Just four days after U.S. authorities seized the domain of sanctioned cryptocurrency exchange Garantex and froze over $28 million in Tether, a remarkably similar cryptocurrency platform named Grinex appeared online.
Is this quick return just a coincidence, or are we observing a carefully planned effort to avoid regulatory scrutiny?
Crystal’s investigative team looked into the matter and has uncovered strong evidence that suggests Garantex’s strategic reinvention as Grinex was carefully planned.
Garantex had established itself as a leading Russian cryptocurrency exchange, processing billions of dollars annually. The recent seizure of $28 million, though significant, represented only a fraction (an estimated x%) of Garantex’s monthly transaction volume.
Following the initial asset freeze and domain seizure, Garantex’s customer support Telegram group advised users to visit their offices in person to retrieve their funds.
Users were instructed to bring their identification and account details. It is unclear how many users actually took advantage of this service, but it likely posed a significant inconvenience for many.
Above is a screenshot of Garantex’s Telegram chat instructing users to visit their Moscow office in person to retrieve their funds.
Shortly after the sanctions and asset freeze, Russian-language cryptocurrency news sites began reporting that Garantex had rebranded as “Grinex.”
Anticipating precisely this scenario, Crystal’s Research and Intelligence team swiftly initiated an investigation.
Garantex has a track record of using front organizations to disguise its identity, including, but not limited to, setting up fake exchanges and planting fake attribution trails for blockchain analytics tools. Recognizing these patterns, Crystal used its expertise to quickly verify these new claims.
Our first step was to consider the website itself; it had a highly similar appearance to Garantex’s original site:
Contingency Plan: Garantex’s Disaster Recovery Steps
Crystal’s investigation revealed striking evidence of premeditation.
The Grinex domain was registered in 2024 through a Russian registrar, whoisproxy[.]ru, and lay dormant until March 10, 2025 – just four days after authorities shut down Garantex’s domain.
Further, it would appear that Grinex was laying operational preparations months earlier, as Grinex’s MX records, necessary for email communications, were configured on December 18, 2024.
This timeline strongly indicates that Garantex anticipated a potential domain seizure and proactively established Grinex as its successor.
When we turn to look at Garatex’s activity onchain, we found a picture emerging that appears to wholly support this theory.
Enter A7A5 – Garantex’s stable token
Reports have emerged that Garantex transferred its liquidity and customer balances to Grinex, allowing it to continue operations despite the sanctions.
Crystal’s analysis of the Garantex wallets revealed reliance of a novel stablecoin A7A5 – which describes itself as a “RWA (real world asset) token backed by fiat deposits in trusted banks with a correspondent network linked to Kyrgyzstan and high overnight interest rates.
We were able to show how the blocked Garantex wallet moved the A7A5 tokens to a single wallet. By March 10, 21.20pm UTC, nearly $60 million had been burned.
By 21.30pm UTC, nearly the entire amount of A7A5 was minted and moved to Grinex, erasing the transaction histories.
The prominence of A7A5 on the Grinex website as a deposit method and the speed and opacity with which funds transitioned from Garantex to Grinex underscore the innovation—and potential danger—of such stablecoins as vehicles for regulatory evasion.
Is this a new frontier in the financial crime toolkit by those looking to dodge sanctions?
The Garantex-Grinex evolution highlights a growing challenge for regulators and compliance professionals: cryptocurrency exchanges are increasingly sophisticated in their evasion tactics.
The strategic use of pre-prepared domains and novel stablecoins underscores the urgent necessity for heightened vigilance and sophisticated analytical methods in regulatory enforcement.
