Shuttered Russian exchange Garantex has rebranded as Grinex, according to on-chain analysis from blockchain intelligence firm TRM Labs.
Garantex handled over $100 billion in transactions prior to its dismantling by international enforcement agencies in March of this year.
Yet analysis from UK-based TRM Labs suggests that Grinex has been onboarding Garantex users and redistributing their assets in the form of A7A5, a ruble-pegged stablecoin available on Tron and Ethereum.
Garantex wallet addresses began converting funds into the A7A5 stablecoin in January 2025, with Kyrgyz records documenting that the company behind the token, Old Vector, was registered as recently as December 13, 2024.
TRM Labs suggests that the sanctioned exchange was aware that it was at risk of being shut down, and that the creation of A7A5 was a means of evading sanctions and enabling its users to recover any assets that could end up being lost in the event of a takedown.
On-chain analysis reveals that large volumes of transfers involving A7A5 were made in January, in the weeks leading up to the U.S.-led enforcement action that dismantled Garantex.
Tellingly, TRM also cites how Garantex’s Telegram channels began promoting Grinex only a matter of days after it was taken down, with the new exchange registered in Kyrgyzstan on December 23, 2024.
The individuals involved in the registration of Grinex and A7A5 are apparent unknowns, with no evident or formal link to Garantex.
Grinex appears to have been registered by Duulat-eldar Sagynbeki Subankulov, who TRM Labs suggests may be a former professional gamer.
Meanwhile, Old Vector was registered by Tatyana Sergeevna Menshikova, who remains a complete unknown.
Yet for TRM Labs, the obscurity of these two individuals adds “another layer of ambiguity to Grinex’s origins.”
One thing that is known is Grinex’s user interface bears a “striking resemblance to Garantex,” while the platform has actually announced an agreement with sanctioned exchange to onboard its former customers and even hire its employees, doing so on the Telegram channel of the Garantex-linked Satoshkin group.
Elaborating on the links between the two platforms, TRM Labs told Decrypt that “Garantex has a unique on-chain fingerprint and Grinex uses this same fingerprint.”
Of particular significance is the fact that intermediary addresses, which “are associated with the transfer of funds out of Garantex,” were used to deposit funds (mostly in A7A) into Grinex client addresses.
On top of this, TRM Labs also told Decrypt that Garantex co-founder Sergey Mendeleev was “prominent in the announcement of Grinex’s launch,” which was posted on Telegram.
And it’s not only TRM Labs that believes Grinex is effectively Garantex 2.0, with Chainalysis also leaning in this direction.
“At Chainalysis, we’ve been monitoring the alleged links between Grinex and Garantex, and while we’re not ready to make a formal attribution just yet, we have seen signs that Grinex is likely to be the rebrand of Garantex,” said Head of National Security Intelligence Andrew Fierman, speaking to Decrypt.
Fierman explains that Chainalysis has received “multiple reports” of former Garantex users visiting the exchange’s offices, where they were able to transfer their funds directly to Grinex.
“There’s also been a Telegram post from a Garantex co-founder [Sergei Mendeleev] talking [about] the launch of Grinex, brushing off any platform similarities with laughing emojis,” he added.
At its peak, Garantex accounted for 82% of all crypto-currency volumes associated with sanctioned entities internationally, while even after it was sanctioned by OFAC in April 2022 it managed to handle 70% of such volumes.
And for Fierman, its apparent rebirth as Grinex raises serious questions about whether sanctions and shutdowns can ever be 100% effective in stamping out illicit cryptocurrency activity.
“The broader issue here is that rebranding has become a familiar tactic for sanctioned crypto entities; an issue we will be monitoring closely,” he said.
This issue is also underlined by other analysis from TRM Labs, which finds that two other Russia-linked exchanges (in addition to Grinex) have been capturing Garantex’s former volumes in recent months.
One of these is ABCEX, which is tied to Sergey Mendeleev and was Garantex’s third-largest on-chain counterparty, while the other is “high-risk exchange” Rapira.
Both of these platforms witnessed a surge in volume in March, when Garantex was taken down, and while ABCEX saw a dropoff in April, Rapira has continued to grow.
Edited by Stacy Elliott.
