On 14 August 2025 OFAC re-designated the cryptocurrency exchange Garantex Europe OU under its cyber authority (E.O. 13694, as amended) for processing over USD 100 million in transactions tied to ransomware and darknet-market actors since 2019, and designated its successor exchange Grinex — created by former Garantex staff to move customer deposits and continue operations after a March 2025 US Secret Service-led takedown of Garantex's infrastructure. OFAC also designated three Garantex executives, the A7A5 ruble-backed stablecoin issuer Old Vector (Kyrgyzstan), and Russian settlement-platform firm A7 and its subsidiaries A71 and A7 Agent — entities linked to sanctioned Moldovan oligarch Ilan Shor and sanctioned Promsvyazbank — for supplying the A7A5 token used to compensate Garantex customers and route funds through Grinex.

Analyst notesShow

Mechanism

OFAC designation package under E.O. 13694 (as amended by E.O. 14144 and E.O. 14306) targeting a specific sanctions-evasion chain rather than a single entity:

1. Garantex — originally designated April 5, 2022 under E.O. 14024; re-designated under the cyber E.O. after continuing to process ransomware- and darknet-linked funds (Conti, Black Basta, LockBit, NetWalker, Phoenix Cryptolocker) despite the 2022 action and a March 6, 2025 US Secret Service/German/Finnish law-enforcement seizure of its infrastructure. 2. Grinex — designated as owned/controlled by Garantex; created by Garantex staff immediately after the March 2025 takedown to receive transferred customer deposits and keep the exchange's business running. 3. A7A5 token / Old Vector — the ruble-backed stablecoin used to make Garantex customers whole after the takedown; issued by Kyrgyzstan-based Old Vector, designated for material support to A7. 4. A7 / A71 / A7 Agent — Russian cross-border settlement firms owned by sanctioned oligarch Ilan Shor and sanctioned bank Promsvyazbank; A7 representatives arranged A7A5 trading on Garantex before the takedown. 5. Three Garantex executives designated individually for procuring infrastructure, registering trademarks, and business development that sustained the exchange's sanctions-evasion role.

Why severity 3 / mixed basis

Quant anchor: Treasury cites over USD 100 million in known

illicit-actor transactions through Garantex since 2019, and states Grinex has "facilitated the transfer of billions of dollars" since its creation — real disclosed magnitude, hence mixed rather than pure qual.

Not rated higher: this is a designation/asset-freeze action against a

crypto-exchange network, not a systemic financial-sector or energy sanction; the entities are mid-size relative to Russia's broader sanctions-evasion architecture.

Not rated lower: it closes a specific, actively-used evasion channel

(the Garantex→Grinex→A7A5 chain) spanning three jurisdictions (Russia, Kyrgyzstan, and Shor/PSB's networks) and follows a coordinated US Secret Service/FBI law-enforcement action, indicating sustained multi-agency priority.

Downstream implications

The UK followed six days later with its own designation of largely the

same network — see 2025-08-20-uk-ofsi-russia-crypto-circumvention-sanctions (Grinex, Old Vector, plus Capital Bank of Central Asia and Altair Holding SA, citing a separate USD 9.3bn four-month A7A5 transaction figure) — indicating US-UK coordination on this specific rail rather than independent parallel action.

Establishes a template (re-designate the original entity under cyber

authority, then designate the successor exchange and the compensation-token issuer as a linked chain) OFAC may reuse if Grinex or A7A5 are themselves replaced.

Open questions

Whether Grinex or A7A5 are reconstituted under new corporate vehicles,

echoing the Garantex-to-Grinex substitution pattern.

Whether the EU issues a parallel designation against the same network.

Sources

Primary: U.S. Department of the Treasury — Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals

Secondary: Global Trade Alert — state-act 93946

Loading…

Mechanism

OFAC designation package under E.O. 13694 (as amended by E.O. 14144 and E.O. 14306) targeting a specific sanctions-evasion chain rather than a single entity:

Why severity 3 / mixed basis

Quant anchor: Treasury cites over USD 100 million in known

Not rated higher: this is a designation/asset-freeze action against a

crypto-exchange network, not a systemic financial-sector or energy sanction; the entities are mid-size relative to Russia's broader sanctions-evasion architecture.

Not rated lower: it closes a specific, actively-used evasion channel

Downstream implications

The UK followed six days later with its own designation of largely the

Establishes a template (re-designate the original entity under cyber

authority, then designate the successor exchange and the compensation-token issuer as a linked chain) OFAC may reuse if Grinex or A7A5 are themselves replaced.