Treasury redesignates Garantex and its Grinex successor as the laundromat collapses
OFAC names three executives and a Kyrgyz-Russian shell network; Grinex then halts, blaming a 'Western special services' hack
Summary
On 16 April 2026 the Russia-linked exchange Grinex suspended operations, claiming over 1bn rubles in user funds were stolen and blaming "special services" of "unfriendly states." The collapse followed a US Treasury OFAC move redesignating Garantex, which processed over $100m in illicit transactions since 2019, laundering for the Conti Ransomware syndicate and the Hydra darknet market, and designating its Grinex successor, three executives and six shell companies in Russia and Kyrgyzstan. Investigators say Garantex officers moved customer deposits to Grinex within days of the March 2025 seizure, kept liquid by the ruble-pegged A7A5 token. The pattern, designate, rebrand, resume, is the core challenge.
By the numbers
- $100m+, illicit transactions processed by Garantex since 2019 (Treasury).
- 1bn+, rubles Grinex claimed were stolen in the alleged hack.
- 3, Garantex executives newly designated, plus 6 Russian/Kyrgyz shell firms.
- Mar 2025, when Garantex deposits first migrated to the Grinex successor.
Why it matters
Garantex was a load-bearing off-ramp for Russian ransomware and sanctions-evasion crypto. Killing the successor too, if the halt is genuine and not an exit scam, removes a major laundering venue, but the A7A5/rebrand playbook shows how quickly the next one stands up.
What to watch
- Whether a new successor exchange appears, or A7A5 migrates elsewhere.
- On-chain tracing of the "stolen" Grinex funds (hack vs exit scam).
- Knock-on liquidity strain for ransomware affiliates after Endgame.