Shuttered Russian trade Garantex has rebranded as Grinex, in keeping with on-chain evaluation from blockchain intelligence agency TRM Labs.
Garantex dealt with over $100 billion in transactions previous to its dismantling by worldwide enforcement companies in March of this 12 months.
But evaluation from UK-based TRM Labs means that Grinex has been onboarding Garantex customers and redistributing their property within the type of A7A5, a ruble-pegged stablecoin accessible on Tron and Ethereum.
Garantex pockets addresses started changing funds into the A7A5 stablecoin in January 2025, with Kyrgyz data documenting that the corporate behind the token, Previous Vector, was registered as just lately as December 13, 2024.
TRM Labs means that the sanctioned trade was conscious that it was liable to being shut down, and that the creation of A7A5 was a method of evading sanctions and enabling its customers to get better any property that would find yourself being misplaced within the occasion of a takedown.
On-chain evaluation reveals that giant volumes of transfers involving A7A5 have been made in January, within the weeks main as much as the U.S.-led enforcement motion that dismantled Garantex.
Tellingly, TRM additionally cites how Garantex’s Telegram channels started selling Grinex solely a matter of days after it was taken down, with the brand new trade registered in Kyrgyzstan on December 23, 2024.
The people concerned within the registration of Grinex and A7A5 are obvious unknowns, with no evident or formal hyperlink to Garantex.
Grinex seems to have been registered by Duulat-eldar Sagynbeki Subankulov, who TRM Labs suggests could also be a former skilled gamer.
In the meantime, Previous Vector was registered by Tatyana Sergeevna Menshikova, who stays an entire unknown.
But for TRM Labs, the obscurity of those two people provides “one other layer of ambiguity to Grinex’s origins.”
One factor that’s identified is Grinex’s person interface bears a “putting resemblance to Garantex,” whereas the platform has really introduced an settlement with sanctioned trade to onboard its former clients and even rent its staff, doing so on the Telegram channel of the Garantex-linked Satoshkin group.
Elaborating on the hyperlinks between the 2 platforms, TRM Labs instructed Decrypt that “Garantex has a singular on-chain fingerprint and Grinex makes use of this identical fingerprint.”
Of explicit significance is the truth that middleman addresses, which “are related to the switch of funds out of Garantex,” have been used to deposit funds (largely in A7A) into Grinex shopper addresses.
On high of this, TRM Labs additionally instructed Decrypt that Garantex co-founder Sergey Mendeleev was “outstanding within the announcement of Grinex’s launch,” which was posted on Telegram.
And it’s not solely TRM Labs that believes Grinex is successfully Garantex 2.0, with Chainalysis additionally leaning on this course.
“At Chainalysis, we’ve been monitoring the alleged hyperlinks between Grinex and Garantex, and whereas we’re not able to make a proper attribution simply but, we’ve got seen indicators that Grinex is more likely to be the rebrand of Garantex,” mentioned Head of Nationwide Safety Intelligence Andrew Fierman, chatting with Decrypt.
Fierman explains that Chainalysis has obtained “a number of experiences” of former Garantex customers visiting the trade’s workplaces, the place they have been in a position to switch their funds on to Grinex.
“There’s additionally been a Telegram put up from a Garantex co-founder [Sergei Mendeleev] speaking [about] the launch of Grinex, disregarding any platform similarities with laughing emojis,” he added.
At its peak, Garantex accounted for 82% of all crypto-currency volumes related to sanctioned entities internationally, whereas even after it was sanctioned by OFAC in April 2022 it managed to deal with 70% of such volumes.
And for Fierman, its obvious rebirth as Grinex raises severe questions on whether or not sanctions and shutdowns can ever be 100% efficient in stamping out illicit cryptocurrency exercise.
“The broader concern right here is that rebranding has turn out to be a well-known tactic for sanctioned crypto entities; a difficulty we will likely be monitoring carefully,” he mentioned.
This concern can also be underlined by different evaluation from TRM Labs, which finds that two different Russia-linked exchanges (along with Grinex) have been capturing Garantex’s former volumes in current months.
Certainly one of these is ABCEX, which is tied to Sergey Mendeleev and was Garantex’s third-largest on-chain counterparty, whereas the opposite is “high-risk trade” Rapira.
Each of those platforms witnessed a surge in quantity in March, when Garantex was taken down, and whereas ABCEX noticed a dropoff in April, Rapira has continued to develop.
Edited by Stacy Elliott.
