A Russian cryptocurrency exchange continues to flourish in the shadows, relying on offshore financial hubs and other cryptocurrency platforms to transfer client funds while evading Western sanctions, according to a new report from the Russian branch of Transparency International.
The investigation, published earlier this month, exposes more of the infrastructure underpinning Garantex, which ICIJ has previously reported on, and Grinex, another cryptocurrency platform purported by the U.S. Treasury Department to be Garantex’s successor.
Garantex was sanctioned by the Treasury’s Office of Foreign Assets Control in 2022 for processing tens of millions of dollars in transactions linked to illicit activity. The exchange, registered in Estonia in 2019, helped move money for a Russian ransomware-as-a-service operation and one of the world’s largest darknet marketplaces, according to OFAC. Garantax also permitted a notorious cryptocurrency launderer to transfer money across international borders for Russian elites.
The report, by Transparency International Russia (in exile), details how the sanctioned exchange has morphed into a decentralized money laundering system supported by two entities that have until now evaded scrutiny from global regulators and researchers: Exved, a cross-border payment processing platform aimed in part at facilitating the import of dual-use goods into Russia, and MKAN Coin, a Telegram-based crypto exchange operating out of Dubai that replicates Garantex’s core functions.
“Every time regulators cut off one ‘head’ of this crypto hydra, another appears under a new name,” the report’s author, Kristine Baghdasaryan, said in a news release for the report. “Our findings show that Garantex did not disappear; it reorganised into a distributed system that hides crypto activity behind agency contracts, offshore legs, and Telegram-based workflows.”
Three years after the U.S. sanctioned Garantex, the European Union followed, citing its close associations with Russian banks. The U.S. Secret Service, the Department of Justice and an international group of law enforcement bodies seized Garantex’s digital infrastructure in March and the U.S. unsealed an indictment against the exchange’s operators, Aleksej Besciokov and Aleksandr Mira Serda.
Besciokov, a Lithuanian national and Russian resident in his mid-40s, was subsequently arrested in India awaiting extradition to the U.S. But before he could be tried, Besciokov died in custody at the end of August, his lawyer, Ashish Panday, confirmed to ICIJ. Panday told ICIJ Besciokov died in the morning of Aug. 31 from a heart attack while in custody at the Tihar Jail in Delhi, one of the largest prison complexes in the world.
Sergey Mendeleev, an alleged central figure in the Garantex structure, mourned Besciokov in a Telegram post. The director general and additional inspector general for the central jail did not respond to a request for comment. The U.S. Attorney’s Office for the Eastern District of Virginia, the court where the indictment was filed, declined to comment.
After the crackdown further tightened the exchange’s access to global financial markets and cross-border payment mechanisms, Treasury reported Garantex moved its operations to a successor platform, Grinex, a virtual asset service provider registered in Kyrgyzstan. A June investigation by The Financial Times into a rouble-pegged stablecoin, A7A5, found Grinex had moved billions of dollars worth of cryptocurrency in spite of sanctions.
In turn, OFAC sanctioned Grinex, Exved, Mendeleev and the company that created the A7A5 token, and the State Department announced a $5 million bounty for information that would lead to the arrest of Mira Serda, the second Garantex administrator in August.
Two actors identified in TI Russia report
Transparency International Russia’s report details how Exved allows users to convert fiat currency to a stablecoin, namely Tether’s USDT, before Exved moves the funds through payment processors nested in offshore jurisdictions like Hong Kong, Thailand and the United Arab Emirates to obscure its origin and destination. The researchers contacted Exved in October 2024 posing as a fake Hong Kong-based electronics exporter to gain insight into its operations.
Baghdasaryan, the report’s lead researcher and author, told ICIJ all of the communications with Exved were done through Telegram and that the onboarding process took just 30 minutes. Baghdasaryan’s research revealed that a separate company registered in Russia, Paysol LLC, would be acting as Exved’s “agent,” but that the actual service agreement would be signed with a Hong Kong-based firm, Feilian Company Limited, controlled by a Russian named Sergey Antipov.
“The arrangement worked as follows: our fictional Russian importer would transfer rubles to Feilian’s Alfa-Bank account in Russia,” the report reads. “The Hong Kong-based entity, Feilian, would then convert and forward the money to our fictitious Hong Kong-based exporter in dollars, yuan, or USDT.”
Before the mock transaction would be carried out, Baghdasaryan had a call with Paysol during which she asked about the company’s connections to Garantex and Exved, how customs would work with the importing of dual-use goods into Russia and which banks the company works with.
“They evaded these questions, for sure,” she said.
A compliance officer working with Paysol’s legal team told the Transparency International team during the call that, in order to avoid a bank flagging the transactions as possible sanctions violations, it was important to have “tailored documentation and logistics partners.” The officer also acknowledged that the payment process is used frequently to ease the process of importing restricted goods into Russia. The structure of Exved and its agent, Paysol, offers flexibility that allows for legitimate trade and import transactions aimed at skirting sanctions, the report found.
“Exved and its network do not directly forge documents,” Baghdasaryan stated in her report. “Rather, they enable and process payments based on sanitized invoices that may not reflect the actual goods.”
Paysol provided Transparency International Russia’s false Hong-Kong exporter company with a cryptocurrency wallet address that blockchain analysis showed had received funds from a sanctioned Garantex wallet. The wallet address provided to the researchers by Paysol had processed over $112 million across hundreds of inbound and outbound transactions.
After Baghdasaryan and other Transparency International Russia researchers completed their investigation into Exved earlier this year, the group discovered a site on the open web hosting a trove of leaked Garantex material, including hundreds of emails, internal documentation and chats, scanned identity verification documents, invoices and cryptocurrency transaction logs dated between 2021 and 2024. The discovery led the researchers to MKAN Coin, a Telegram-based crypto-to-cash exchange that serves Russians looking to move money out of the country.
“While the name was new, the infrastructure, personnel, bots, and behavior patterns were not,” the report on MKAN Coin reads. “MKAN Coin inherited and rebranded Garantex’s laundering blueprint, extending it into a decentralized, global network designed to survive sanctions and scrutiny.”
The exchange has branches across the world, in jurisdictions as varied as Kyrgyzstan, Spain, Brazil, Thailand and Georgia. According to the report, the leaked documents revealed that a former chief executive of Garantex was behind the MKAN Coin brand.
“[MKAN Coin] is a core product of Garantex,” Baghdasaryan said. “Crypto-to-cash through Telegram, to transfer money abroad, just like Garantex did.”