The US has imposed sanctions against Grinex, Exved, InDeFi Bank, and others. What is known?

On August 14, 2025, the Office of Foreign Assets Control (OFAC) of the US Department of the Treasury announced new sanctions. They are directed against the founder and co-owners of the previously blocked Garantex crypto exchange, as well as against one of its “successors,” the Grinex platform, and the A7A5 token, which is pegged to the Russian ruble. GetBlock AML Research explains why these entities came under the scrutiny of the US authorities.

The operation involved the US Secret Service (cyber investigation unit), the FBI, and international partners from Germany and Finland. It was a continuation of a major operation on March 6, 2025, when the main Garantex website was blocked and more than $26 million in cryptocurrency was frozen. At the same time, conditions were created for the rapid launch of Grinex and the integration of the A7A5 token into its operations.

Garantex co-founder Sergey Mendeleev, as well as the companies InDeFi Bank and Exved, which he owns, were added to the new sanctions list. According to OFAC, InDeFi Bank provides decentralized financial services, and Exved is a platform for crypto trading between Russia and other countries, bypassing US sanctions.

Garantex co-owners Pavel Karavatsky and Alexander Mira Serda also fell under the sanctions. Serda was previously mentioned in the indictment made public on March 7, 2025.

How Garantex became Grinex

Garantex was initially registered in Estonia, but in 2019, its founders Mendeleev and Stanislav Drugalev moved the office to Moscow. Later, Russian authorities conducted a search of Drugalev’s apartment due to the exchange’s ties to cybercriminals. He initially cooperated with the investigation, but later left for Dubai, where he died in a suspicious car accident. Mendeleev formally distanced himself from the exchange but continued to have ties to it.

In April 2022, the US imposed sanctions on Garantex for conducting more than $100 million in illegal transactions (including transactions related to the Conti, LockBit, and Ryuk ransomware groups and the Hydra dark web marketplace). Even after losing its Estonian license in February 2022, the exchange continued to operate through a network, concealing the identities of its wallet owners. After the sanctions were imposed, more than 70% of cryptocurrency transactions related to already blocked companies and jurisdictions passed through Garantex.

The March 2025 operation did not stop their activities. It turned out that Plan B was ready in advance: in December 2024, the company Grinex was registered in Kyrgyzstan. After the Garantex website was blocked, related Telegram channels began advertising Grinex as a “new platform with familiar functionality.” It replicated the Garantex interface and approach, and also helped old customers recover their assets.

Almost a digital ruble

One of the key elements in the transition from Garantex to Grinex was the emergence of the A7A5 token, pegged to the Russian ruble. It was created by the Kyrgyz company Old Vector and integrated into Grinex as a means of payment and compensation. Garantex’s frozen customer funds were transferred to A7A5, which could be sold or exchanged.

The token project is linked to the Russian company A7 LLC, owned by Moldovan oligarch Ilan Shor (under US sanctions) and the Russian bank PSB (formerly Promsvyazbank), which is also under sanctions. Garantex wallets began transferring funds to A7A5 back in January 2025, several weeks before the March operation.

Visualization: TRM Labs

Scheme for withdrawing assets from Garantex to Grinex using A7A5

Meer exchange

The Meer exchange was one of the first to add A7A5 to trading. It has a similar interface and features as Garantex and Grinex. The Meer domain was registered on December 9, 2024, almost simultaneously with the launch of Grinex and A7A5. After Garantex was blocked in March, the trading volume on Meer increased sharply, which indicates its possible role in supporting the network’s shadow financial flows.

Visualization: TRM Labs

Incoming transaction volumes on the Meer exchange since the beginning of 2025

Garantex and crypto laundering

Garantex was an important channel for laundering money from ransomware, dark web transactions, and sanctions evasion. Millions of dollars from the Ryuk, Conti, and LockBit groups passed through it, as well as large sums from Hydra Market, the largest dark web marketplace until its closure in 2022. After that, Hydra’s successors and other high-risk platforms such as Iran’s Nobitex and Russia’s Bitpapa continued to operate through Garantex.

Visualization: TRM Labs

Visualization: TRM Labs

Links between Garantex wallets and sanctioned and criminal organizations

The role of Kyrgyzstan

The emergence of Grinex and the A7A5 token is linked to the fact that after 2022, trade between Russia and Kyrgyzstan grew sharply. Kyrgyzstan passed the Law on Virtual Assets and created the first licensing system for crypto companies. In two years, the market grew to billions of dollars, but it also attracted participants involved in circumventing sanctions.

Consequences

OFAC believes that such structures prepare contingency plans in advance to quickly transfer clients and assets to new platforms. Tokens pegged to fiat currencies, such as A7A5, can become a tool for circumventing sanctions, especially in countries with soft regulation of the crypto market.

Under the new sanctions, all assets of Grinex, A7, and related companies in the US jurisdiction are frozen, and Americans are prohibited from working with them. Foreign banks that continue to serve these structures risk falling under secondary US sanctions.