Garantex Exchange Takedown

As of October 2026: The indictment against Aleksej Besciokov and Aleksandr Mira Serda is an allegation. Treasury reported in August 2025 that Besciokov had been arrested in India; searches on October 21, 2026 found no Justice Department release, court record or reliable report of an Indian extradition ruling, extradition to the US, plea, trial or sentence, so his current status is unknown and should be checked before citing it. The India arrest was confirmed by a Justice Department spokesperson to TechCrunch in March 2025. The US$96 billion and US$26 million figures are the Justice Department's March 2025 statements.

Also known as: Garantex crypto exchange · Grinex successor exchange.

What happened?

Garantex was a cryptocurrency exchange originally registered in Estonia that, according to the US Treasury, ran most of its operations from Moscow and St. Petersburg. Treasury dates its founding to late 2019; the Justice Department counts its transactions from April 2019. By early 2022 Estonia’s Financial Intelligence Unit had pulled its license after finding serious anti-money laundering failures and links to wallets used for crime.

On April 5, 2022, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned the exchange, making it an SDN that US persons could not deal with. Treasury said more than US$100 million of its known transactions were tied to illicit actors and darknet markets.

On March 6 and 7, 2025, the Justice Department announced a joint action with Germany and Finland. US agents seized three web domains, German and Finnish police seized the servers, and the US froze over US$26 million. The Justice Department said Garantex had processed at least US$96 billion in transactions since April 2019. It also unsealed an indictment against two of its administrators.

Which techniques did it use?

Garantex was a centralized exchange: customers deposited crypto, and the platform held and swapped it. Treasury said most funds sent to Garantex came from other exchanges used for crime, and that criminal users then used Garantex’s exchange services to launder them. In layering terms, the exchange sold a clean break: dirty coins went in, other assets came out, and the account was the only link.

Two features stand out in the public record. First, prosecutors say the platform did not properly screen customers. The Justice Department said it never registered with FinCEN as a money services business, despite substantial business in the United States. Second, after the 2022 sanctions the operators allegedly redesigned how the exchange worked. The indictment says they moved operational wallets to new addresses every day so that US exchanges would struggle to identify and block Garantex traffic. Treasury said the same: Garantex built infrastructure meant to stop institutions from tying wallet addresses back to it. This is covered more broadly on the unlicensed exchanges and sanctions evasion pages.

How was it found?

The first break was regulatory. Estonia’s supervisor examined the firm and found links to criminal wallets, and it coordinated with Treasury. Blockchain tracing then supplied the volume: Treasury’s 2022 analysis tied nearly US$6 million to the Conti ransomware gang and about US$2.6 million to the Hydra darknet market. See blockchain analytics for how that tracing works.

The 2025 takedown relied on physical infrastructure and data. The Justice Department said US authorities had earlier copies of Garantex’s servers, including customer and accounting databases, and thanked Tether and the analytics firm Elliptic for help. Prosecutors also pointed to a revealing detail: when Russian law enforcement asked for records on an account linked to one of the founders, the exchange allegedly gave incomplete information and falsely said the account was unverified, while the account was tied to that founder’s identity documents.

What was the outcome?

• Domains and servers seized. Garantex.org, Garantex.io and Garantex.academy, which the Justice Department said would display a law enforcement seizure notice.
• More than US$26 million frozen, with a claims address published for victims.
• Two indictments. Aleksej Besciokov, a Lithuanian national living in Russia, and Aleksandr Mira Serda, a Russian national living in the United Arab Emirates, were charged in the Eastern District of Virginia. Each faces one count of conspiracy to commit money laundering (maximum 20 years). Besciokov also faces counts of conspiracy to violate US sanctions law (maximum 20 years) and conspiracy to operate an unlicensed money transmitting business (maximum five years). An indictment is only an allegation.
• An arrest in India. Treasury reported that Besciokov was arrested in India after the indictment was unsealed. TechCrunch reported in March 2025 that Kerala police detained him in Varkala under India’s extradition law on a warrant from a Delhi court, and that a Justice Department spokesperson confirmed the arrest was made at the request of the United States. As of October 2026, no Justice Department release, US court record or reliable report found for this page says whether he has been extradited, pleaded or been tried, so his current status is unknown.
• A successor, then more sanctions. Treasury said that right after the March action, Garantex officers moved customer deposits to Grinex, and customers who lost funds were given the equivalent in A7A5, a ruble-backed token. On August 14, 2025, OFAC sanctioned Grinex, three Garantex executives, the firms behind A7A5 and others. The State Department offered up to US$5 million for information on Mira Serda and up to US$1 million for other key leaders.

What were the warning signs?

• Heavy exposure to known criminal wallets. Ransomware, darknet and fraud proceeds made up a visible share of flows, which compliance teams at other exchanges could see in incoming deposits.
• Loss of a license, but no change in behavior. A regulator pulled the Estonian license in February 2022, yet the site kept serving customers.
• Wallets that moved daily. Constant address changes after sanctions were a red flag in themselves, because honest businesses have no reason to hide from sanctions screening.
• No registration where the law required it. Serving US customers without a FinCEN registration is a basic licensing failure.
• Misleading answers to authorities. The indictment alleges false statements about which accounts were verified.

What changed afterwards?

Garantex shows a sanctions loop that repeats across the cases on this site. A service is sanctioned, its operators build a replacement, and regulators have to find and designate the replacement too. OFAC’s 2025 action named the successor, its executives and the token that rebuilt customer balances, aiming at the network rather than a single website. The same pattern appears in the ChipMixer takedown, where servers were seized while the alleged operator stayed out of reach, and in the Hydra Market case, where the darknet market’s money flowed through exchanges like this one.

For platforms, the practical lesson is screening. US sanctions rules bar dealings with blocked parties, so exchanges are expected to check counterparties and wallet blocklists rather than assume a wallet is clean. For how regulators judge crypto firms, see the KYC page.

First published October 4, 2026 · Last updated October 21, 2026 · Legal statuses current as of October 2026