of the A7 network and the key entities involved.
Key Findings
- On May 26, 2026, the United Kingdom sanctioned 18 companies and individuals, including Huobi Global, Exmo, Bitpapa, Rapira, and Aifory Pro. The measures were imposed under the Russia (Sanctions) Regulations 2019. According to UK authorities, these entities are part of the A7 financial and cryptocurrency infrastructure network, which has allegedly been used to support Russia’s wartime economy.
- Blockchain analysis shows that since 2021, more than $4.9 billion has been transferred through Huobi to entities sanctioned by the UK, as well as participants in the A7 network. Approximately $1.13 billion of that volume moved after the shutdown of Garantex in March 2025.
- Following Garantex’s closure, transfers from Huobi to exchanges and services that effectively replaced it—including Rapira, Aifory Pro, Grinex.io, ABCex, A7, and A7A5—increased more than tenfold, rising from $111 million to $1.13 billion. The A7 network alone accounted for $838 million, representing nearly a 193-fold increase.
- Bitpapa has now become subject to sanctions under its third national sanctions regime. The platform was previously sanctioned by the United States in March 2024 and by Ukraine in July 2025. The UK's latest action highlights growing international coordination targeting similar platforms.
- Financial crime and compliance professionals are increasingly focusing not only on sanctioned entities themselves but also on the companies that emerge to replace them and continue providing similar services.
What Happened
On May 26, 2026, the UK Foreign, Commonwealth & Development Office announced sanctions against 18 organizations and individuals. The list includes cryptocurrency exchanges such as Huobi Global (HTX), Exmo Exchange, Bitpapa, and Rapira Group, along with other entities that UK authorities say were used to facilitate financial transactions connected to Russia.
The measures target crypto exchanges, banks, and corporate structures that allegedly helped move funds through digital assets and sustain economic activity under sanctions. Many of the sanctioned entities are linked to an ecosystem that emerged after Garantex ceased operations in March 2025. This ecosystem includes major exchanges, ruble-to-crypto conversion services, and the broader A7 infrastructure, consisting of companies and digital asset issuers.
Which platforms help Russia evade sanctions: a complete list
We examine cryptocurrency platforms used for cross-border settlements that bypass sanctions. The report is based on blockchain analytics and reveals specific connections, transaction volumes, and operational infrastructure.
According to blockchain analysis, more than $4.9 billion has been transferred through Huobi since 2021 to entities now sanctioned by the UK, their predecessors, and other high-risk platforms. In the 14 months following Garantex’s shutdown alone, approximately $1.2 billion was transferred, with $838 million flowing directly to the A7 network.
Why UK Authorities Focused on the A7 Network
The sanctions were imposed under the Russia (Sanctions) Regulations 2019. Official statements place particular emphasis on the A7 network, which UK authorities describe as a Kremlin-backed financial infrastructure.
According to estimates from the UK government, more than $90 billion passed through the network over the previous year. For comparison, that figure is roughly equivalent to half of Russia’s annual military budget.
The sanctions target crypto exchanges, a Kyrgyz bank, Georgia-registered trading platforms, corporate entities, and a digital asset issuer. Any assets held under UK jurisdiction by these organizations are subject to asset freezes, and UK-regulated businesses are prohibited from providing them with funds or economic resources.
UK officials stated that any expectation that sanctions can be bypassed through cryptocurrency networks or shadow financial systems is misguided.
The sanctioned entities include:
- Exmo Exchange Limited
- Nueva Cryptologia (ABCex)
- Arvira LLC
- Rapira Group LLC
- Alistera Limited
- Eurasian Savings Bank OJSC
- Bitpapa IC FZC LLC
- Sooty Limited
- Aifory LLC
- State Brokerage Company OJSC
- Diamond Estate LLC
- Trace Road LLC
- Virtual Asset Issuer OJSC
- Huobi Global S.A.
Key Participants in the Network
The A7 network encompasses a broad range of liquid services, including one of the world's largest cryptocurrency exchanges, Huobi Global.
Why Bybit is blocking Russian users: causes and the role of compliance
As Bybit returns to Western markets, users are facing unexpected restrictions. We uncover the hidden processes inside the exchange’s compliance system
Huobi Global
Since 2021, more than $4.9 billion has been transferred through Huobi to entities sanctioned by the UK and other Russian-linked platforms. Approximately $1.95 billion was sent to Garantex in 2022 and another $1.18 billion in 2023. In 2025 alone, transfers to the A7 network reached $838 million.
Asset outflows from Huobi Global (HTX) to Russian exchanges and services, 2021–2026. Source: TRM Labs
The sanctions affect a major international exchange with substantial activity across multiple jurisdictions. Any transactions involving the platform that fall under UK jurisdiction are now prohibited.
Exmo Exchange Limited
Founded by entrepreneurs from Russia, Exmo announced in 2022 that it had exited the Russian market and sold its Russian operations to a new entity operating under the Exmo.me brand.
However, blockchain analysis indicates that both platforms continued using shared wallet infrastructure to hold customer funds. This suggests that the formal business separation may not have reflected a complete operational separation.
Direct transaction volume between Exmo and sanctioned entities—including Garantex, Grinex, and Chatex—exceeded $19.5 million. In July 2025, Ukraine also imposed sanctions on a Kazakhstan-registered Exmo entity.
Shared wallet infrastructure used by Exmo. Source: TRM Labs
Bitpapa
Bitpapa is a UAE-registered P2P platform that allows users to buy and sell cryptocurrency directly with one another.
In March 2024, the U.S. Treasury sanctioned Bitpapa for facilitating multimillion-dollar transactions involving already sanctioned entities, including Hydra Market and Garantex. Ukraine later imposed similar restrictions.
Following the UK's action, Bitpapa is now sanctioned by three separate jurisdictions, significantly expanding international oversight of the platform.
Rapira Group
Rapira is registered in Georgia but maintains an office in Moscow and specializes in ruble-to-crypto exchange services.
Its total transaction volume with entities linked to Russia’s sanctions-related ecosystem exceeded $543 million. Its largest counterparty was Grinex.io, which many observers view as one of Garantex’s successors.
Transactions between Rapira and Grinex totaled $375.6 million. Notably, these transfers began on March 10, 2025—just three days after Garantex ceased operations.
Aifory Pro
Aifory Pro has provided ruble-to-crypto exchange services since mid-2023. Its total inbound and outbound transaction volume exceeds $3 billion.
The platform processed approximately $189 million in transactions with entities from Russia’s sanctions-related ecosystem. Of that amount, $175.2 million involved ABCex. Most of the funds flowed from ABCex to Aifory, totaling $168.7 million, compared with $6.5 million in the opposite direction.
The platform also processed approximately $9.6 million involving Garantex, $2.9 million involving Rapira, and roughly $600,000 connected to the A7 network. These patterns suggest that Aifory primarily functioned as a recipient and intermediary within a larger system rather than as an independent settlement hub.
ABCex
ABCex is a Russian cryptocurrency exchange reportedly linked to Sergey Mendeleev, one of Garantex’s co-founders.
The platform has previously been described as Garantex’s third-largest blockchain counterparty. It has also been mentioned in reports concerning transactions that may have been connected to individuals involved in the March 2024 Crocus City Hall terrorist attack.
Blockchain records show a relationship between ABCex and Garantex dating back to at least October 2023, well before Garantex’s shutdown.
After Garantex ceased operations, ABCex emerged as one of the central pillars of the new ecosystem. Since 2023, its transaction volume with UK-sanctioned entities and A7-linked structures has reached approximately $355 million, including:
- $175.2 million with Aifory Pro
- $133.4 million with Garantex
- $38.1 million with Rapira
ABCex also remains Aifory Pro’s largest source of incoming funds, accounting for approximately 96% of all inbound transfers from sanctioned counterparties.
Eurasian Savings Bank
According to UK authorities, Eurasian Savings Bank played a role in supporting Russia’s financial sector.
Following Garantex’s closure, Kyrgyzstan became an important hub for infrastructure connected to cryptocurrency operations involving Russian market participants. Reports have previously indicated that A7 LLC—co-owned by sanctioned Moldovan businessman Ilan Shor and Russia’s PSB Bank—used Kyrgyz-registered entities to support crypto infrastructure and issue digital assets.
According to the UK government, the ruble-backed stablecoin A7A5 facilitated approximately $9.3 billion in transactions within just four months.
What Happened After Garantex Was Shut Down
When a coordinated operation involving the U.S. Department of Justice, German authorities, and Finnish authorities shut down Garantex on March 7, 2025, a key question emerged: would the ecosystem surrounding it disappear, or would it rapidly reconstitute itself elsewhere?
Blockchain data suggests the latter.
Before Garantex’s closure, approximately $60 million per month flowed through Huobi to entities linked to the Russian network. After the shutdown, that figure increased to $86 million per month, representing roughly 43% growth despite the disappearance of one of the ecosystem’s largest platforms.
Grinex Hacked: Exchange Loses Around $15M and Halts Operations
The incident affected not only Grinex but also TokenSpot, a platform tied to multi-billion-dollar flows within a sanctions evasion network. Both play a key role in a parallel financial system linked to Russia.
The most significant growth occurred among companies that assumed functions previously performed by Garantex. During the 26 months before the exchange’s shutdown, Huobi transferred approximately $111 million to Rapira, Aifory Pro, Grinex.io, ABCex, A7, and Old Vector LLC (A7A5). During the following 14 months, that volume surged to $1.13 billion.
The A7 network experienced the most dramatic increase, growing from $4.3 million to $838 million. Transfers to Grinex.io rose from $139,000 to $18 million, while transfers to Rapira increased from $30 million to $184 million.
These entities became the primary focus of the UK's latest sanctions campaign.
What This Means for Companies and Financial Institutions
All entities included in the latest sanctions package have been added to the UK Consolidated List of Financial Sanctions Targets. Organizations operating under UK regulation are required to identify and freeze any assets or transactions linked to these parties.
Compliance professionals are paying particular attention to Huobi. Blockchain analysis suggests that its interactions with Russia-linked cryptocurrency infrastructure may be even more extensive than reflected in official UK statements. Organizations with exposure to UK jurisdiction should evaluate both current and historical transactions involving the platform.
Ownership structures also remain critical. Under UK sanctions rules, a company may itself become subject to restrictions if more than 50% of it is owned or controlled by a sanctioned person. As a result, beneficial ownership and control assessments remain essential when evaluating related entities.
Another Russia-linked crypto service discovered: dossier and details
After the introduction of mandatory user verification, the transaction volume of one crypto service plummeted by almost half. A new service soon emerged, and, judging by the data, the same users began migrating to it.
The more than tenfold increase in transfers between Huobi and Garantex successor platforms, combined with the 43% growth in overall transaction volume, points to a broader trend: sanctions pressure does not necessarily eliminate financial networks. Instead, such networks often adapt by creating new interfaces, attracting former customers, and preserving significant portions of their technical infrastructure.
For this reason, modern financial crime monitoring increasingly focuses not only on company names appearing on sanctions lists but also on behavioral indicators—including ruble-to-crypto conversion services, P2P platforms serving customers of sanctioned banks, and shared blockchain infrastructure with already sanctioned entities.
This approach can help identify emerging financial routes before they appear in the next round of sanctions designations.
Useful material?
Research
Four Iranian cryptocurrency exchanges accounted for roughly 78% of all digital asset volume tied to the country in 2025. They have now become the focal point of the largest U.S. sanctions campaign against Iran's cryptocurrency infrastructure.
Jun 5, 2026
Research
A financial system is already up and running on public blockchains, with loans, analogues of U.S. Treasuries, and automated capital markets. More than $551 billion has flowed through DeFi protocols — but most of that activity has nothing to do with the real economy and everything to do with the speculative build-up of risk.
May 29, 2026
Research
Around 97% of Chinese suppliers of chemicals used to make fentanyl accept payment in cryptocurrency. The volume of such transactions continues to grow alongside the global market for synthetic drugs
May 22, 2026
Research
For the first time, the new law makes blockchain analytics an officially mandatory tool of financial oversight in the United States. Authorities will also gain the power to restrict transactions with foreign crypto services tied to money-laundering risks.
May 20, 2026
Research
Working with cryptocurrencies requires more than just new technology — it demands a complete overhaul of internal processes. We explain how the financial sector is learning to control digital assets and detect threats
May 8, 2026
Research
The scammers attempted to conceal over $90 million through complex cryptocurrency transactions. However, part of the funds was successfully traced and frozen.
May 6, 2026
Telegram
Twitter