When Russia was cut off from the global banking system after its invasion of Ukraine, cryptocurrency became one of the few lifelines for moving money in and out of the country. But what started as a workaround turned into a high-stakes game of cat-and-mouse between Russian operators and U.S. enforcement agencies. By 2026, the battle over crypto access had reshaped how sanctions work - and who can still use digital assets.
Garantex: The First Target
Garantex wasn’t just another crypto exchange. It was the largest platform in Russia for trading fiat-to-crypto and crypto-to-crypto, handling over $1 billion in monthly volume by 2021. Founded in 2018 by Sergey Mendelev, Aleksandr Mira Serda, and Pavel Karavatsky, it became the go-to service for Russians who couldn’t use Western banks or PayPal. Unlike exchanges that kept strict KYC rules, Garantex allowed anonymous registrations, peer-to-peer trades, and direct ruble deposits through shell companies in Armenia and Kazakhstan. The U.S. Treasury’s Office of Foreign Assets Control (OFAC) first hit Garantex on April 5, 2022, under Executive Order 14024. The official reason? Operating in the financial services sector of the Russian economy. But deeper investigations revealed something more alarming: Garantex was laundering ransomware payments. Between 2019 and 2022, it processed over $100 million in funds tied to LockBit, Conti, and Hive ransomware groups. Blockchain analytics firm Elliptic traced these flows using wallet clustering and transaction graphing, identifying patterns that matched known cybercriminal addresses. By early 2025, the U.S. Secret Service had built a case strong enough to act. On March 6, 2025, agents coordinated a global takedown. Three Garantex domains were seized. Servers in Latvia and Georgia were raided. Over $26 million in USDT was frozen. And Aleksej Besciokov, one of the co-founders, was arrested while vacationing in India - a rare example of an overseas crypto executive being detained on U.S. charges.Grinex: The Replacement That Didn’t Last
Garantex didn’t shut down. It rebooted. Within 48 hours of the March 2025 raids, its engineers launched Grinex. The website even had a banner: "Formed in response to sanctions and asset freezes that affected Garantex." It wasn’t subtle. Grinex kept the same leadership team, the same technical stack, and the same user base. Its only change? A new name and a new token: A7A5. A7A5 was designed to replace USDT. Unlike Tether, which can freeze wallets at the U.S. government’s request, A7A5 was a ruble-backed stablecoin issued by a Kyrgyzstani firm with no ties to Western regulators. It ran on the TRON network, making transactions faster and cheaper than Ethereum. Russian users flocked to it. By June 2025, Grinex was processing over $500 million per month - almost matching Garantex’s peak. But OFAC wasn’t fooled. On August 14, 2025, they designated Grinex under Executive Order 13694, which targets cyber-enabled financial crimes. The designation didn’t just block Grinex - it froze the personal assets of Mendelev, Serda, and Karavatsky. It also sanctioned six companies linked to them across Russia and Kyrgyzstan. The U.S. State Department added a $5 million reward for information leading to Serda’s arrest.The A7 Network: A $8 Billion Underground System
Grinex wasn’t alone. It was part of a much larger network called the A7 ecosystem. This included A7, A71, A7 Agent, InDeFi Bank, Exved, and Old Vector - all interconnected platforms that shared infrastructure, users, and the A7A5 token. Elliptic’s August 2025 report showed that since January 2024, over $8 billion had flowed through wallets linked to these A7 entities. That number is likely higher. Many wallets were hidden behind layered mixers and decentralized bridges. But the same techniques that exposed Garantex were used to trace A7A5. The stablecoin’s issuance was centralized - controlled by a single issuer in Bishkek. That became its weakness. In mid-2025, a security breach exposed private keys used to mint A7A5. Elliptic noticed strange spikes in transaction volume on August 14, 2025 - the same day OFAC announced Grinex’s sanctions. The timing wasn’t a coincidence. The A7 team scrambled to rotate keys and migrate funds. But the damage was done. The U.S. government now had a map of the entire network.
Why USDT Failed and A7A5 Tried
Russian users didn’t turn to crypto because they loved decentralization. They turned to it because the ruble was unstable and banks were cut off from SWIFT. USDT was the default choice - stable, liquid, and widely accepted. But when Garantex was taken offline, users realized USDT could be frozen by Tether’s operators - who answer to U.S. regulators. A7A5 was built to fix that. It was pegged 1:1 to the ruble. It didn’t have a U.S.-based issuer. It didn’t have a corporate headquarters. It was designed to be untraceable. But it wasn’t. The same blockchain transparency that makes crypto revolutionary also makes it vulnerable. Every transaction leaves a fingerprint. And with enough data, even the most hidden wallets can be exposed.What This Means for Users Today
If you’re in Russia or any sanctioned country, accessing crypto exchanges is harder than ever. Major platforms like Binance and Kraken have long since cut off Russian users. Smaller exchanges that remained open - like Garantex and Grinex - are now blocked or under investigation. The A7 network is still active, but it’s shrinking. Wallets linked to A7A5 are now flagged by major blockchain explorers. Exchanges that once accepted it now reject it. Even peer-to-peer traders are wary - selling A7A5 could mean getting flagged by regulators. The lesson is clear: no crypto asset is truly immune to sanctions. If it’s tied to a centralized issuer, a known team, or a jurisdiction under pressure, it becomes a target. The days of using crypto as a free pass around sanctions are over.
How Enforcement Got Smarter
This isn’t just about seizing wallets. It’s about dismantling entire ecosystems. The U.S. didn’t just sanction Garantex. They went after its founders, its successor, its token issuer, its supporting companies, and its financial network. They used private sector analytics (Elliptic), international law enforcement (Secret Service), and financial rewards (State Department) in one coordinated push. It’s a new model: blockchain intelligence + global arrests + asset freezes + public pressure. This approach is being copied in other regions. The EU is now building its own crypto tracking unit. The UK has started freezing crypto assets tied to Iranian and North Korean networks. For users, this means two things: first, if you’re trying to bypass sanctions, you’re not just risking your money - you’re risking your freedom. Second, if you’re just trying to hold crypto, you need to know which assets are flagged - and which are still usable.What’s Next?
The next wave of evasion might involve decentralized stablecoins - ones without any issuer at all. Or it could mean using privacy coins like Monero or Zcash. But even those aren’t safe. In 2025, Chainalysis added Monero tracing to its platform. It’s not perfect - but it’s getting better. One thing is certain: sanctions are no longer just about banks and wire transfers. They’re about code. About wallets. About who controls the keys. And if you’re on the wrong side of that line, there’s no hiding anymore.Can Russians still use crypto exchanges today?
Yes - but only on a very limited scale. Major global exchanges like Binance, Coinbase, and Kraken have blocked Russian users since 2022. Smaller platforms tied to the A7 network still operate, but they’re under constant surveillance. Transactions involving A7A5 or Grinex are now flagged by most blockchain analytics tools. Any attempt to deposit or withdraw funds from these services risks freezing assets or triggering regulatory alerts.
Why was Garantex targeted instead of other Russian exchanges?
Garantex was the largest and most active exchange linked to ransomware payments. Elliptic’s data showed it processed over $100 million in cybercriminal funds between 2019 and 2022. Other exchanges were smaller or less involved in illicit flows. The U.S. chose Garantex because it was the most visible and profitable node in the network - taking it down had the biggest impact.
Is A7A5 still usable in 2026?
A7A5 is technically still on the TRON and Ethereum blockchains, but it’s effectively unusable for most users. Wallets holding A7A5 are now marked as high-risk by major crypto platforms. Exchanges refuse to list it. Peer-to-peer traders avoid it. Even decentralized bridges block transfers from A7-linked addresses. Its value has dropped over 70% since the August 2025 sanctions due to lack of liquidity and trust.
Can the U.S. freeze crypto wallets outside its borders?
Yes - if the wallet uses a service or infrastructure tied to the U.S. financial system. Most major blockchains (like Ethereum and TRON) rely on U.S.-based nodes, wallet providers, or analytics firms. When OFAC designates a wallet, companies like Chainalysis or Elliptic flag it. Exchanges and custodians then freeze those addresses to avoid legal liability. Even if the wallet is in Russia, it’s still frozen if it interacts with a U.S.-connected system.
What happened to the founders of Garantex and Grinex?
One co-founder, Aleksej Besciokov, was arrested in India in March 2025 and is currently awaiting extradition to the U.S. The other two, Sergey Mendelev and Aleksandr Mira Serda, are believed to be in Russia or Kyrgyzstan. Both are under U.S. sanctions, with a $5 million reward offered for Serda’s capture. Their personal assets - including crypto, real estate, and bank accounts - have been frozen globally.