Back

High-Risk Platforms Are Copying Sanctioned Russian Exchange Garantex

author avatar

Written by
Landon Manning

03 September 2025 22:01 UTC
Trusted
  • TRM Labs links Garantex’s evasion tactics to new exchanges like ABCex and AEXbit, raising concerns about copycat strategies.
  • Analysts suggest AEXbit may be a rebrand to bypass sanctions, echoing Garantex’s alleged revival through Grinex.
  • Experts warn that criminals adapt faster than regulators, making behavioral monitoring vital in combating illicit crypto activity.
Promo

Garantex, a sanctioned Russian crypto exchange, may inspire other businesses to emulate its methods. A new report details a connection between ABCex and AEXbit, which may be a rebrand to evade legal consequences.

TRM Labs shared this report with BeInCrypto alongside some exclusive commentary from Ari Redbord, its Global Head of Policy and Government Affairs. The firm suspects that AEXbit and Garantex are directly linked, but there is no firm proof.

Sponsored
Sponsored

Is Garantex Inspiring Exchanges?

TRM Labs has been hard at work analyzing crime trends in 2025’s crypto scam supercycle, and its newest report is highly concerning. Specifically, it alleges that Garantex, a high-risk crypto exchange, has taught some valuable lessons in sanctions evasion to other illicit crypto platforms:

“Garantex’s takedown was a landmark enforcement action, but it also shows us something important — illicit actors don’t just disappear, they adapt. What we’re seeing now is the playbook being reused: rebrands, cloned interfaces, and jurisdictional arbitrage,” Redbord told BeInCrypto.

What does this mean, exactly? Although Garantex largely went underground after US sanctions and a few arrests, the exchange restarted under a fresh name. Grinex, the new firm, shared many on-chain transactions, code, and other assets with Garantex.

Sponsored
Sponsored

This led experts to believe this company was a new money laundering front. Transactions in A7A5, a ruble-backed stablecoin from Kyrgyzstan, helped cement these connections. TRM Labs isn’t confident that new criminal exchanges are directly involved with Garantex, but they’re using similar methods.

Tactics Spread Between Illicit Actors

Specifically, the firm tracked ABCex, a shuttered exchange, and AEXbit, a potential rebrand, which closely resembled connections between Garantex and Grinex.

Shortly after ABCex briefly shuttered during a DDoS attack, this replacement service opened with an identical user interface.

TRM Labs suspects AEXbit relaunched to evade legal consequences, just like Garantex created a successor exchange.

ABCex was allegedly linked to illicit gambling and terror funding, and TRM Labs found out that it has been co-spending with the “clean” AEXbit. This new firm also has some tangential connections to Garantex, but those are less certain.

Sponsored
Sponsored
Spending Links Between Exchanges
Spending Links Between Exchanges. Source: TRM Labs

In short, it doesn’t actually matter if this new exchange is directly affiliated with Garantex or not. What matters is that these tactics are spreading among illicit actors.

Cybersecurity experts are already worried that criminals are learning from each other more effectively than crimefighters are.

In his closing comments, Redbord seemed to generally share these fears.

“For law enforcement and compliance teams, this underscores the need to monitor behavior and infrastructure, not just names,” Redbord concluded.

If the community is going to prevent money laundering and fight criminal actors, it will need to learn from these tactics, too.

Disclaimer

In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.