Garantex, a sanctioned Russian crypto exchange, may inspire other businesses to emulate its methods. A new report details a connection between ABCex and AEXbit, which may be a rebrand to evade legal consequences.
TRM Labs shared this report with BeInCrypto alongside some exclusive commentary from Ari Redbord, its Global Head of Policy and Government Affairs. The firm suspects that AEXbit and Garantex are directly linked, but there is no firm proof.
SponsoredIs Garantex Inspiring Exchanges?
TRM Labs has been hard at work analyzing crime trends in 2025’s crypto scam supercycle, and its newest report is highly concerning. Specifically, it alleges that Garantex, a high-risk crypto exchange, has taught some valuable lessons in sanctions evasion to other illicit crypto platforms:
“Garantex’s takedown was a landmark enforcement action, but it also shows us something important — illicit actors don’t just disappear, they adapt. What we’re seeing now is the playbook being reused: rebrands, cloned interfaces, and jurisdictional arbitrage,” Redbord told BeInCrypto.
What does this mean, exactly? Although Garantex largely went underground after US sanctions and a few arrests, the exchange restarted under a fresh name. Grinex, the new firm, shared many on-chain transactions, code, and other assets with Garantex.
This led experts to believe this company was a new money laundering front. Transactions in A7A5, a ruble-backed stablecoin from Kyrgyzstan, helped cement these connections. TRM Labs isn’t confident that new criminal exchanges are directly involved with Garantex, but they’re using similar methods.
Tactics Spread Between Illicit Actors
Specifically, the firm tracked ABCex, a shuttered exchange, and AEXbit, a potential rebrand, which closely resembled connections between Garantex and Grinex.
Shortly after ABCex briefly shuttered during a DDoS attack, this replacement service opened with an identical user interface.
SponsoredTRM Labs suspects AEXbit relaunched to evade legal consequences, just like Garantex created a successor exchange.
ABCex was allegedly linked to illicit gambling and terror funding, and TRM Labs found out that it has been co-spending with the “clean” AEXbit. This new firm also has some tangential connections to Garantex, but those are less certain.
In short, it doesn’t actually matter if this new exchange is directly affiliated with Garantex or not. What matters is that these tactics are spreading among illicit actors.
Cybersecurity experts are already worried that criminals are learning from each other more effectively than crimefighters are.
In his closing comments, Redbord seemed to generally share these fears.
“For law enforcement and compliance teams, this underscores the need to monitor behavior and infrastructure, not just names,” Redbord concluded.
If the community is going to prevent money laundering and fight criminal actors, it will need to learn from these tactics, too.
