U.S. Sanctions Garantex and Grinex, Offers $6 Million Bounty in Russian Crypto Crackdown

The United States has intensified its campaign against illicit Russian cryptocurrency activity. It re-designated Garantex under new sanctions and blacklisted its alleged successor Grinex. The U.S. State Department also announced a $6 million bounty for information leading to the arrest or conviction of Garantex’s leadership. Authorities say both exchanges played a central role in ransomware laundering and darknet market transactions. These activities violate U.S. sanctions enforced by the Treasury’s Office of Foreign Assets Control (OFAC) against cryptocurrency exchanges.

Garantex’s Troubled History

Founded in Moscow, Garantex operated as a major trading hub for ruble-denominated digital assets. The platform was first sanctioned in 2022 after U.S. investigators linked it to more than $100 million in illicit transactions. These included payments tied to ransomware groups like Ryuk and Conti. Hydra and other darknet marketplaces also used the exchange.

According to the U.S. Treasury’s Office of Foreign Assets Control (OFAC), Garantex acted as a gateway for converting cryptocurrency from criminal activities into fiat currency. This undermined global sanctions enforcement.

>>> Read more: Crypto Sanctions: U.S. Targets Houthi Wallets

Grinex: The Alleged Successor

The newly sanctioned Grinex exchange is accused of acting as a contingency plan crypto exchange for Garantex. Investigators say it inherited its infrastructure, user base, and operational methods. OFAC alleges that Grinex continued the same illicit services while bypassing restrictions from earlier sanctions. The case shows how sanctions are evaded through rebranded entities that look legitimate but are run by the same individuals or networks.

The $6 Million Garantex Bounty

In a parallel move, the State Department’s Rewards for Justice program is offering a bounty of up to $6 million for credible information on Garantex leadership. The reward applies to tips leading to arrest, conviction, or disruption of the network. Similar bounties have been used in past cybercrime cases. They have helped target ransomware operators and their enablers. Washington says the measure underscores its determination to dismantle these ecosystems.

Cybercrime and Ransomware Disruption

Exchanges like Garantex and Grinex serve as financial lifelines for ransomware operations. Victims often pay attackers in cryptocurrency. That money is then routed through such platforms to obscure its origin.

These exchanges help criminals launder ransomware payments through cryptocurrency channels, converting them into cash without alerting traditional banking systems. U.S. authorities believe that cutting off these laundering channels is critical to disrupting major ransomware operations.

Sanctions Policy and Compliance Risks

The re-designation of Garantex highlights OFAC’s approach to tightening enforcement through follow-up action, targeting sanctioned entities that continue operations. The inclusion of Grinex sends a warning to the industry that successor exchanges are not beyond reach.

The Treasury also sanctioned wallets tied to a ruble-backed stablecoin known as the A7A5 token, citing its role in sanctions evasion. For legitimate crypto businesses, this reinforces the need for robust sanctions compliance programs to avoid engagement with blacklisted counterparties.

>>> Read more: Russia Crypto Shift Archives

Global and Industry Reactions

There has been no public response from Russian authorities. Compliance experts say the measures will likely limit these exchanges’ access to international liquidity. Some exchanges outside Russia may now review their exposure to ruble-linked assets and reassess their customer due diligence processes.

The move signals to other jurisdictions that the U.S. won’t shy away from taking aggressive action against cross-border sanctions evasion through crypto schemes.

What’s Next

Officials say investigations into both exchanges are ongoing. More sanctions could follow against connected wallets, mixers, or service providers. Analysts warn that the same operators may attempt to launch another replacement platform. This makes vigilance essential.

The broader strategy, combining direct enforcement with financial isolation, will likely remain central to U.S. cybercrime policy.

>>> Read more: Embargo Ransomware: BlackCat Successor Targets Healthcare

The coordinated targeting of Garantex and Grinex marks a decisive escalation in U.S. efforts to curb illicit crypto flows linked to Russia. By coupling financial isolation through Garantex sanctions with a multi-million-dollar bounty on its leadership, Washington sends a clear message. The infrastructure that enables cybercrime and disruption will face relentless pressure, no matter how many times it changes its name.