Garantex Moves $15 Million in Crypto Despite US Sanctions

Despite the United States-led freeze of $26 million in Tether (USDT) assets tied to the sanctioned Russian crypto exchange Garantex, a new investigation suggests that the enforcement action may have only scratched the surface. According to a report from blockchain analytics firm Global Ledger, more than $15 million in additional reserves remain untouched across Ethereum, Bitcoin, and BNB Chain networks. These assets appear to be active, and in some cases, already on the move.

Garantex’s exposure extends beyond USDT to include Bitcoin (BTC), Ethereum (ETH), and a range of other tokens, including ERC-20, BEP-20, and a ruble-pegged stablecoin called A7A5. The sanctions freeze, coordinated with Germany and Finland, took place over three days in early March. On March 6, Garantex publicly acknowledged the enforcement action. That same day, an Ethereum wallet linked to Garantex suddenly came back online, aggregating 3,265 ETH or roughly $8.6 million. The laundering began shortly after, with more than $2.25 million worth of ETH gradually routed through Tornado Cash, an Ethereum-based mixing protocol, between May 22 and June 4.

The activity didn’t stop there. On May 30, 206 ETH — about $280,000 — was mixed through Tornado Cash. Just days later, on June 4, another 30 ETH was sent through. As of that date, the wallet still held over 2,334 ETH, or roughly $6.1 million. These patterns strongly suggest an intentional money laundering effort to obscure links to Garantex. The activity is ongoing, with real-time alerts continuing to track fresh outflows from this same reserve.

The situation with Bitcoin was strikingly similar. In early March, Global Ledger identified an aggregation of 19.39 BTC, again from dormant addresses. Over the next few weeks, that number grew to 30.04 BTC, worth about $3.17 million. Some of that Bitcoin didn’t stay on the same chain for long. In early May, 2.2 BTC was bridged to the TRON (TRX) network and partially sent to Grinex, a suspected successor to Garantex. According to Global Ledger CEO Lex Fisun, the move to TRON likely reflects a calculated decision to take advantage of the network’s speed and low cost. “TRON is cheap, liquid, and fast,” Fisun said. “If your end goal is to swap BTC into stablecoins, bridging straight into the chain that already dominates those flows is the path of least resistance.”

Whether or not Grinex is acting as the successor to the sanctioned exchange remains to be confirmed, but Global Ledger doesn’t appear to have much doubt. The firm noted that all of Garantex’s assets were immediately withdrawn after the March freeze and sent directly to Grinex-linked wallets. The BNB Chain also played a quiet but curious role. Unlike Ethereum or TRON, BNB Chain doesn’t support Tether. That means Tether has no power to freeze assets there. As it turns out, funds on BNB Chain stopped moving the same day Garantex announced its suspension: March 6. But there were no burns, no swaps, and no withdrawals. As of June, Global Ledger estimates the BNB-based reserves at around $4 million, still unspent.

Fisun noted that this creates a strategic blind spot for sanctions enforcement. “There’s no ‘big red button,’ so enforcement on BNB Chain relies on off-chain actors,” he said, pointing out that in practice, freezing assets on BNB Chain is slower and more uncertain. “It took nearly two years with the PopcornSwap scam,” Fisun emphasized. The Global Ledger CEO also added that while BNB Chain is more opaque, its limited share of dollar-pegged stablecoins makes it less critical overall. “[…] only about $5 billion in USDT circulates on BNB Chain versus $73.8 billion on TRON. Also, using BNB Chain requires an extra wrapping/bridging step that traders and bad actors would rather skip when TRON already offers deeper books and zero fees.”

All told, the analytics firm estimates that at least $15 million in Garantex-linked crypto remains outside U.S. enforcement reach. And that figure doesn’t include any new tokens or potential stealth wallets that haven’t been traced yet. It’s not just about the numbers. The bigger concern might be what these patterns represent: a loophole in multi-chain enforcement. While token-level freezes — like the one imposed on Tether — can be effective on paper, they’re far less useful when entities move assets between chains, or into stablecoins not issued by U.S.-based companies. As Global Ledger says, Garantex’s “on-chain manoeuvring underscores the growing challenge of enforcing asset freezes.”

When asked about USDC exposure, Fisun said Global Ledger had tracked assets that moved just before the freeze. “The blocked Garantex wallets still hold 73,283 USDC,” he said, adding that on March 4, more than 290,000 USDC went from “blocked Ethereum wallets to one of the top 10 exchanges’ deposit addresses.” He added that smaller holdings might have flown under the radar, noting that the likely reason the addresses weren’t frozen was the relatively small balances involved, and that it may have simply come down to the numbers.