Dangerous: Grinex, Suspected Garantex Successor, Moves $1.66B Through Crypto Exchanges

The world of cryptocurrency is constantly evolving, bringing both innovation and challenges. One persistent challenge involves tracking and preventing the movement of illicit crypto funds, especially those linked to sanctioned entities. Recent findings highlight a concerning trend: Grinex, identified as a suspected successor to the sanctioned Russian exchange Garantex, has reportedly facilitated the movement of over $1.66 billion through various crypto exchanges. This activity continues despite explicit warnings from blockchain analytics firms, raising significant questions about compliance and enforcement in the digital asset space.

Grinex Activity Raises Alarms for Crypto Exchanges

Blockchain analytics firm Global Ledger has been monitoring the activities of Grinex, the platform suspected of taking over operations from Garantex after it faced international crackdowns. Their analysis reveals a substantial and growing exposure for numerous crypto exchanges to wallets associated with Grinex. Initially, in early May, Global Ledger estimated around $1 billion in funds from exchanges had exposure to Grinex. However, continuous fund flows have pushed this estimate much higher.

Yury Serov, research head of investigations at Global Ledger, described the situation as ‘devastating’ and noted its daily increase. By May 30, Global Ledger’s data indicated a total transactional exposure of $2.41 billion involving crypto services and wallets tied to Grinex. A significant portion of this, $1.66 billion, represents funds moving directly in and out of approximately 180 virtual asset service providers (VASPs), commonly known as crypto exchanges.

Illicit Crypto Flows Heavily Reliant on Tron and USDt

The analysis of these suspicious movements points heavily towards the use of the Tron network, particularly for stablecoin transactions involving USDt (USDT). According to compliance firm Bitrace, stablecoin flows exposed to high-risk addresses reached $649 billion in 2024 alone, with over 70% of potentially illicit stablecoin transactions occurring on Tron via USDt. The observed fund flows out of Grinex mirror this trend, primarily utilizing Tron-based USDt.

This preference for Tron-based USDt in illicit crypto activities underscores a broader challenge for regulators and compliance teams. While regulations like the Travel Rule aim to increase transparency by requiring VASPs to share transaction details, applying these rules effectively across all networks and jurisdictions remains complex.

Sanctions and the Challenge of Tracking Funds

The original platform, Garantex, was sanctioned by the U.S. Treasury in 2022 and the European Union in early 2023. In March 2023, U.S., German, and Finnish authorities conducted a coordinated operation to disrupt Garantex, seizing domains and servers. Tether also froze $27 million in stablecoins on the platform. Following this crackdown, evidence suggests Garantex’s operations shifted to Grinex.

Global Ledger’s analysis found that Garantex had moved over $60 million in Russian ruble-backed stablecoins to Grinex, identifying it as the platform’s ‘full-fledged successor.’ Reports even suggest that Grinex managers claimed customers were physically visiting the former Garantex office to transfer funds.

Despite the clear link to a sanctioned entity, Global Ledger’s findings indicate that Grinex wallets continue to move funds, often directly, to wallets on licensed crypto exchanges. Global Ledger notified some exchanges about the suspicious flows, receiving acknowledgment from some but no response from others. Crypto News Insights contacted several major exchanges; only Binance confirmed it monitors and blocks exposure to sanctioned entities, though incoming deposits are challenging to prevent entirely.

How Platforms Evade Crackdowns and What It Means for Compliance

The emergence of Grinex following the Garantex takedown highlights a persistent challenge: sanctioned entities and illicit platforms often rebrand and continue operating. Security experts have warned that even after infrastructure seizures, associated wallets may remain active, potentially serving key customers in a stealth mode. The recent case of the no-KYC exchange eXch, dismantled by German authorities, also showed signs of continued fund flows from linked wallets.

The Grinex situation demonstrates regulatory arbitrage in action. Some USDt flows from Grinex have been traced to licensed, Europe-focused crypto exchanges. While these entities operate under frameworks like MiCA within the EU, they also serve customers in countries outside the EU that may have different regulatory landscapes. This allows individuals, potentially residing legally in these countries with valid documentation, to interact with VASPs that also operate in regulated markets.

The ongoing movement of $1.66 billion linked to Grinex serves as a stark reminder that despite advancements in blockchain analytics and increasing regulatory efforts, significant blind spots remain. Tracking and preventing illicit crypto flows requires constant vigilance, improved information sharing between regulators and exchanges, and a global approach to enforcement that closes loopholes exploited by sanctioned entities seeking to evade detection.

Conclusion

The continued operation and significant fund movement by Grinex, the suspected successor to sanctioned Garantex, underscores the dynamic nature of financial crime in the crypto space. The $1.66 billion moved through various crypto exchanges highlights the challenges faced by compliance teams and regulators in identifying and blocking illicit flows, particularly when entities rebrand and exploit jurisdictional differences. While tools and regulations are improving, the cat-and-mouse game between enforcement and illicit actors persists, demanding continuous adaptation and collaboration to safeguard the integrity of the global financial system.