Investigators uncover “crypto laundromat” as Garantex successors funnel billions abroad

From Moscow to Dubai, the blacklisted crypto exchange transformed into Exved, MKAN Coin, and Grinex, channelling billions through offshore networks and Telegram channels despite global crackdowns.

A sanctioned Russian cryptocurrency network has reappeared under new names, transferring billions of dollars through banks and offshore intermediaries despite raids and international sanctions, according to an investigation published Wednesday by Transparency International Russia in Exile and OCCRP.

The report states that Moscow-based Garantex, blacklisted by the U.S. Treasury in 2022 and stripped of its license by Estonian regulators, processed about $96 billion between 2019 and 2025, with at least $1.3 billion linked to criminal activity, citing data from blockchain analytics firm Chainalysis. Law enforcement raids in March 2025 targeted its servers and domains, but successor platforms surfaced within weeks. The U.S. Justice Department announced indictments against its administrators, and Indian authorities arrested a system administrator at Washington’s request.

One successor, Exved, is led by Garantex co-founder Sergey Mendeleev. Although officially registered as a domestic “payment facilitator,” Exved operates from Moscow City, allowing Russian clients to pay in rubles while foreign partners receive hard currency or stablecoins abroad. Investigators posing as traders in Hong Kong found the onboarding process required only minimal documents. Transactions were routed through Paysol, a Russian-registered company acting as Exved’s “agent.”

Chats with Exved representatives explained how the scheme works: rubles are sent to the Russian bank account of a foreign-registered intermediary, such as a Hong Kong shell company. Offshore, the intermediary then forwards equivalent sums in U.S. dollars, yuan, or USDT [Tether stablecoin] to the foreign supplier. Contracts make no mention of cryptocurrency. “No bank will know. It is visible only between us,” one agent said.

The structure makes funds appear legitimate within Russia’s banking system while being converted abroad. Exved charges a three percent commission for transfers above $50,000. Russian banks including T-Bank and Expobank were cited as "working banks" for ruble-side payments. Foreign banks in Hong Kong, such as J.P. Morgan, Deutsche Bank, and Bank of China, were also mentioned as conduits.

Investigators say Exved’s network has been used to purchase dual-use goods such as microprocessors and telecom equipment from China and Taiwan. Paysol’s legal staff acknowledged that clients often bring in restricted items and that invoices can be adjusted to avoid customs scrutiny.

Blockchain analysis showed that wallets linked to Exved and Paysol were directly connected to sanctioned Garantex addresses. One wallet processed more than $112 million, including $234,000 from Garantex Europe on December 25, 2024, followed weeks later by a $2.6 million transfer to Paysol. Some funds later returned to Garantex, a common “layering” tactic in which illicit money is cycled through multiple transactions to disguise its origin and complicate tracing.

Other successors followed. MKAN Coin emerged in Dubai, Kyrgyzstan, Brazil, Spain, and Thailand, offering Russians Telegram-based crypto-to-cash services. It was run by former Garantex executive Mohammad Khalifa. Dubai regulators shut MKAN down in 2024, but Kyrgyz authorities later added affiliated entities to their money-laundering blacklist.

After MKAN’s closure, a new exchange called Grinex appeared in 2025. Analysts at TRM Labs and Global Ledger found strong ties to Garantex’s infrastructure, including wallets and bots. Grinex also launched a ruble-pegged stablecoin, A7A5, backed by accounts at Promsvyazbank, a sanctioned state-controlled bank. Within four months, A7A5 processed $9.3 billion.

In August 2025, the U.S. Treasury expanded sanctions to include Exved, Grinex, and InDeFi Bank, along with executives Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky. Days later, the U.K. announced its own measures, specifically highlighting the A7A5 token.

The investigation also details the individuals behind the networks. One is Sergey Kunitsa, head of Paysol and former head of a customs brokerage firm. Another is Aleksandr Mira Serda, also known as Ntifo-Siao, who remains active despite U.S. indictments. Public records show he bought a $3 million villa in Dubai and obtained a new Russian birth certificate listing a deceased Spanish citizen as his father.

Throughout, investigators said, Telegram remains the backbone of operations. From onboarding to contracts, everything is handled in private chats and bots. “Telegram has become the central operating layer,” investigators concluded.

Despite sanctions and raids, the report states the network continues to adapt. Investigators describe it as a “crypto laundromat”: decentralized, opaque, and resilient. Instead of centralized exchanges, the system now relies on offshore intermediaries, encrypted channels, and state tolerance.