The war between Russia and Ukraine has lasted nearly four years. Western sanctions aim to financially isolate Russia. But instead, Russia has found ways to adapt.
In 2025, BeInCrypto began documenting the process by which Russia and related organizations rebuilt its payment system using crypto. What was formed was not a single exchange or Token , but an entire sustainable ecosystem, capable of surviving freezes, asset seizures, or prolonged control measures.
This investigation will reconstruct the entire system in chronological order, based on chain data analysis and interviews with experts who track money flows.
The first warning signs are not necessarily signs of a crime.
Initially, the signs didn't suggest a connection to ransomware or the darknet marketplace . Instead, it appeared to be commercial activity.
Authorities began asking new questions about how money moved across borders to import goods, how payments were made for dual-use items, and how transactions were settled without banks.
Simultaneously, on-chain data shows a significant increase in activity on Russian OTC exchanges . OTC liquidation providers linked to Russia also recorded particularly large volumes in Asia.
Meanwhile, Telegram groups and darknet forums openly discussed ways to circumvent sanctions. These weren't secret conversations, but practical guides on how to transfer assets across borders without using banks.
The process is very simple. OTC desks accept domestic rubles, sometimes cash, and then issue stablecoins or cryptocurrencies. These cryptocurrencies are then transferred overseas and converted back into local currency.
Garantex operates a Russian crypto money laundering center.
Garantex plays a crucial Vai in this ecosystem. Garantex serves as a liquidation hub for OTC desks, migrants, and trade-related payments.
Russia is using partners in the UAE to circumvent sanctions.Even after the initial sanctions, Garantex continued to operate with legitimate overseas exchanges. This situation lasted for many months.
When law enforcement agencies began tightening their grip, everyone expected disruption. But in reality, Russia had prepared in advance.
“Even when leaving Russia, people still use Garantex to transfer money abroad. If you want to transfer to Dubai, this is the main way to transfer money when traditional banking channels are blocked. For many Russians wanting to leave, Garantex becomes a practical escape route. It’s one of the few ways to transfer money abroad when banks and SWIFT are no longer available,” Chia Lex Fisun, CEO of Global Ledger.
The seizures disrupted the reserves.
On the day Garantex's infrastructure was seized in March 2025, a linked Ethereum wallet quickly amassed over 3,200 ETH. Within hours, almost all of this money was transferred to Tornado Cash.
This is a crucial step. Tornado Cash doesn't directly facilitate withdrawals; instead, it clears your transaction history.
Chart showing ETH reserve fund accumulation and Tornado Cash transfers. Source: Global Ledger.A few days later, dormant Bitcoin reserves began to move. Wallets untouched since 2022 started accumulating BTC . This wasn't a sell-off, but rather emergency fund management.
BTC reserve reactivation chartTherefore, it can be seen that assets other than stablecoins remain under Russia's control.
A successor emerged almost immediately.
As accessing Garantex became increasingly difficult , a new service emerged.
Grinex quietly launched and added support for USDT. Tracing of funds shows they passed through TRON and connected to Grinex's infrastructure. Many users also reported their balances reappearing under this new name.
“This is probably the most obvious name change we’ve ever seen. The new name is almost identical to the old one, the website is the same, and people who lost access to Garantex suddenly find their assets reappearing on Grinex,” Fisun Chia with BeInCrypto.
In late July 2025, Garantex also publicly announced that it would refund existing users in Bitcoin and Ethereum. on-chain data confirms that this payment system was already operational.
At least $25 million worth of crypto has been distributed. A large amount remains untouched.
The payment process is structured clearly. Reserve funds are transferred through mixing services, aggregate wallets, and chain bridges before reaching the end user.
Overall cash flow diagram for prize payouts.Ethereum payouts are based on complexity.
The payments on Ethereum employed various methods to conceal their origin. Funds were transferred via Tornado Cash , then into a DeFi protocol, and subsequently moved across multiple chain . Transactions continuously flowed back and forth between Ethereum, Optimism , and Arbitrum before reaching the Chia wallet.
Despite the somewhat complex process, only a very small fraction of the reserved ETH has been transferred to users. Over 88% of the ETH remains intact, indicating that the payout process is still in its early stages.
Bitcoin payments reveal another weakness.
The process of rewarding with Bitcoin is much simpler and more focused.
The investigative team identified multiple reward wallets linked to a large central hub, which had received nearly 200 BTC. This hub remained operational for months after its seizure.
What's noteworthy is where the money went next.
The source wallets continuously interact with designated deposit addresses belonging to one of the world's largest centralized exchanges. Any "excess" balance after transactions also returns to these addresses.
Why are Western sanctions struggling to keep up?
Western sanctions were not absent. However, they appeared late, were uneven, and were implemented slowly.
When Garantex was completely shut down, investigators documented billions of dollars that had passed through their wallets.
Even after sanctions were imposed, the exchange continued to trade with regulated foreign platforms, taking advantage of the time lag between the ban, its enforcement, and the updating of compliance systems.
The root problem isn't a lack of legal basis, but ratherthe disparity in speed between enforcing sanctions and the speed of crypto infrastructure . While regulators need weeks or months, the crypto system can move liquidation in just hours.
“Sanctions are theoretically fine. The problem is implementation. Billions of dollars can still be moved simply because enforcement is too slow, fragmented, and often fails to keep pace with the adaptability of the crypto system. It’s not that sanctions don’t exist, but rather that they aren’t implemented quickly enough to keep up with the pace of the crypto industry,” commented the CEO of Global Ledger.
This delay allowed Garantex to adapt and operate continuously. Wallets were rotated frequently. Hot wallets changed unexpectedly all the time. Remaining balances were moved as part of normal exchange operations, making it harder for automated monitoring systems to detect them.
The private sector is also struggling to keep up. Banks and exchanges constantly have to balance regulatory compliance, transaction processing speed, customer experience, and operating costs.
In this context, transactions involving prohibited individuals or organizations can still slip through the cracks if they don't trigger clear warnings.
By October 2025, the payment infrastructure will still be operational. Reserves will still be available. Money transfer routes will not be shut down.
This is not the collapse of an exchange, but the evolution of an entire system.
Russia's cryptocurrency strategy for 2025 demonstrates how a sanctioned economy adapts by building parallel lines, keeping money flowing, and constantly redirecting it when blocked.
