Inside Putin’s Crypto Cold War: How Russia Evaded Western Sanctions In 2025

What Happened

This investigation reconstructs that system in chronological order, based on on-chain forensic analysis and interviews with investigators tracking the flows.

Grinex launched quietly and began supporting USDT. Traced flows passed through TRON and connected to Grinex-linked infrastructure. Users reported balances reappearing under the new name.

In late July 2025, Garantex publicly announced payouts to former users in Bitcoin and Ethereum. On-chain data confirmed the system was already live.

Market Context

Early signals did not point to ransomware or darknet markets. They pointed to trade.

At the same time, on-chain data showed Russian OTC desks surging in activity. Exchanges hosting Russian OTC liquidity also saw volumes spike, especially in Asia.

Garantex played a critical role in this ecosystem. It functioned as a liquidity hub for OTC desks, migrants, and trade-linked payments.

Why It Matters

The method was simple. OTC desks accepted rubles domestically, sometimes as cash. They issued stablecoins or crypto. That crypto then settled abroad, where it could be converted into local currency.

When enforcement finally escalated, the expectation was disruption. What followed instead was preparation.

Details

The Russia-Ukraine war has waged on for nearly 4 years now. Western sanctions were meant to isolate Russia financially. Instead, they forced adaptation.

In 2025, BeInCrypto began documenting how Russia and Russia-linked actors rebuilt payment routes using crypto. What emerged was not a single exchange or token, but a resilient system designed to survive freezes, seizures, and enforcement delays.

The First Warning Signs Were not Criminal

Authorities began asking new questions on how money crossed borders for imports, how dual-use goods were paid for, and how settlements occurred without banks.

Meanwhile, Telegram groups and darknet forums discussed sanctions evasion openly. These were not hidden conversations. They described practical methods for moving value across borders without banks.

Garantex Operated Russia’s Crypto Laundering Hub

Even after early sanctions, it continued interacting with regulated exchanges abroad. That activity persisted for months.

“Even people who were leaving Russia were still using Garantex to move their money out. If you were trying to relocate to places like Dubai, this became one of the main ways to transfer funds once traditional banking routes were cut off. For many Russians trying to leave the country, Garantex became a practical exit route. It was one of the few ways to move money abroad after banks and SWIFT were no longer an option,” said Lex Fisun, CEO of Global Ledger

The Seizure Triggered a Reserve Scramble

On the day Garantex’s infrastructure was seized in March 2025, a linked Ethereum wallet rapidly consolidated more than 3,200 ETH. Within hours, nearly the entire balance moved into Tornado Cash.

That move mattered. Tornado Cash does not facilitate payouts. It breaks transaction history.

Days later, dormant Bitcoin reserves began moving. Wallets untouched since 2022 consolidated BTC. This was not panic selling. It was treasury management under pressure.

So, it was clear that assets outside stablecoin control remained accessible.

A Successor Appeared Almost Immediately

As access to Garantex faded, a new service emerged.

“It was probably the most obvious rebrand we’ve seen. The name was nearly the same, the website was nearly the same, and users who lost access to Garantex saw their balances reappear on Grinex,” Fisun told BeInCrypto.