The team of the crypto exchange Garantex, which came under EU and US sanctions, has launched a new platform called Grinex. This follows from a report from Global Ledger provided by Incrypted.
Recall that Garantex effectively suspended operations on March 6, 2025. Its website was shut down and its wallets were frozen. Later, it was also reported that the co-founder of the exchange Alexey Beshchekov was detained in India at the request of the US authorities.
Garantex has been actively used both to launder funds stolen by hackers, including the Lazarus Group, and to circumvent sanctions against Russia.
Global Ledger claims to have uncovered both onchain and offchain evidence of the exchange team launching an alternative platform, Grinex.
Liquidity is being actively transferred to its accounts in an effort to not only continue operations, but also to maintain market share. In particular, according to the report, by mid-March 2025, Grinex had received about $29 million.
The promos of the platform explicitly state that the Garantex team is behind its creation. Also, it’s has a similar design.
Listing of A7A5 stablecoin and transfer of assets to the new platform
In February 2025, Kyrgyz company Old Vector introduced the A7A5 ruble-denominated stablecoin for Promsvyazbank’s A7 cross-border payment platform. On February 19, Garantex announced the listing of the asset.
On March 11, shortly after the exchange closed, in comments to a message in the official Telegram channel of A7A5, the creators of the stablecoin confirmed that the token is now available on Grinex.
According to Global Ledger, between February 8 and March 11, Garantex transferred 10 million A7A5, 768 million A7A5 and 1 billion A7A5 to TFwjPScaJRCbSWVAywE1S1WgaUgSnyYUbD account. On March 4, the same wallet received stablecoins from addresses blocked by Tether. Namely:
- 441,416 A7A5;
- 187,926 A7A5;
- 228,898 A7A5;
- 2,5 billion A7A5.
On March 5, more than 4,5 billion A7A5 was withdrawn from this wallet. After a series of transactions through disposable accounts, these crypto assets settled on TJkBr9TZ1xBeJoF7RNWqyEMbYqVJJ6fXXHR on March 10.
On the same day, they were sent to the TML1DbrPXYDDDwatGxw66iEwECnXCG54uJy contract address. It received more than 5 billion A7A5 and 100 A7A5. After 10 minutes, 4,4 billion A7A5 were burned and reissued, sending to TNDjh6WGLYyWmkh8vfu42bXVHUqFNQ3rDq.
Global Ledger speculated that the funds were laundered in this way so that they had no direct connection to Garantex. From the above wallet, the funds were transferred using a chain of disposable wallets to the Grinex address — TGckaiamj5NzaYx6Qp6Zu7kahuHArzUo99.
The flow chart of the funds is as follows:
Some other evidence
The Global Ledger report also indicates that the previously mentioned TJkBr9TZ1xBeJoF7RNWqyEMbYqVJJ6fXXHR wallet received 86 TRX from an account on a large centralized crypto exchange (CEX) to pay for gas. From the same platform transferred 423 TRX already to TNDjh6WGLYyWmkh8vfu42bXVXVHUqFNQ3rDq.
The first transaction to the confirmed Grinex hot wallet was in the amount of 5000 TRX. The funds came from the same centralized Asian exchange that Garantex was actively using for withdrawals and liquidity inflows, the report said.
Global Ledger also cited a statement from a top Garantex manager who confirmed that users were transferring funds to Grinex.
This is stated in the channel of one of the clients. He confirmed that the funds that were blocked on Garantex, came to Grinex after a conversation with the manager.
Also, both platforms have a similar interface, and the description of Grinex on the CoinMarketRating portal explicitly states that it is from the creators of Garantex.
«Given all the evidence presented in this report, we can confidently assert that Grinex and Garantex are directly related», — Global Ledger said.
The company emphasized that Grinex, all things considered, is not an independent counterparty, it should be regarded as a direct successor to Garantex.