Garantex Moves $15 Million in Crypto Despite Sanctions

Sanctioned Russian crypto exchange Garantex, despite having $26 million in Tether (USDT) assets frozen, still has an additional $15 million in crypto assets that remain active or untouched. This revelation comes from a report by blockchain analytics firm Global Ledger, which indicates that the enforcement action may have only scratched the surface of Garantex's operations.

The exchange, which was targeted in a coordinated freeze by the United States, Germany, and Finland in early March, has exposure to various cryptocurrencies beyond USDT. These include Bitcoin (BTC), Ethereum (ETH), and other tokens on ERC-20, BEP-20 networks, as well as a ruble-pegged stablecoin called A7A5. The sanctions freeze specifically targeted Garantex’s USDT holdings, but the exchange's broader crypto reserves have continued to move or remain active.

On March 6, Garantex publicly acknowledged the enforcement action. Interestingly, an Ethereum wallet linked to Garantex, which had been dormant for months, suddenly came back online that same day. This wallet began aggregating 3,265 ETH, worth roughly $8.6 million, and subsequently started laundering the funds. Between May 22 and June 4, over $2.25 million worth of ETH was gradually routed through Tornado Cash, an Ethereum-based mixing protocol, making it harder to trace. This activity suggests an intentional effort to obscure links to Garantex and continues to be monitored in real-time.

The situation with Bitcoin was similarly concerning. In early March, Global Ledger identified an aggregation of 19.39 BTC from dormant addresses, which grew to 30.04 BTC worth about $3.17 million over the following weeks. Some of this Bitcoin was bridged to the TRON (TRX) network and partially sent to Grinex, a suspected successor to Garantex. The move to TRON likely reflects a calculated decision to take advantage of the network’s speed and low cost, as transfers on TRON are cheaper and faster compared to Bitcoin or Ethereum.

Global Ledger CEO Lex Fisun noted that all of Garantex’s assets were immediately withdrawn after the March freeze and sent directly to Grinex-linked wallets. This raises questions about whether Grinex is acting as the successor to the sanctioned exchange. The BNB Chain also played a role, with funds stopping movement on March 6 but remaining unspent as of June, estimated at around $4 million. This creates a strategic blind spot for sanctions enforcement, as freezing assets on BNB Chain is slower and more uncertain.

Fisun emphasized that while BNB Chain is more opaque, its limited share of dollar-pegged stablecoins makes it less critical overall. The analytics firm estimates that at least $15 million in Garantex-linked crypto remains outside U.S. enforcement reach, not including any new tokens or potential stealth wallets that haven’t been traced yet. This situation highlights a loophole in multi-chain enforcement, where token-level freezes can be effective on paper but less useful when entities move assets between chains or into stablecoins not issued by U.S.-based companies.

Garantex’s on-chain maneuvers underscore the growing challenge of enforcing asset freezes. The exchange’s ability to move funds across different networks and stablecoins demonstrates the complexity of tracking and freezing crypto assets in a multi-chain environment. This case serves as a reminder of the need for more robust and coordinated enforcement strategies to effectively address the movement of crypto assets across different networks and stablecoins.