Audit log

Every state-changing event for Garantex: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-04 20:08:07Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 453,359,436

   sig

   5Y9DrmQnVumw…45Y2aN5Hcopyexplorer ↗

   hash

   2GeWPTQZTULp…5Y9wvjMRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (19623 B) ▸

   {"actor":"system:backfill","investigation_id":"e330db80-c665-4c9a-af18-efa6a49cc091","kind":"publish","page_slug":"garantex","published_at":"2026-10-04T20:08:07.521Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Garantex","sections":[{"content":"Garantex was a virtual currency exchange that began operating in April 2019. It was originally registered in Estonia but conducted the bulk of its business from Moscow's Federation Tower and from St. Petersburg, Russia. According to the U.S. Department of the Treasury, Estonia's Financial Intelligence Unit revoked Garantex's operating license in February 2022 after finding serious anti-money-laundering deficiencies and links to wallets associated with criminal activity; Garantex allegedly continued operating despite the loss of its license. The U.S. Department of Justice has alleged that Garantex processed at least $96 billion in cryptocurrency transactions between 2019 and its shutdown in 2025, and Treasury has separately stated that over $100 million of identified Garantex transactions were tied to illicit actors and darknet markets.","heading":"Origins and Operations","severity":"high","sources":[{"credibility":1,"name":"Treasury Sanctions Russia-Based Hydra and Garantex (2022 press release)","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/jy0701"},{"credibility":1,"name":"DOJ: Garantex cryptocurrency exchange disrupted in international operation","type":"court_filing","url":"https://www.justice.gov/opa/pr/garantex-cryptocurrency-exchange-disrupted-international-operation"}]},{"content":"On April 5, 2022, OFAC designated Garantex alongside the Hydra darknet market under Executive Order 14024, describing Garantex as a \"ransomware-enabling virtual currency exchange.\" Treasury stated that known Garantex transactions included approximately $6 million connected to the Conti ransomware group and roughly $2.6 million connected to Hydra. On August 14, 2025, OFAC re-designated Garantex Europe OU and separately sanctioned its alleged successor, Grinex, along with three individuals described as Garantex co-founders or executives — Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky — plus several associated entities, including InDeFi Bank, Exved, A7 Limited Liability Company and its subsidiaries, and the Kyrgyzstani firm Old Vector. Treasury alleged Garantex-linked infrastructure had laundered proceeds tied to ransomware variants including Conti, Black Basta, LockBit, NetWalker, and Phoenix Cryptolocker.","heading":"U.S. Treasury (OFAC) Sanctions — 2022 and 2025","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Russia-Based Hydra and Garantex (2022 press release)","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/jy0701"},{"credibility":1,"name":"Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0225"},{"credibility":2,"name":"US Treasury's OFAC sanctions crypto exchange Garantex for second time","type":"news_article","url":"https://cointelegraph.com/news/us-treasury-ofac-sanctions-garantex-europe"}]},{"content":"On March 6, 2025, a coalition of law enforcement agencies — including the U.S. Secret Service, FBI, and DOJ's Criminal Division, alongside Germany's Federal Criminal Police Office, the Frankfurt General Prosecutor's Office, Dutch National Police, Estonian National Criminal Police, Finnish National Bureau of Investigation, and Europol — seized three domain names associated with Garantex (garantex.org, garantex.io, and garantex.academy) and seized servers located in Germany and Finland, freezing more than $26 million in cryptocurrency. The DOJ publicly announced the operation on March 7, 2025, alongside the unsealing of criminal charges against Aleksej Besciokov, a Lithuanian national described as Garantex's primary technical administrator, and Aleksandr Mira Serda, a Russian national and co-founder who was reportedly arrested while on vacation in India. Both were charged with conspiracy to commit money laundering (maximum 20 years); Besciokov was additionally charged with conspiracy to violate the International Emergency Economic Powers Act and conspiracy to operate an unlicensed money-transmitting business. The U.S. State Department subsequently offered rewards of up to $6 million for information leading to the arrest or conviction of Garantex's leaders.","heading":"Criminal Charges and Law Enforcement Shutdown (March 2025)","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Garantex cryptocurrency exchange disrupted in international operation","type":"court_filing","url":"https://www.justice.gov/opa/pr/garantex-cryptocurrency-exchange-disrupted-international-operation"},{"credibility":2,"name":"Sanctioned Russian Crypto Exchange Garantex Seized, Operators Charged With Money Laundering","type":"news_article","url":"https://www.coindesk.com/policy/2025/03/07/sanctioned-russian-crypto-exchange-garantex-seized-operators-charged-with-money-laundering"},{"credibility":2,"name":"US, European law enforcement seize Russian crypto exchange Garantex and indict 2 administrators","type":"news_article","url":"https://therecord.media/garantex-crypto-exchange-taken-down-law-enforcement-operation"}]},{"content":"The European Union sanctioned Garantex for the first time via Council Implementing Regulation (EU) 2025/389 of 24 February 2025, part of the EU's 16th sanctions package over Russia's war against Ukraine, which added 48 individuals and 35 entities in total. The EU cited Garantex's close association with EU-sanctioned Russian banks; it marked the Council's first designation of a cryptocurrency exchange. Investigative reporting by the International Consortium of Investigative Journalists has alleged Garantex had further connections to a Moscow organized-crime figure, the Kremlin-linked oil company Rosneft, and was allegedly used by groups including Hezbollah and drug trafficking networks operating in Ukraine; these specific allegations are attributed to ICIJ's reporting and have not been independently verified here.","heading":"European Union Sanctions","severity":"high","sources":[{"credibility":1,"name":"EU sanctions Russian crypto exchange Garantex","type":"news_article","url":"https://www.icij.org/inside-icij/2025/03/e-u-sanctions-russian-crypto-exchange-garantex/"},{"credibility":2,"name":"EU sanctions Russian crypto exchange Garantex over Ukraine conflict ties","type":"news_article","url":"https://cryptoslate.com/eu-sanctions-russian-crypto-exchange-garantex-over-ukraine-conflict-ties/"}]},{"content":"Blockchain analytics firms have alleged that Garantex's operators prepared a successor platform, Grinex, in advance of law enforcement action. According to TRM Labs, Grinex was incorporated in Kyrgyzstan in December 2024, before the March 2025 seizure of Garantex's infrastructure, and launched within days of the takedown, allegedly replicating Garantex's interface and recruiting former Garantex clients. Swiss blockchain analytics firm Global Ledger reported that Garantex's holdings of a ruble-pegged stablecoin, A7A5, were transferred to Grinex-controlled wallets, and that Garantex founder Sergey Mendeleev announced Grinex's creation on Telegram using \"crying laughing\" emojis, which the firm characterized as evidence the resemblance was deliberate. Global Ledger also reported accounts of former Garantex users visiting company offices in Europe and the Middle East to move funds to Grinex, and that Grinex reportedly reached roughly $40 million in trading volume within two weeks of launch. At the time of that reporting, larger analytics firms Chainalysis and TRM Labs had not yet independently confirmed Global Ledger's specific findings, though TRM Labs' own subsequent research separately identified Grinex as Garantex's successor. The U.S. Treasury's August 2025 sanctions action formally designated Grinex as an alleged successor to Garantex. Grinex is tracked separately in this system as its own entity.","heading":"Alleged Migration to Successor Exchange Grinex","severity":"critical","sources":[{"credibility":2,"name":"Shuttered Russian Crypto Exchange Garantex Rebrands as Grinex, Global Ledger Finds","type":"news_article","url":"https://www.coindesk.com/policy/2025/03/21/shuttered-russian-crypto-exchange-garantex-rebrands-as-grinex-global-ledger-finds"},{"credibility":2,"name":"Garantex, Grinex, and the A7A5 Token: A Deep Dive into Sanctions Evasion Networks","type":"research","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":1,"name":"Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0225"}]},{"content":"TRM Labs has alleged that a ruble-pegged digital token called A7A5, issued by the Kyrgyzstani firm Old Vector, was used to help move and recover customer funds frozen in the Garantex takedown, with on-chain analysis reportedly showing Garantex-linked wallets moving funds into A7A5 starting in January 2025. The token and related entities — A7 Limited Liability Company and its subsidiaries — have been linked by researchers to Moldovan oligarch Ilan Shor, who is separately under Western sanctions, and to the Russian bank Promsvyazbank. TRM Labs further alleged that at one point Garantex handled more than seventy percent of cryptocurrency volume flowing to and from already-sanctioned entities, underscoring its alleged centrality to Russian sanctions-evasion activity. These attributions rely on blockchain-analytics research rather than court findings and should be treated as allegations.","heading":"A7A5 Token and Broader Sanctions-Evasion Network","severity":"high","sources":[{"credibility":2,"name":"Garantex, Grinex, and the A7A5 Token: A Deep Dive into Sanctions Evasion Networks","type":"research","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":2,"name":"U.S. Sanctions Garantex and Grinex Over $100M in Ransomware-Linked Illicit Crypto Transactions","type":"news_article","url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"}]},{"content":"On October 2, 2026, Japan's Ministry of Foreign Affairs added Garantex (operating as Garantex Europe OU) to an asset-freeze list as part of a package covering 33 entities, 9 individuals, and 35 vessels linked to Russia's war against Ukraine, implemented under Japan's Foreign Exchange and Foreign Trade Act following a Cabinet decision. Garantex was reported to be the sole cryptocurrency exchange included in that package. Reporting noted that Garantex had already been sanctioned by the United States and the European Union, and that Japan's action extended the exchange's multilateral sanctions exposure. Commentary accompanying the coverage observed that entities such as Garantex \"appear to prepare contingency plans well in advance of anticipated enforcement measures,\" a reference to the exchange's alleged migration to Grinex after the 2025 U.S.-led shutdown.","heading":"Japan Sanctions (October 2026)","severity":"high","sources":[{"credibility":2,"name":"Japan sanctions Garantex among 33 Russian entities","type":"news_article","url":"https://crypto.news/japan-sanctions-garantex-among-33-russian-entities/"},{"credibility":2,"name":"Japan expands Russia sanctions over Ukraine war, adds Garantex to list","type":"news_article","url":"https://cointelegraph.com/news/japan-adds-garantex-to-list-of-russia-sanctions-over-ukraine-war"},{"credibility":2,"name":"Japan sanctions Garantex, freezing assets of exchange tied to $96B in crypto transactions","type":"news_article","url":"https://cryptobriefing.com/japan-sanctions-garantex-crypto-exchange/"}]}],"sources_used":[{"credibility":1,"name":"Treasury Sanctions Russia-Based Hydra and Garantex (2022 press release)","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/jy0701"},{"credibility":1,"name":"Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0225"},{"credibility":1,"name":"DOJ: Garantex cryptocurrency exchange disrupted in international operation","type":"court_filing","url":"https://www.justice.gov/opa/pr/garantex-cryptocurrency-exchange-disrupted-international-operation"},{"credibility":2,"name":"Sanctioned Russian Crypto Exchange Garantex Seized, Operators Charged With Money Laundering","type":"news_article","url":"https://www.coindesk.com/policy/2025/03/07/sanctioned-russian-crypto-exchange-garantex-seized-operators-charged-with-money-laundering"},{"credibility":2,"name":"Shuttered Russian Crypto Exchange Garantex Rebrands as Grinex, Global Ledger Finds","type":"news_article","url":"https://www.coindesk.com/policy/2025/03/21/shuttered-russian-crypto-exchange-garantex-rebrands-as-grinex-global-ledger-finds"},{"credibility":2,"name":"US, European law enforcement seize Russian crypto exchange Garantex and indict 2 administrators","type":"news_article","url":"https://therecord.media/garantex-crypto-exchange-taken-down-law-enforcement-operation"},{"credibility":2,"name":"US Treasury's OFAC sanctions crypto exchange Garantex for second time","type":"news_article","url":"https://cointelegraph.com/news/us-treasury-ofac-sanctions-garantex-europe"},{"credibility":1,"name":"EU sanctions Russian crypto exchange Garantex","type":"news_article","url":"https://www.icij.org/inside-icij/2025/03/e-u-sanctions-russian-crypto-exchange-garantex/"},{"credibility":2,"name":"EU sanctions Russian crypto exchange Garantex over Ukraine conflict ties","type":"news_article","url":"https://cryptoslate.com/eu-sanctions-russian-crypto-exchange-garantex-over-ukraine-conflict-ties/"},{"credibility":2,"name":"Garantex, Grinex, and the A7A5 Token: A Deep Dive into Sanctions Evasion Networks","type":"research","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":2,"name":"U.S. Sanctions Garantex and Grinex Over $100M in Ransomware-Linked Illicit Crypto Transactions","type":"news_article","url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"credibility":2,"name":"Japan sanctions Garantex among 33 Russian entities","type":"news_article","url":"https://crypto.news/japan-sanctions-garantex-among-33-russian-entities/"},{"credibility":2,"name":"Japan expands Russia sanctions over Ukraine war, adds Garantex to list","type":"news_article","url":"https://cointelegraph.com/news/japan-adds-garantex-to-list-of-russia-sanctions-over-ukraine-war"},{"credibility":2,"name":"Japan sanctions Garantex, freezing assets of exchange tied to $96B in crypto transactions","type":"news_article","url":"https://cryptobriefing.com/japan-sanctions-garantex-crypto-exchange/"}],"summary":"Garantex was a Russia-based cryptocurrency exchange, founded in 2019 and formally registered in Estonia, that U.S. authorities allege processed more than $96 billion in transactions before it was seized in a March 2025 multinational law enforcement operation. The exchange and its operators have been sanctioned by the United States (2022 and 2025), the European Union (2025), and Japan (2026) for allegedly facilitating ransomware payments, darknet market proceeds, and sanctions evasion, and its founders are alleged to have migrated customers and funds to a successor platform, Grinex, within days of the shutdown.","timeline":[{"date":"2019-04","event":"Garantex begins operating as a cryptocurrency exchange, registered in Estonia with operations run from Moscow and St. Petersburg.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/jy0701"},{"date":"2022-02","event":"Estonia's Financial Intelligence Unit revokes Garantex's operating license after finding anti-money-laundering deficiencies and links to criminal wallets; Garantex allegedly continues operating regardless.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/jy0701"},{"date":"2022-04-05","date_evidence":"April 5, 2022","event":"OFAC sanctions Garantex and the Hydra darknet market under Executive Order 14024.","source":"U.S. Department of the Treasury press release","source_url":"https://home.treasury.gov/news/press-releases/jy0701"},{"date":"2024-12","event":"Grinex, later alleged to be Garantex's successor, is incorporated in Kyrgyzstan, months before Garantex's seizure.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"date":"2025-02-24","date_evidence":"Council Implementing Regulation (EU) 2025/389 of 24 February 2025","event":"The European Union sanctions Garantex for the first time as part of its 16th Russia sanctions package.","source":"ICIJ / Council of the EU","source_url":"https://www.icij.org/inside-icij/2025/03/e-u-sanctions-russian-crypto-exchange-garantex/"},{"date":"2025-03","date_evidence":"On Thursday, a coalition of law enforcement agencies from the U.S., Germany and Finland seized Garantex's domains and servers","date_original":"2025-03-06","event":"A multinational law enforcement coalition seizes Garantex's domain names and servers, freezing more than $26 million in cryptocurrency.","source":"CoinDesk / U.S. Department of Justice","source_url":"https://www.coindesk.com/policy/2025/03/07/sanctioned-russian-crypto-exchange-garantex-seized-operators-charged-with-money-laundering"},{"date":"2025-03","date_evidence":"has been taken down in an international law enforcement operation, according to a Friday announcement from the U.S. Department of Justice (DOJ)","date_original":"2025-03-07","event":"DOJ publicly announces the Garantex takedown and unseals criminal money-laundering charges against Aleksej Besciokov and Aleksandr Mira Serda.","source":"U.S. Department of Justice","source_url":"https://www.justice.gov/opa/pr/garantex-cryptocurrency-exchange-disrupted-international-operation"},{"date":"2025-03","event":"Grinex launches as an alleged successor exchange within days of Garantex's shutdown, allegedly replicating its interface and absorbing former customers and funds.","source":"CoinDesk, citing Global Ledger","source_url":"https://www.coindesk.com/policy/2025/03/21/shuttered-russian-crypto-exchange-garantex-rebrands-as-grinex-global-ledger-finds"},{"date":"2025-08-14","date_evidence":"August 14, 2025","event":"OFAC re-designates Garantex Europe OU and separately sanctions successor exchange Grinex, three named executives, and several associated entities including A7 LLC and Old Vector.","source":"U.S. Department of the Treasury press release","source_url":"https://home.treasury.gov/news/press-releases/sb0225"},{"date":"2026-10","date_evidence":"Japan has sanctioned Russian crypto exchange Garantex as one of 33 entities added to a new asset-freeze list on Oct. 2","date_original":"2026-10-02","event":"Japan's Ministry of Foreign Affairs adds Garantex to an asset-freeze list covering 33 entities, 9 individuals, and 35 vessels linked to Russia.","source":"Cryptobriefing / crypto.news","source_url":"https://cryptobriefing.com/japan-sanctions-garantex-crypto-exchange/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ccfa2260-cbbf-47fb-bbdb-d151d612bb95copy