Import substitution on the example of Garantex: bypass US sanctions and withdraw $60 million

The Russian crypto exchange Garantex can rightfully be called the embodiment of a mythical phoenix, which is doomed to revive. In February of this year, the US authorities dealt the platform a serious blow. 89 addresses of the exchange and assets worth $22,8 million were blocked for repeated violation of sanctions, money laundering, and terrorism financing. However, this did not stop Garantex from continuing its operations. GetBlock AML Research found out how the exchange managed to circumvent the restrictions once again.

Garantex 2.0

In the course of the operation, the US authorities seized not only USDT stablecoins from Garantex, but also one of the main assets of the exchange — domains (Garantex[.]org, Garantex[.]io, and Garantex[.]academy), which were used to ensure the operation of the platform’s website.

The operators of Garantex have since rebranded and launched a new exchange, Grinex. Apparently, this plan was worked out in advance, as the Grinex[.]io domain was registered back in 2024.

How Garantex launders millions for Lazarus Group by circumventing sanctions — full investigation

How the exchange launders crypto assets, why it was blocked by Tether and how to avoid blocking funds — we go into detail

Read more

Liquidity migration

Since February 8, Garantex has been making preparations for a possible counteraction to its activities. The exchange’s wallets began accumulating the ruble-denominated A7A5 stablecoin, which is issued by the Kyrgyz company Old Vector for the cross-border payment platform of Promsvyazbank. After USDT was blocked, A7A5 stablecoins began to be moved via disposable wallets to the address: TJkBr9TZ1xBeJoF7RNWqyEMbYqVJ6fXXHR.

A7A5 withdrawal scheme from blocked addresses. Data: Crystal Intelligence

On March 10, four days after blocking assets, this address burned over A7A5 billion ($60 million) and issued a similar number of new tokens. This completely cleared the on-chain trail and funds, making it much more difficult to track the movement of liquidity. The majority of 4,5 billion new A7A5 tokens were accumulated on the address: TNDjh6WGLYyWmkh8vfu42bXVHUqFNQ3rDq.

Distribution of issued A7A5 after burning. Data: Crystal Intelligence

The total number of issued A7A5 stablecoins is 8,1 billion, which means that their issuer over-issued more than half of the total A7A5 supply (61,7%) for the benefit of Grinex.

Later, 4,5 billion A7A5 were moved via several one-time addresses to Grinex’s operational wallet: TGckaiamj5NzaYx6Qp6Zu7kahuHArzUo99.

No secrecy

The fact that Grinex is the relaunched Garantex is not advertised, but also not hidden. Users of the exchange were invited to face-to-face meetings to transfer them to the new platform.

Message from one of the Garantex clients about switching to Grinex

Grinex reviews, which began to appear en masse on the Internet, say that the founders of Garantex launched the exchange.

Article on the Coinmarketrating website