A new cryptocurrency exchange named Grinex is believed to be a rebrand of Garantex, a Russian cryptocurrency exchange whose domains were seized by the U.S. authorities and an admin arrested.
According to a new report by blockchain intelligence firm TRM Labs, Grinex shows strong ties to Garantex’s previous operations but has not determined if it’s currently being used for illicit transactions.
Garantex was a Russian cryptocurrency exchange, officially registered in Estonia, that was sanctioned by the U.S. (OFAC) in April 2022, followed by similar actions by the UK and the EU.
U.S. authorities seized Garantex’s domains in early March 2025 for multiple violations, including the processing of $100 billion worth of illicit transactions and facilitating money laundering for ransomware gangs and darknet markets.
TRM Labs confirmed transactions with the Conti ransomware group and the dark web markets Hydra, Mega, Kraken, OMG!OMG! And Solaris.
Two administrators of Garantex, Aleksej Besciokov and Aleksandr Mira Serda, were subsequently charged, with Besciokov arrested a few days later while vacationing in India.
Grinex’s sudden rise
Soon after the seizure, Grinex was promoted on Telegram channels linked to the Garantex-adjacent Satoshkin group, stating it was a “a new platform with familiar functionality.”
The user interface similarities between the two platforms were extensive, but more notably, Grinex was in a position to make arrangements to capture Garantex’s staff and user base from its very launch.
“Grinex announced it had entered into an agreement with Garantex to onboard its clients and was considering hiring former Garantex employees,” explains TRM Labs.
“Even more revealing, Grinex began distributing former Garantex user assets through a new token, A7A5.”
Two weeks prior to Garantex’s takedown, a new stablecoin called A7A5, pegged 1:1 to the Russian ruble, was announced on the platform, likely as a measure of the anticipated upcoming legal action.
TRM Labs found two Kyrgyzstan-based firms to be behind large transactions involving the A7A5 token, but the connections are obscure.
What is clear is that after the Garantex takedown, Grinex started distributing former Garantex user assets through the A7A5 token, with Telegram channels previously linked to Garantex promoting Grinex as a way for users to recover their frozen funds.
Source: TRM Labs
Ultimately, the rise of Grinex shows that blocking cybercrime and sanctions evasion mechanisms is a complicated process, as illicit networks can quickly adapt by rebranding, creating new stablecoins, and exploiting decentralized platforms to continue their operations unabated.
TRM Labs mentions two other platforms that emerged as a Garantex replacement, namely ABCEX, which is directly related to Garantex founder Sergey Mendeleev, and Rapira, which has welcomed several former Garantex users already.
