Russian crypto operators under sanctions avoid regulation by utilizing transfers through Telegram

Russian crypto operators under sanctions avoid regulation by utilizing transfers through Telegram

From Moscow to Dubai, the blacklisted crypto exchange morphed into Exved, MKAN Coin, and Grinex, funneling billions through offshore networks and Telegram channels despite global crackdowns.

A sanctioned Russian cryptocurrency network has resurfaced under new names, moving billions of dollars through banks and offshore intermediaries despite raids and international sanctions, according to an investigation published Wednesday by Transparency International Russia in Exile and OCCRP.

The report says Moscow-based Garantex, blacklisted by the U.S. Treasury in 2022 and stripped of its license by Estonian regulators, processed about $96 billion between 2019 and 2025, with at least $1.3 billion tied to criminal activity, citing data from blockchain analytics firm Chainalysis. Law enforcement raids in March 2025 targeted its servers and domains, but successor platforms appeared within weeks. The U.S. Justice Department announced indictments against its administrators, and Indian authorities arrested a system administrator at Washington’s request.

One successor, Exved, is led by Garantex co-founder Sergey Mendeleev. Though officially registered as a domestic “payment facilitator,” Exved operates from Moscow City, letting Russian clients pay in rubles while foreign partners receive hard currency or stablecoins abroad. Investigators posing as traders in Hong Kong found the onboarding process required only minimal documents. Transactions were routed through Paysol, a Russian-registered company acting as Exved’s “agent.”

Chats with Exved representatives described how the scheme works: rubles are sent to the Russian bank account of a foreign-registered intermediary, such as a Hong Kong shell company. Offshore, the intermediary then forwards equivalent sums in U.S. dollars, yuan or USDT [Tether stablecoin] to the foreign supplier. Contracts make no mention of cryptocurrency. “No bank will know. It is visible only between us,” one agent said.

The structure makes funds appear legitimate inside Russia’s banking system while being converted abroad. Exved charges a three percent commission for transfers above $50,000. Russian banks including T-Bank and Expobank were cited as “working banks” for ruble-side payments. Foreign banks in Hong Kong, such as J.P. Morgan, Deutsche Bank and Bank of China, were also mentioned as conduits. 

Investigators say Exved’s network has been used to buy dual-use goods such as microprocessors and telecom equipment from China and Taiwan. Paysol’s legal staff acknowledged that clients often bring in restricted items and that invoices can be adjusted to avoid customs scrutiny. 

Blockchain analysis showed that wallets linked to Exved and Paysol were directly tied to sanctioned Garantex addresses. One wallet processed more than $563 million, including $234,000 from Garantex Europe on December 25, 2024, followed weeks later by a $2.6 million transfer to Paysol. Some funds later returned to Garantex, a common “layering” tactic in which illicit money is cycled through multiple transactions to disguise its origin and complicate tracking.

Other successors followed. MKAN Coin emerged in Dubai, Kyrgyzstan, Brazil, Spain and Thailand, offering Russians Telegram-based crypto-to-cash services. It was run by former Garantex executive Mohammad Khalifa. Dubai regulators shut MKAN down in 2024, but Kyrgyz authorities later added affiliated entities to their money-laundering blacklist.

After MKAN’s closure, a new exchange called Grinex appeared in 2025. Analysts at TRM Labs and Global Ledger found strong ties to Garantex’s infrastructure, including wallets and bots. Grinex also launched a ruble-pegged stablecoin, A7A5, backed by accounts at Promsvyazbank, a sanctioned state-controlled bank. Within four months, A7A5 processed $9.3 billion.

In August 2025, the U.S. Treasury expanded sanctions to include Exved, Grinex and InDeFi Bank, along with executives Mendeleev, Aleksandr Mira Serda and Pavel Karavatsky. Days later, the U.K. announced its own measures, specifically highlighting the A7A5 token.

The investigation also details the individuals behind the networks. One is Sergey Kunitsa, head of Paysol and former head of a customs brokerage firm. Another is Aleksandr Mira Serda, also known as Ntifo-Siao, who remains active despite U.S. indictments. Public records show he bought a $3 million villa in Dubai and obtained a new Russian birth certificate listing a deceased Spanish citizen as his father.

Throughout, investigators said, Telegram remains the backbone of operations. From onboarding to contracts, everything is handled in private chats and bots. “Telegram has become the central operating layer,” investigators concluded.

Despite sanctions and raids, the report says the network continues to adapt. Investigators describe it as a “crypto laundromat”: decentralized, opaque and resilient. Instead of centralized exchanges, the system now depends on offshore intermediaries, encrypted channels and state tolerance.