Transparency International Russia publishes an investigation into how Garantex successors preserved the core of the ecosystem after sanctions and shifted to a distributed architecture under new labels — primarily Exved and Grinex. We show that roles, wallet clusters, and transfer routes persist, while only the names and outer shell change.
Why does this matter? Because this network disguises crypto flows as rouble-denominated “agency” payments, pushes settlements through offshore legs, and runs its day-to-day processes in Telegram. This configuration simultaneously facilitates capital flight and undermines export controls, including supplies of dual-use goods (micro-electronics and telecoms equipment). In a separate loop, we record stablecoin volumes in the billions of dollars; over several months, the value of transactions reached $9.3 billion.
“Every time regulators cut off one ‘head’ of this crypto hydra, another appears under a new name. Our findings show that Garantex did not disappear; it reorganised into a distributed system that hides crypto activity behind agency contracts, offshore legs, and Telegram-based workflows,” notes the report’s author, Kristine Bagdasaryan.
The piece maps the key links in this architecture and its geography, spanning Russia and foreign jurisdictions, and traces the “bridges” between Garantex’s successors. Several episodes point to European footprints of key figures and compliance vulnerabilities that allow the network to stay under the radar for extended periods.
“This architecture does not merely enable capital flight — it erodes export control by quietly financing dual-use goods,” Bagdasaryan adds. “We call for a shift from one-off actions against brand names to pattern-based supervision, delivered in coordination and at pace.”
After every takedown, a new “head” emerges, which will continue as long as the measures remain narrow and episodic. We call for a systemic regime: inter-agency coordination across the EU, the United Kingdom, and the United States, risk-marking of “agency” payment trails, and priority monitoring of wallet clusters linked to Garantex successors.
A complete account of the Garantex case is available on our website.
