MKAN Coin Group: The Global Shadow Revival of Garantex
Reported by
Kristine Baghdasaryan
Contribution by
Ilia Shumanov, Kirill Gorlov, Vlad Netyaev
On-Chain Analysis
Sharad Vyas, OCCRP
Edited by
Grigorii Slobodzian
Fact-checked by
Natalia Korotonozhkina
Illustrations by M.G.
Legal review by
Kirill Gorlov, G.M.
We are grateful for the support and assistance of
Bruno Brandão and Janaína Pavan, Transparency International Brazil, Crystal Intelligence, Elliptic, OCCRP
Some entities and individuals referenced in this investigation, including Bank of China, DBS Hong Kong, J.P. Morgan Hong Kong, Deutsche Bank Hong Kong, Fintech Corporation, Exved, Paysol, Sergey Mendeleev, and Sergey Kunitsa, were contacted for comment or made aware of our reporting. Not all subjects mentioned in the report were reached.
By the spring of 2025, we had already completed our investigation into Exved. We examined how their agent scheme was structured, how they concealed crypto traces, avoided regulatory scrutiny, circumvented sanctions, and facilitated the delivery of dual-use goods to Russia. We continued investigating other Garantex successors that had been appearing here and there since 2022, when the company was sanctioned. We kept tracing them across Dubai, Brazil, Kyrgyzstan, Spain, Thailand, and Georgia.
At this time, in March 2025, a little-known website surfaced on the open web, quietly hosting one of the most revealing data breaches tied to Russia’s crypto-laundering architecture. Without any media attention, the site offered hundreds of files, leaked emails, internal chats, scanned identity documents, vendor invoices, and crypto transaction logs which were dated from 2021 through late 2024.
These materials were sourced from the email inboxes of two employees within Garantex’s and Fintech Moscow operations. One was responsible for finance and document circulation, and the other served as executive assistant and office administrator, coordinating day-to-day logistics and internal operations. The materials covered not only Garantex’s inner workings but also the network of its successor structures, offering unprecedented insight into what happened after the company was sanctioned. ► Show details
These materials were sourced from the email inboxes of two employees within Garantex’s and Fintech Moscow operations. One was responsible for finance and document circulation, and the other served as executive assistant and office administrator, coordinating day-to-day logistics and internal operations. The materials covered not only Garantex’s inner workings but also the network of its successor structures, offering unprecedented insight into what happened after the company was sanctioned. ► Show details
The core legal and service infrastructure of Garantex remains embedded in Fintech Corporation LLC, a Moscow-registered entity that served as a central node in Garantex’s pre-sanctions operations and connected to Rosneft, Russia’s state oil company, and figures close to Kremlin insider Igor Sechin. Fintech Corporation LLC is also the registered legal entity of Garantex Academy, a project aimed at promoting crypto literacy but widely viewed as part of the exchange’s public relations strategy.
What first seemed like an unverified leak quickly proved authentic. Our team reviewed dozens of personal identifiers. We matched passport scans with official corporate filings, cross-checked crypto wallets against public blockchain records, and verified office leases and internal memos. The documents consistently aligned with open-source information, leaving little doubt that the leak was genuine.
The material confirmed several long-held suspicions in addition to our own findings. Now it’s time to map out the full picture.
From Takedown to Rebirth
In the aftermath of Garantex’s blacklisting by U.S., EU, and UK regulators in 2022, a new brand quietly emerged. It started first in Dubai, then in Brazil, Kyrgyzstan, Spain, Thailand, and Georgia. This brand, MKAN Coin, offered the same core product Garantex had perfected: a seamless, Telegram-based crypto-to-cash exchange aimed at Russians moving capital abroad.
While the name was new, the infrastructure, personnel, bots, and behavior patterns were not. MKAN Coin inherited and rebranded Garantex’s laundering blueprint, extending it into a decentralized, global network designed to survive sanctions and scrutiny.
Unlike Exved, which is better understood as a deliberate continuation and next iteration of Garantex, MKAN seems more like reincarnation under a new name and legal wrapping, with just enough distance to obscure its origins.
Some entities and individuals referenced in this investigation, including Bank of China, DBS Hong Kong, J.P. Morgan Hong Kong, Deutsche Bank Hong Kong, Fintech Corporation, Exved, Paysol, Sergey Mendeleev, and Sergey Kunitsa, were contacted for comment or made aware of our reporting. Not all subjects mentioned in the report were reached.
Mohammad Khalifa
Behind MKAN Coin is Mohammad Khalifa, a former executive at Garantex Europe and one-time top manager at the Dubai International Financial Center. According to public Spanish business registries, Khalifa served as a co-director of Indefiti EU, a crypto-focused entity registered in Spain, until January 2024.
The leaked files revealed direct involvement. As detailed in the spreadsheets we recovered, Khalifa appeared regularly in internal correspondence, traveled on business to Russia with Garantex staff, and was linked to dozens of crypto wallets. His presence was not peripheral; he was embedded in the core of the operation.
In March 2023, Mohammad Khalifa posted a celebratory photo on social media: a handshake with a Kyrgyz official announcing the launch of MKAN Coin’s operations in Kyrgyzstan. The caption proudly declared the group’s expansion into “FINTEC, insurance, crypto solutions, and logistics.”
Less than two years later, in February 2025, the Kyrgyz financial intelligence unit issued Order No. 29, adding several companies to its money-laundering blacklist under the national AML/CFT law. Among the banned entities was Crypto360, a firm registered in 2023 at the same technical and administrative address used by MKAN Kyrgyzstan.
Crypto360 is no random startup. The company is officially registered to Maria Agranovskaya. Notably, she is also listed as an administrator of the Exved-linked legal Telegram group “Юристы ВЭД,” alongside Mendeleev, further confirming her involvement in related networks.
Although Crypto360 was initially included in the government’s blacklist, it was quietly removed from the list shortly thereafter. This development raises further questions about the extent of its political and institutional ties.
Brazil and Marbella: Indefiti and Smartbank Echoes
Our investigation identified entities using the Indefiti brand in Brazil and Spain, echoing the ideological foundation laid by InDeFi SmartBank, a decentralized finance (DeFi) partner of Exved, co-founded by Sergey Mendeleev and Alexandr Lebedev, a former KGB and Foreign Intelligence Service (SVR) officer.
Although Indefiti Brazil and Indefiti EU in Marbella do not appear structurally identical to InDeFi SmartBank, they reflect a similar vision; the creation of decentralized, non-bank financial infrastructure aimed at skirting traditional oversight.
In Spain, Mohammad Khalifa was listed as co-director of Indefiti EU until early 2024, though details about this entity’s operations remain sparse.
Brazilian records link Indefiti Brazil to MKAN Coin through overlapping personnel, including Djimily Vladimir Dantas Ferreira, who operates the company in Brazil. These ties suggest possible coordination between the two networks.
According to Telegram correspondence, the core ambition behind InDeFi SmartBank was to issue and promote a crypto-ruble, which would serve as the foundation for the platform’s broader financial ecosystem. The team explicitly stated that once the crypto-ruble was launched and backed by liquidity, the main objective would be selling tokens linked to it. These tokens (like IDF and TEI) were envisioned not merely as utility coins, but as investment vehicles tied to pseudo-banking services: deposits, staking, tokenized equity (like Emperium), and liquidity pools. Although framed as a decentralized solution, the platform closely mimicked banking functions while operating entirely outside regulatory frameworks.
Importantly, the Spanish Indefiti should not be assumed to inherit the same operational architecture as Garantex. What connects these projects is their shared emphasis on building parallel financial ecosystems outside of traditional banking, not confirmed infrastructure continuity.
As for InDeFi SmartBank itself, it does not hold a banking license in Russia, and its name has a disclaimer:
“SmartBank is a smart contract system in blockchain.”
The Garantex Legal Shell: Fintech Corporation and CoinKYT
If Indefiti reflects an attempt to build an “alternative bank” on blockchain rails, parallel efforts emerged to legitimize such schemes. A key new entity is compliance-oriented CoinKYT, closely tied to Fintech Corporation and Aleksandr Mira Serda.
One of his Russian passports lists his name as Alexandr Mira Cerda, while another passport spells it as Aleksandr Mira Serda. ► Show details
One of his Russian passports lists his name as Alexandr Mira Cerda, while another passport spells it as Aleksandr Mira Serda. ► Show details
The difference concerns both the spelling of the last name (Cerda vs. Serda) and the first name (Alexandr vs. Aleksandr). However, the first spelling of his last name (Cerda) does not appear in OFAC sanctions list or his wanted page. The only variations reflected are Mira Serda, Ntifo-Siao, and Ntifo Siaw. As a result, searches using “Cerda” yield no results. English-language media primarily call him Aleksandr Mira Serda. It is also worth noting that his alleged father’s Spanish death certificate records the surname as Cerda.
Public records show that Aleksandr Mira Serda, a shareholder of Fintech Corporation LLC alongside another Garantex beneficiary owner, Pavel Karavatskiy, registered multiple entities under Fintech’s umbrella. One of them is CoinKYT, a self-described KYC/AML compliance service created to provide a veneer of regulatory legitimacy for crypto clients. CoinKYT was officially trademarked in Russia in 2023, with public records listing Mira Serda as its rights holder.
Although formally positioned as a tool for financial compliance, CoinKYT is controlled by individuals linked to offshore schemes, pseudo-banking structures, and sanctions evasion efforts. Despite this, the company has sought to project a respectable image. In a May 2025 interview published on CoinKYT’s Telegram channel, the CEO claimed the firm “actively collaborates with police,” including on investigations into Ukrainian-run call center fraud schemes.
On social media and Telegram, CoinKYT also publicly promoted Exved, another player in the broader parallel crypto-financial ecosystem:
Dubai Footprint and Identity Shift
As Mira Serda expanded his international business operations, he also established a personal footprint in Dubai. He purchased a luxury villa in the DAMAC Hills, Bel Air development in Dubai as a residential property, under a freehold agreement valued at approximately $3.07 million. The property, located in one of Dubai’s upscale gated communities, was registered under his name using his Downtown Dubai address at 1508 Tower 2, 29 Boulevard. His brother, Leslie Ntifo-Siao, resides in Dubai at a nearby address in The Vogue Business Bay:
Leaked records reveal that Alexandr Mira Serda obtained a new Russian birth certificate listing a deceased Spanish citizen, José Luis Mira Cerda (who died in Murcia in 2019) as his father. This retroactive change in parentage, more than three decades after birth, coincides with his growing involvement in cross-border property and crypto-related business activities. The deliberate registration of a new identity, anchored to a foreign EU citizen with no apparent biological link, strongly suggests an effort to obscure his original identity, potentially to evade sanctions, due diligence checks, or law enforcement scrutiny.
The Ntifo-Siao Network
Leslie Ntifo-Siao, the brother of former Garantex shareholder Aleksandr Mira Serda, surfaces as a key actor. In May 2021, Leslie publicly represented Garantex at the Supreme Blockchain Conference in Dubai. He later became a co-owner of Arca Technologies, a Dubai-based Payment Services Provider established in 2022. Corporate filings show that Arca listed the personal e-mail address of Mohammad Khalifa ([email protected]) and registered its office at Al Salemiyah Tower, the same building that hosts the MKAN Coin headquarters (office 303).
Court records from the UAE show Arca Technologies listed Leslie Ntifo-Siao as a respondent in a commercial appeal case (No. 2377/2024). The nature of the dispute is not fully detailed, but the case indicates a legal confrontation.
As of 2025, according to the 2GIS map and regulator, they have been moved to another location: Rawdat Al Wasl Building 206, Sheikh Zayed Road.
In addition to activity in the UAE, Leslie maintains ties to Kyrgyzstan. He is the owner of SpektrumTek, a company registered in Bishkek at the same address as MKAN Kyrgyzstan and just down the street from Crypto360. Both firms operate out of neighboring buildings on Razzakov Street.
In Thailand, the Ntifo-Siao brothers and their associates expanded their footprint through a combination of corporate activity and real estate acquisitions. Official records show that Indefiti (Thailand) Co. Ltd. was registered in November 2022 with its legal address in Bangkok; the internal correspondence reveals continued operational involvement into 2023 and 2024. In March 2023, Fintech employees discussed plans to “allocate an MKAN office for lease” in Thailand, suggesting Ntifo-Siao’s ongoing effort to establish a physical presence for affiliated operations in the country. Later, in mid-2024, additional emails show preparations for financial reporting by Indefiti Thailand, coordinated jointly with a local accounting firm, Benoit and Partners.
We found plans for setting up an exchange office and headquarters in Thailand, on Phuket (the date of the layout approval was January 2022).
In 2024, Aleksandr Mira Serda arranged to purchase a two-story house on Phuket Island for about $410,960, using a notarized power of attorney. Since foreigners can’t own land in Thailand, he also signed a 30-year land lease for around $186,300. Both agreements, handled by his local representatives, Nattharada Pansamutr and Thitirat Ritpitak, were made with Hongthai Phuket Co., Ltd.
That same year, his brother, Leslie Ntifo-Siao, entered a similar agreement to lease a plot of land in the nearby Manick Hillside Phuket project, signing a 30-year lease worth approximately $234,360 and agreeing to build a custom 4-bedroom villa with a pool. His total planned investment amounted to approximately $1.9 million. This included the villa structure, additions such as a cinema, gym, and rooftop terrace, as well as a furniture package. On September 15, 2022, Leslie paid a reservation deposit of about $68,500 in cash, as confirmed by an official receipt signed by the landowner, Miss Thapani Kotchapakdi.
While these properties were designated for private use, its timing, alongside corporate activity tied to Indefiti and MKAN, reinforces his personal and financial footprint in Thailand.
Global Expansion and Reinvention: The Grinex Phase
This situation in Thailand, Kyrgyzstan, and the UAE appears to be just one part of a larger puzzle. Across UAE, Kyrgyzstan, Spain, Brazil, Georgia, and Thailand, the same people, logos, bots, and back-end infrastructure appear under new legal names: MKAN Coin and Indefiti. While MKAN Coin’s operations have since been suspended by UAE regulators, the platform was previously marketed as a tool for Russian clients to convert rubles into dollars or stablecoins and move capital offshore. Although the structure of Indefiti remains opaque, its branding and network suggest a similar ambition to provide alternative cross-border financial channels amid tightening Western sanctions.
Indeed, a new pivot may be underway. As regulators in Dubai froze MKAN Coin’s operations for unlicensed activity, evidence suggests that the operators behind Garantex have not exited the game, they’ve merely shifted tactics. In the months following the shutdown, a new platform quietly emerged under the name Grinex.
Reports from multiple crypto-focused media outlets, such as Global Ledger, Forklog, BeInCrypto, Hashtelegraph, and TRM Labs, suggest that Grinex may be a rebranded shell operated by the same individuals behind Garantex.
The platform, launched in 2025, offers P2P crypto services with a strong focus on Russian and CIS markets, echoing Garantex’s original geographic footprint. According to TRM Labs, Grinex “shows transactional and infrastructure overlap with Garantex,” and likely inherited at least part of its user base.
Further deepening the resemblance is the launch of a new stable token, A7A5, The token’s origins trace directly to A7 LLC, a Russian cross-border settlement platform owned by sanctioned Moldovan oligarch Ilan Shor, through Grinex. According to an investigation by Crystal Intelligence, this token appears to be part of Garantex’s post-sanctions survival strategy. The A7A5 token is marketed as a ruble-pegged stablecoin designed for use in cross-border trade, particularly appealing to users within Russian regulatory gray zones. Crystal’s analysts noted:
“This token could offer similar functionality to Tether (USDT) but under localized control – allowing sanctioned actors to conduct trade while minimizing exposure to Western enforcement.”
It’s worth noting that the February press release on the a7a5.kg project website notes that the cryptocurrency is backed by ruble deposits in PSB (Promsvyazbank), belonging to certain companies interested in using the stablecoin. PSB is a Russian state-controlled “defence bank”, which is under sanctions from the US, UK, and EU. This coin could be designed for cross-border trade, a potential mechanism for sanctions evasion.
A7A5 has processed $9.3 billion in transactions on the Grinex exchange within just four months.
Although Grinex’s ownership remains opaque, the timing of its debut, directly following the international takedown of Garantex and MKAN Coin’s regulatory freeze, strongly supports the theory that this is not an entirely new enterprise but a strategic rebranding of the same laundering infrastructure.
Conclusion
The evolution of Garantex from a sanctioned crypto exchange into a sophisticated, decentralized global network carries profound implications for the efficacy of global sanctions frameworks and the integrity of the international financial system.
The trajectory of Garantex demonstrates that traditional, entity-based sanctions, while impactful, are often insufficient against highly adaptive, decentralized networks that can rapidly rebrand, shift operational bases, and exploit regulatory gaps. The very concept of a “crypto laundromat” highlights a system that deliberately blurs the lines between formal legalization and covert sanctions evasion. This system operates with weak KYC (Know Your Customer) standards and opaque intermediary structures, allowing high-risk transactions to pass undetected. This signals a fundamental shift in the nature of financial crime and sanctions evasion, moving from centralized, identifiable organizations to distributed, agile networks that leverage technology (cryptocurrency, encrypted messaging) and legal ambiguities to operate across borders. This implies that traditional law enforcement and regulatory models, often siloed by jurisdiction and focused on identifiable legal entities, are increasingly ill-equipped to combat this new paradigm.
A critical consequence of these operational models is the systematic erosion of traditional financial oversight and audit trails.
The flagship reincarnation, MKAN Coin, surfaced in Dubai and rapidly spread to Brazil, Kyrgyzstan, Spain, Thailand, and Georgia, offering Russians an offshore off‑ramp from rubles to stablecoins and hard currency. Although Dubai’s Virtual Assets Regulatory Authority shut MKAN down in mid‑2024, the network rebounded: by early 2025, a look‑alike exchange called Grinex and its ruble‑pegged stable‑token A7A5 were processing billions, re‑using Garantex wallets and bots.
Inside Russia, the money is primed by Exved, a “payment facilitator” set up by Garantex’s former shareholder, Sergey Mendeleev. Blockchain traces tie Exved’s wallets to Garantex, Grinex, and mixer hub ABCEX/Arvix, proving it drains into one liquidity pool.
Exved’s willingness and capability to facilitate trade in dual-use goods, such as microprocessors, from sensitive regions like China, Hong Kong, and Taiwan, poses a direct threat to international security and export controls. This circumvention is achieved by navigating around banking scrutiny and customs oversight through tailored documentation. The explicit admission by Paysol’s legal team that their scheme is commonly used for dual-use goods imports elevates this beyond mere financial crime to a direct national security concern. It demonstrates how these crypto-laundering networks directly undermine international export controls and sanctions regimes designed to prevent hostile actors from acquiring critical technologies. This implies that the financial crime aspect serves as a means to an end, enabling the strategic circumvention of broader security measures.
This network’s evolution demands new global strategies to effectively combat financial crime and uphold international security.