Crypto Laundromat: How Garantex Evolved into a Sanctions-Evading Global Network
Reported by
Kristine Baghdasaryan
Contribution by
Ilia Shumanov,
Kirill Gorlov,
Vlad Netyaev
On-Chain Analysis
Sharad Vyas, OCCRP
Edited by
Grigorii Slobodzian
Fact-checked by
Natalia Korotonozhkina
Illustrations by M.G.
Legal review by
Kirill Gorlov, G.M.
We are grateful for the support and assistance of
Bruno Brandão and Janaína Pavan, Transparency International Brazil, Crystal Intelligence, OCCRP
Some entities and individuals referenced in this investigation, including Bank of China, DBS Hong Kong, J.P. Morgan Hong Kong, Deutsche Bank Hong Kong, Fintech Corporation, Exved, Paysol, Sergey Mendeleev, and Sergey Kunitsa, were contacted for comment or made aware of our reporting. Not all subjects mentioned in the report were reached.
Key Findings
Garantex Didn’t Die, It Transformed
Blacklisted by OFAC in 2022 and targeted by law enforcement raids in 2025, Garantex never ceased operations. Instead, it reemerged under new names, such as MKAN Coin, Grinex, and Exved, morphing into a decentralized laundering system sustained by technical obfuscation and government’s tolerance.
Successor Entities Continue to Operate Across Jurisdictions
Entities tied to Garantex continue operating across UAE, Brazil, Kyrgyzstan, Spain, Thailand, Georgia, Hong Kong, and Russia.
Exved: Sanctions Evasion
Led by Sergey Mendeleev, who is linked to Garantex, Exved masquerades as a domestic payment facilitator but operates as an offshore crypto laundering network. By using agent-based payment schemes, it enables Russian clients to move money abroad through offshore proxies, leaving no crypto footprint in Russian banking records.
Dual-Use Goods
During an undercover interview, we confirmed the Exved system’s involvement in financing dual-use goods transactions, which includes microchips, telecom equipment, and related components sourced from jurisdictions such as China and Taiwan.
MKAN Coin and Grinex: Functional Reincarnations of Garantex
While Exved can be described more accurately as an intentionally designed next-generation platform, MKAN Coin and Grinex are closer to rebranded replicas of Garantex, offering the same Telegram-based crypto-to-cash service to Russians moving capital abroad.
Wallet Analysis: Garantex Never Left
Operational addresses tied to Exved and Grinex received funds from Garantex-related sanctioned wallets and routed them to similar entities: this is a classic layering technique in laundering.
Key Individuals Driving the Laundromat
A small, experienced group linked to Garantex continues to operate the laundering network. Sergey Mendeleev, founder of Exved and architect of Garantex’s early systems, repurposed the infrastructure for crypto-backed cross-border payments disguised as legal services. Co-founder Aleksandr Mira Serda (aka Cerda, Ntifo-Siao, or Ntifo Siaw), indicted in the U.S., manages parts of the network from abroad. Mohammad Khalifa, a Garantex representative across multiple jurisdictions, is also tied via blockchain analysis to successor schemes. Together, they sustain a fragmented but resilient system of platforms, including Exved and Grinex, that operate beyond formal oversight.
Moscow-City: The Laundromat’s Unmoved Core
Despite years of investigative reporting, international sanctions, and public scrutiny, Moscow-City remains the operational heart of the laundering network. Key actors, including Exved and affiliated shell companies like Paysol and Fintech Corporation, continue to maintain offices, proxies, and crypto-cash infrastructure in the towers of Moscow-City. The same location that once hosted Garantex now facilitates its successors, an enduring symbol of Russia’s government ability to protect financial gray zones even under international pressure.
Telegram: The Real Exchange
Behind the complex web of crypto wallets, offshore entities, and sanctioned counterparties lies a surprisingly simple backbone: Telegram. Not a regulated exchange or a licensed platform, just a messaging app. Yet this is where it all happens: client onboarding, agent contracts, wallet transfers, and even rudimentary KYC, all conducted through bots and private chats. Telegram has become the central operating layer of the laundering ecosystem, enabling anonymous, scalable, and borderless financial flows, all of which are largely hidden from regulatory oversight.
A Crypto-Laundromat Integrated with State-Tolerated Systems
Garantex’s metamorphosis into Exved and its integration into Russia’s experimental cross-border financial schemes suggest more than opportunistic evasion, it signals a systemic laundering architecture operating under tacit or active federal government enablement. This raises urgent questions about financial integrity and global enforcement gaps.
Some entities and individuals referenced in this investigation, including Bank of China, DBS Hong Kong, J.P. Morgan Hong Kong, Deutsche Bank Hong Kong, Fintech Corporation, Exved, Paysol, Sergey Mendeleev, and Sergey Kunitsa, were contacted for comment or made aware of our reporting. Not all subjects mentioned in the report were reached.
Prologue: From Garantex to Its Successors
Coordinated Strike
On a spring morning in March 2025, law enforcement agencies across three continents launched a coordinated strike.
The U.S. Secret Service, Europol, and authorities in Germany, Finland, and India launched their attack almost simultaneously. Their target was the online infrastructure of Garantex, a Moscow-based crypto exchange officially sanctioned for facilitating millions of dollars in illicit transactions.
Officers seized Garantex’s online infrastructure, including its main domains, garantex.io and garantex.org, and took control of the servers hosting its core operations. In the hours before the raid, U.S. authorities reportedly copied some of the data.
The system administrator of Garantex, Aleksey Besciokov, was arrested in India, while the exchange’s co-founder, Aleksandr Mira Serda (also known as Aleksandr Ntifo-Siao) evaded arrest and is believed to have continued operating from the UAE. Both were indicted for conspiracy to operate an unlicensed money-transmitting business and to commit money laundering.
In August 2025, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) expanded sanctions against Garantex’s successors – Grinex, Exved, InDeFi Bank – and its executives: Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky. Garantex itself was re-designated under the U.S. cyber-related sanctions program. Within days, the UK announced sanctions aimed at Garantex’s successor networks, highlighting token A7A5, which had moved roughly $9.3 billion on the exchange in just four months. Taken together, Washington and London signalled that enforcement now targets the broader Garantex ecosystem and its successor brands, not just the legacy exchange.
But this was not the first blow to the exchange. In 2022, OFAC had already blacklisted Garantex for laundering funds for darknet markets and ransomware groups such as Conti and Hydra. The Estonian regulator had revoked the exchange’s license for serious anti-money laundering violations. Nevertheless, Garantex did not cease operations: it merely changed tactics, entrenched itself in Russia, and continued serving clients while evading Western oversight.
Founded in Moscow in 2019, Garantex started as a crypto exchange focused on ruble-based trading. Over time, it grew into a core component of Russia’s evolving response to Western financial isolation. Between 2019 and 2025, it processed around $96 billion in transactions, with at least $1.3 billion directly linked to criminal activity, according to blockchain forensics firm Chainalysis.
Each time Garantex seemed defeated, it returned in a new form, like a hydra: cutting off one head only made another grow.
Critical Hub for Sanctions Evasion
A shift in operational tactics allowed Garantex not only to survive, but to thrive after sanctions were imposed. The exchange rotated wallets frequently, used one-off addresses, and engaged in chain-hopping methods to obscure transaction trails. Investigators found evidence of false user data provided to Russian authorities and illegal servicing of U.S. customers without registration.
Beyond technical adaptation, Garantex emerged as a favored venue for high-risk transactions tied to illicit actors. According to crypto forensics firm Elliptic, on-chain data showed that wallets allegedly linked by Israeli authorities to Palestinian Islamic Jihad (PIJ) had conducted transactions through Garantex. The ICIJ, citing data from blockchain analytics firm Global Ledger, reported that as much as $15 million in cryptocurrency had passed through Garantex to wallets allegedly tied to Hezbollah and Iran’s Quds Force.
While the exact share of such activities in Garantex’s total volume remains unclear, the evidence indicates that the exchange played a significant role in facilitating payments for sanctioned entities. This was especially prominent after major platforms like Binance, Coinbase, and PayPal restricted services for Russian users following the Western sanctions imposed in 2022.
This pattern reflects not just technical evasion, but Garantex’s broader appeal to actors seeking minimal compliance and maximum opacity. Its services were repeatedly exploited by cybercriminal syndicates as well as by those aiming to funnel money across borders without regulatory detection.
In 2024, according to TRM Labs estimates, over 85% of crypto inflows to sanctioned entities and jurisdictions went through Garantex and the Iranian exchange Nobitex. OFAC’s analysis “shows that over $100 million of known Garantex transactions are associated with illicit actors, including darknet markets and ransomware groups.”
Returning to April 2025: although the raids and arrests seemed like a decisive blow, Garantex did not disappear. What followed was a transformation: name changes, new schemes, new platforms. Soon, the name Grinex appeared on the blockchain as a rebranded shell where user balances were migrated. As of April 2025, it had processed over 41.7 million USDT in incoming transactions.
Garantex underwent a significant evolution, becoming part of a larger ecosystem: a crypto-based transaction network operating with apparent government tolerance and expanding across international borders.
This investigation traces Garantex’s transformation from sanction evasion tactics to the rise of its successor entities like Exved and MKAN Coin, to the quiet integration of this potential laundering architecture into Russia’s own experimental financial framework.
Together, these networks could be called a “Crypto Laundromat”: a decentralized infrastructure used to move billions in dirty money across borders, with the Kremlin looking the other way, or possibly helping shape the system from within.
