The war between Russia and Ukraine has been going on for nearly four years. Western sanctions were aimed at economically isolating Russia. Instead, they forced adaptation.
In 2025, BeInCrypto began documenting how Russia and Russian-linked actors use cryptocurrencies to restructure payment routes. What emerged was not a single exchange or token, but a resilient system designed to withstand freezes, seizures, and enforcement delays.
This study reconstructs that system over time based on on-chain forensic analysis and interviews with investigators tracking the flows.
The first warning sign wasn’t a crime.
Early signs did not point to ransomware or darknet markets. They pointed to trade.
Authorities began asking new questions about how funds crossed borders for imports, how dual-purpose goods were paid for, and how payments were made without banks.
At the same time, on-chain data showed a surge in Russian OTC desk activity. Exchanges hosting Russian OTC liquidity also saw a surge in trading volumes, particularly in Asia.
Meanwhile, Telegram groups and darknet forums openly discussed sanctions evasion. These were not hidden conversations. They described practical ways to move value across borders without going through banks.
The method was simple. OTC desks accepted rubles domestically and in some cases as cash. They issued stablecoins and cryptocurrencies. The cryptocurrency was then settled overseas, where it could be exchanged for local currency.
Russian cryptocurrency laundering hub run by Garantex
Garantex played a key role in this ecosystem. It served as an OTC desk, a liquidity hub for immigration and trade-related payments.
Russia uses UAE agents to evade sanctions
Even after the early sanctions, it continued to interact with regulated exchanges overseas. The activity continued for many months.
When the crackdown finally intensified, chaos was expected. What followed instead was preparation.
“Even people leaving Russia still used Garantex to transfer funds. If you were looking to move to a place like Dubai, it became one of the main ways to move funds after traditional banking routes were cut off. For many Russians looking to leave Russia, Garantex became a viable exit route. It was one of the few ways to move funds abroad after banks and SWIFT were no longer an option.”Global said Rex Fison, CEO of Ledger.
The seizure sparked a scramble for reserves.
On the day Garantex’s infrastructure was seized in March 2025, linked Ethereum wallets rapidly consolidated over 3,200 ETH. Within a few hours, almost the entire balance was transferred to Tornado Cash.
That move was important. Tornado Cash does not facilitate payments. Your transaction history will be destroyed.
Graphics of ETH reserve consolidation and Tornado cash transfers. Source: Global Ledger
A few days later, the dormant Bitcoin reserves began to move. The wallet has been untouched since BTC was integrated in 2022. This was not panic selling. It was financial management under pressure.
BTC Reserve Reactivation Chart
It was therefore clear that assets outside the stablecoin’s control would remain accessible.
A successor soon appeared
As access to Garantex wanes, a new service has emerged.
Grinex quietly launched and started supporting USDT. The traced flows passed through TRON and were connected to the Grinex-linked infrastructure. Users reported that their balances appear again with a new name.
“This was probably the most obvious rebranding we have ever seen. The name is almost the same, the website is almost the same, and users who lost access to Garantex saw their balances reappear in Grinex,” Fisun told BeInCrypto.
In late July 2025, Garantex announced payments to former users in Bitcoin and Ethereum. On-chain data confirms that the system is already operational.
At least $25 million worth of cryptocurrency was distributed. Much more was left untouched.
The payment structure follows a clear pattern, with reserves tiered through mixers, aggregation wallets, and cross-chain bridges before reaching users.
High-level payment flow diagram
Ethereum payments depend on complexity
Deliberate obfuscation was used for Ethereum payments. Funds were moved to DeFi protocols via Tornado Cash and then to multiple chains. The transfer bounced between Ethereum, Optimism, and Arbitrum before reaching the payment wallet.
Despite the complexity, only a small portion of the ETH reserves reached users. More than 88% remain untouched, indicating that payments are still in their infancy.
Bitcoin payments reveal another weakness
Bitcoin payments have become simpler and more centralized.
Investigators identified multiple payment wallets linked to a single aggregation hub that received nearly 200 BTC. The hub remained active for several months after the attack.
What was even more revealing was where the funds went next.
The source wallet repeatedly interacted with a deposit address associated with one of the world’s largest centralized exchanges. Transaction “changes” are consistently routed there.
Why Western sanctions have had a hard time catching up
Western sanctions were not ignored either. They were slow, uneven, and slow to perform.
By the time Garantex was completely disrupted, law enforcement authorities had already recorded billions of dollars passing through its wallets.
Even after the sanctions were imposed, the exchange continued to interact with foreign regulated platforms, taking advantage of delays between designation, enforcement, and compliance updates.
The central problem was not a lack of legal authority. It was a speed mismatch between sanctions enforcement and crypto infrastructure. While regulators work in weeks or months, crypto systems reroute liquidity in hours.
“Sanctions work on paper. The problem is enforcement. Billions of people are still on the move because enforcement is slow and piecemeal and often lags the speed at which cryptographic systems can adapt. The problem is not that sanctions don’t exist. The problem is that they are too slow to enforce for systems that move at the speed of cryptography,” said the CEO of Global Ledger.
That gap allowed Garantex to adapt. I rotate my wallet often. Hot wallets have taken an unexpected turn. The remaining balances were moved in a manner that mimicked normal trading activity, reducing the effectiveness of automated compliance systems.
The private sector struggled to catch up. Banks and exchanges balance compliance obligations with transaction speed, customer friction, and operational costs.
In that environment, authorized exposures can slip through if the activity does not raise obvious red flags.
By October 2025, the payment infrastructure was still active. There were some spares left. The route remained open.
This was not the collapse of exchanges, but rather the evolution of the system.
Russia’s crypto strategy for 2025 showed how sanctioned economies can adapt by building parallel rails, maintaining liquidity, and rerouting if cut off.
The post Inside Putin’s Crypto Cold War: How Russia Will Avoid Western Sanctions in 2025 appeared first on BeInCrypto.
Discover more from Earlybirds Invest
Subscribe to get the latest posts sent to your email.
