U.S. Imposes Sanctions on Cryptocurrency Exchange Grinex, Successor to Garantex

Red Dog Security

19 Aug 2025 — 2 min read

U.S. authorities have imposed sanctions on Grinex, the successor to the cryptocurrency exchange Garantex, which was previously blacklisted for facilitating darknet transactions and laundering money for cybercriminals.

Links Between Grinex and Garantex

Earlier this year, researchers at TRM Labs reported that Grinex was closely tied to Garantex’s prior operations. While the report did not present direct evidence of illicit activity, it noted that Grinex began aggressively advertising on Telegram channels associated with Garantex shortly after U.S. authorities seized Garantex’s domains in March 2025.

“Just days after Garantex was shut down, Telegram channels linked to the exchange began promoting Grinex—a platform with a nearly identical interface, registered in Kyrgyzstan in December 2024,” TRM Labs observed.

Background on Garantex

The controversy traces back to 2022, when U.S. officials accused Garantex of laundering more than $100 million in transactions tied to ransomware groups, darknet marketplaces, and hacking collectives—including the Conti ransomware gang and the Hydra marketplace. That same year, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Garantex.

The crackdown escalated in 2025: two Garantex administrators, Aleksandr Mira Serda and Lithuanian national Aleksej Besciokov, were indicted. Besciokov was arrested in India days later while on vacation.

Expanded Sanctions

Last week, OFAC extended sanctions against Garantex and three of its co-founders—Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky. Sanctions were also placed on Grinex and six affiliated companies operating in Russia and Kyrgyzstan: InDeFi Bank, Exved, Old Vector, A7, A71, and A7 Agent.

In its official statement, OFAC said:

“Immediately after law enforcement actions on March 6, 2025, led by the U.S. Secret Service, Garantex’s leaders established infrastructure to continue providing core services, including transferring Garantex customer deposits to Grinex. Grinex’s promotional materials state that the exchange was created in response to the sanctions and asset freezes that affected Garantex. Since its creation, Grinex has processed billions of dollars’ worth of cryptocurrency transactions.”

Global Response

Following OFAC’s announcement, the U.S. State Department offered a reward of up to $6 million for information leading to the arrest or conviction of Garantex’s leaders.

According to the State Department, Garantex processed more than $96 billion in cryptocurrency transactions between April 2019 and March 2025.

John K. Hurley, Deputy Treasury Secretary for Terrorism and Financial Intelligence, underscored the broader threat:

“The use of cryptocurrency exchanges to launder money and facilitate ransomware attacks not only threatens our national security but also undermines the integrity of legitimate virtual asset service providers. By exposing these malicious actors, the Treasury Department continues to support the fair and lawful operation of the digital asset industry.”

Malware Downloaded Over 19 Million Times Removed from Google Play Store

Security researchers have uncovered a massive malware campaign on the Google Play Store, where 77 malicious Android applications—collectively downloaded more than 19 million times—were distributing multiple malware families. According to specialists at Zscaler, the surge included adware apps as well as more dangerous threats such as Joker, Harly,

Developer Sentenced to 4 Years in Prison for Creating “Kill Switch” in Former Employer’s Systems

A former software developer has been sentenced to four years in prison for sabotaging his ex-employer’s Windows network with custom malware and a “kill switch” that locked out thousands of employees worldwide. According to the U.S. Department of Justice, 55-year-old Davis Lu, a Chinese citizen legally residing in

Positive Technologies Analyzes the Toolset of APT Group Goffee

Specialists at Positive Technologies have revealed details of a previously undocumented toolset used by the hacker group Goffee (also known as Paper Werewolf). According to the researchers, these tools were deployed in the later stages of attacks, enabling the group to maintain long-term persistence inside victim networks while avoiding detection.

Flipper Developers Deny Existence of “Secret Firmware” for Hacking Cars

The issue of car theft using the Flipper Zero has resurfaced in global headlines. This time, hackers claim to be selling a “secret firmware” for the device that allegedly works against cars from Ford, Audi, Volkswagen, Subaru, Hyundai, Kia, and several other manufacturers. The developers behind Flipper Zero say these