How Garantex splits business and what does AEXbit have to do with it

On August 14, 2025, the US Department of the Treasury, through the Office of Foreign Assets Control (OFAC), announced new sanctions against the founder and co-owners of the Garantex crypto exchange. The exchange had already been sanctioned and was considered one of the most “risky” platforms in the world. Its “successor,” the Grinex platform, as well as the A7A5 token pegged to the ruble, were also targeted. GetBlock AML Research reveals the connection between ABCex and AEXbit with Garantex/Grinex.

The US has imposed sanctions against Grinex, Exved, InDeFi Bank, and others. What is known?

The Office of Foreign Assets Control (OFAC) has imposed restrictions against the successors of the Garantex exchange

Read more

These measures were taken after law enforcement agencies shut down Garantex on March 6, 2025. Shortly thereafter, new platforms registered in Kyrgyzstan and likely associated with Garantex began to appear. They had the same interface as the old exchange and received transfers from addresses associated with Garantex. All of this pointed to their close connection with the closed platform.

The EU has imposed sanctions against the issuer of ruble-stablecoin A7A5. What’s important to know

Kyrgyz company A7, linked to Russian bank PSB, helped the sub-sanctioned crypto exchange Garantex withdraw liquidity from blocked addresses

Read more

At the same time, other questionable exchanges attracted attention. For example, shortly after Garantex closed, the ABCex platform was subjected to a powerful DDoS attack and temporarily went offline. However, on July 31, 2025, a message appeared on Telegram stating that the exchange was back in operation. A few weeks earlier, a new platform called AEXbit appeared on channels associated with Garantex, which had exactly the same interface as ABCex. This led to speculation that AEXbit was a renamed version of ABCex.

Import substitution on the example of Garantex: bypass US sanctions and withdraw $60 million

After USDT blocking, the exchange rebranded and started using A7A5 ruble-stablecoin

Read more

An analysis of transactions showed that ABCex and AEXbit use the same schemes and addresses, which almost certainly proves their connection. Their tactics are very similar to those previously used by Garantex and Grinex — launching new platforms with identical designs and retaining the old infrastructure to circumvent blockages.

Key findings

After Garantex closed, there was a sharp increase in the flow of funds to ABCex, with some of this money clearly coming from wallets associated with Garantex. In July 2025, AEXbit appeared, copying the interface and promotion methods of ABCex.

It was established that both projects belong to the same team, since their addresses made joint expenses. Their actions show that risky exchanges are learning from each other, copying proven methods of avoiding the attention of the authorities.

Brief overview of the platforms

Garantex: one of the largest platforms for money laundering and sanctions evasion. Tens of millions of dollars passed through it, including ransoms for cyberattacks and transactions on shadow markets such as Hydra. At its peak, Garantex was responsible for more than 80% of cryptocurrency transactions involving sanctioned individuals.

Grinex: appeared shortly after Garantex was shut down. It had the same interface and was promoted on the same Telegram channels.

ABCex: had ties to Garantex founder Sergey Mendeleev and was formerly Garantex’s third-largest partner. The exchange was accused of involvement in financing the terrorist attack at Crocus City Hall (Moscow, March 2024) and participating in illegal gambling schemes. There were rumors about Mendeleev’s arrest at the end of 2024, but he later reappeared actively on social media, casting doubt on the rumors.

Announcement of the relaunch of the ABCex exchange on Telegram

AEXbit: a new platform announced in July 2025. Its interface is identical to ABCex, which is why many consider it to be simply a new “brand” of the same team.

Announcement of the launch of the AEXbit exchange on Telegram

How ABCex and AEXbit are copying the tactics of Garantex and Grinex

The behavior of these exchanges largely mirrors that of Garantex and its “successor” Grinex.

First, they present themselves as different companies but use the same interface. This is exactly how Garantex operated after it closed: Grinex appeared with the same design and mission — to continue moving funds and keep the platform running.

Second, Garantex and Grinex had identical special “technical fingerprints” that can be identified through blockchain analysis.

In the case of ABCex and AEXbit, the similarities are even stronger: they don’t just have similar interfaces — they actually run on the same infrastructure. All this suggests that ABCex and Garantex most likely had common management.