Grinex, a exchange of cryptocurrency that was identified as a suspected successor to the sanctioned Russian platform Garantex, has reportedly moved greater than 1.66 billion US dollars through stock exchanges, although the blockchain -analytics company global ledger was raised in red flags.
Garantex had its infrastructure faraway from the US, German and Finnish authorities in March and has since shifted his operations to Grinex.
The Global Ledger initially announced CoinTelegraph that various cryptocurrency exchanges had around 1 billion US dollars of around 1 billion US dollars in early May.
But the movement didn’t stop, said the Swiss Blockchain data specialist. Until May thirtieth, the researchers had increased their estimates as a consequence of continuous fund flows in and from Grinex.
“You can see [the amount is] destructive [and] It grows each day, ”Yury Serov, research manager for studies at Global Ledger, told CoinTelegraph.
The top exchange through Grinex exposure. Source: Global Ledger
Grinex wallets proceed to maneuver to Tron
According to Compliance Company Bitrace, $ 649 billion of stablecoin flows with high risk addresses were exposed to high risk addresses in 2024. The company stated that greater than 70% of the doubtless illegal stablecoin transactions via USDT (USDT) appeared within the TRON network.
The observed fund also flows from Grinex in tron-based USDT. At the time of writing, Global Ledger has 2.41 billion US dollars in transaction exposure to Krypto services and wallets. From this amount, 1.66 billion US dollars in and from 180 cryptocurrency exchanges were obtained, that are also known as virtual asset service providers (vasps).
“Let us assume that there’s a vasp sending of funds and one other who receives it. Under the recommendations of the travel sail, the receiving VASP must receive vital details, e.g.
Global Ledger refused to call the stock exchanges that were exposed to Grinex Transfer, but said that some were informed about his suspicious fund flow evaluation.
“Some of them received feedback that they’ve recognized what we made available to them,” said Serov, adding that a few of his attempts at communication have remained unanswered.
Cointelegraph contacted six of the world's largest crypto firms that worked worldwide to ask whether or not they were informed or found with fund rivers via Grinex.
Of the contacts contacted, Binance only replied and explained that it monitors and blocks each direct and indirect exposure to sanctioned individuals and corporations.
“Although it will not be possible to avoid incoming deposits, we take measures against customers. We also prevent users from sending funds to sanction -related addresses,” said the stock exchange spokesman.
Many of the transactions identified by the worldwide general book were direct interactions, which implies that no intermediary addresses or veiling techniques were used to transfer funds from the Grinex to the exposed stock exchanges.
CoinTelegraph tried to contact Grinex, but didn’t receive a solution from publication.
Grinex is created from the shadow of Garantex
In March, the US and European authorities announced a coordinated international company to disturb Garantex's services. As a part of the procedure, Tether climbed 27 million US dollars to the sanctioned Russian exchange in StableCoins.
The US criminal traps said they confiscated the domain name related to Garantex, while the German and Finnish authorities confiscated servers that organized the Infrastructure of Exchange. US officials also stated that former server copies with customer and accounting data had received. Garantex has processed Crypto transactions of around 96 billion US dollars since April 2019.
Days later, the Indian Central Office for Investigations Aleksej Bešciokov, which was charged with Operating Garantex, arrested for US money laundering fees.
Garantex was then allegedly reappeared as a grinex, in line with Onchain and Offchain data, which were analyzed by Global Ledger. The company reported that Garantex had moved stable coins in Russian rubles from Rubel from Rubel to Grinex, which described the “full successor of the stock exchange”.
Global Ledger added that one in every of the Grinex managers claimed that customers personally visited the Garantex office and actively transferred funds from Garantex to Grinex.
Garantex was approved in 2022 and February 2025 by the US Ministry of Finance and the European Union.
Grinex shows how platforms survive
In the early days of blockchain technology, cryptocurrencies offered cybercriminals a convenient method to move money as a consequence of their decentralized and largely unregulated nature.
Today the asset class has matured and has aroused growing interest of institutions and even nation states. This shift has accelerated the regulatory discussions and advanced the event of advanced security instruments to pursue illegal transactions. Several countries have now arrange specialized units dedicated to crypto.
Despite this progress, there are considerable blind spots, and illegal actors proceed to make use of the regulatory arbitrage.
For example, some USDT flows of Grinex were related to licensed cryptocurrency exchanges oriented in Europe. In the EU, the stock exchanges have began to delist USDT trading pairs to satisfy the MICA frame for Crypto-Assets (Mica) of the Bloc, which imposes strict requirements for stable coin issuers.
“These firms have licenses in Europe, but also they are energetic in countries outside the EU who’ve turn into a crucial goal for Russian immigrants after the war,” said Serov. “Our assumption is that many still live legally with documentation that enable them to interact with euro-focused vasps.”
While recently sanctioned platforms and illegal crypto firms were closed, Alex Katz, CEO of the safety company Kerberus, warned in an earlier interview with CoinTelegraph that such units often rename and proceed operating under recent names.
Recently, Beut, a crypto exchange of no-kow-you-customer (no-kyc), was broken down by German authorities, which confiscated $ 38 million and an associated infrastructure. However, security monitors reported on continued fund currents, which contained associated wallpaper, which indicates that the platform should still serve vital customers in stealth mode.
