Elliptic reveals 5 exchanges assisting Russia in evading sanctions: ABCeX alone trades $11 billion

Blockchain analytics firm Elliptic names five cryptocurrency exchanges assisting Russia in circumventing international sanctions, including ABCeX, which has processed over $11 billion in transactions. Its office is located in the same building as Garantex’s former premises.
(Background: Abandoning de-dollarization? Russia considers “returning to the US dollar settlement system” in exchange for economic cooperation with the US and peace between Russia and Ukraine.)
(Additional context: Russia bans Telegram “file and video sharing”! Demands elimination of anonymity, putting TON ecosystem to the test.)

Table of Contents

Toggle

• The roles of the five heads of the snake
• From Garantex to Grinex to A7A5
• EU’s nuclear option: a total ban on crypto transactions with Russia

In March 2025, the U.S. Department of Justice, together with German and Finnish law enforcement agencies, announced a high-profile takedown of Garantex, a Russian crypto exchange handling over $100 billion in transactions, providing services to ransomware attackers and sanctions evaders. Domains were seized, $26 million in crypto assets frozen, and two executives prosecuted, one of whom was arrested in India.

This was one of the largest enforcement actions in crypto sanctions history.

However, a recent report by blockchain analysis firm Elliptic on the 22nd points out that ABCeX, Exmo, Rapira, Bitpapa, and Aifory Pro are rapidly filling the void left by Garantex, and doing so quite effectively.

Most notably, ABCeX. This exchange offers order books and P2P trading services for ruble-to-cryptocurrency trading, with a total processed volume of at least $11 billion. Its office is located in the Federation Tower in Moscow, in the same building as Garantex’s previous office.

In other words: the sign may have changed, but the address remains the same, and business continues as usual.

The roles of the five heads of the snake

Elliptic’s report not only lists names but also breaks down each exchange’s operational model and risk exposure.

ABCeX employs a “wallet obfuscation strategy.” Frequently changing deposit addresses makes on-chain tracking tools struggle to link transactions to the platform. Elliptic tracked significant fund flows between ABCeX, Garantex, and Aifory Pro.

Exmo’s story is even more ironic. After Russia’s invasion of Ukraine in 2022, Exmo claimed to have sold its Russian operations to an independent entity, Exmo.me, achieving “geographical separation.” But Elliptic’s on-chain analysis shows that user deposits on both platforms still flow into the same hot wallet address: the “split” is only superficial, with the front end changing logos but the backend vault remaining unified.

Rapira is registered in Georgia but has an office in Moscow, offering ruble trading services. It has over $72 million in direct crypto transactions with the sanctioned exchange Grinex. Earlier this year, its Moscow office was reportedly raided, suspected of aiding capital flight.

Bitpapa is the only one among the five officially sanctioned by OFAC (March 2024). Registered in the UAE, it mainly serves the ruble exchange needs of the Russian market. Elliptic data shows about 9.7% of its outbound crypto funds flow to OFAC-sanctioned targets, with 5% directly to Garantex. Its evasion tactic involves constantly rotating wallet addresses to frustrate monitoring tools.

Aifory Pro is the most diversified among the five. It provides cash-to-crypto exchange services in Moscow, Dubai, and Turkey, and acts as an “external economic activity payment agent” for Russian-Chinese trade.

It even offers USDT-based virtual payment cards and Apple Pay integration, enabling Russian users to access sanctioned services like Airbnb and ChatGPT. Elliptic also tracked nearly $2 million transferred from Aifory Pro to Iran-sanctioned exchange Abantether.

From Garantex to Grinex to A7A5

To understand how these five exchanges rapidly filled the void, we must trace the chain reaction following Garantex’s shutdown.

Within weeks of Garantex’s fall, a platform called Grinex launched. Users reported that they could simply go to the same office in the Federation Tower to transfer funds from Garantex to Grinex. Chainalysis analysis indicates that Grinex’s interface is “almost identical” to Garantex’s.

Simultaneously, the issuance of ruble-stablecoin A7A5 appeared. Issued by Kyrgyzstan-based Old Vector, the stablecoin is backed by ruble deposits at the sanctioned Promsvyazbank in Russia. By July 2025, it had processed over $51.17 billion in transactions.

A Chainalysis report from January 2026 states that in 2025, record-breaking $154 billion was sent to illicit crypto addresses, with A7A5 alone accounting for $93.3 billion of that volume. The mastermind behind A7A5 is Ilan Shor, a Moldovan exile allied with Putin, playing a key role in Russia sanctions evasion activities.

In August 2025, OFAC finally sanctioned Grinex, Old Vector, A7 LLC, and related entities and individuals. By October, the EU’s 19th sanctions package listed A7A5 transactions as prohibited.

But the problem remains: after each enforcement action, new alternatives emerge within weeks. Data from TRM Labs shows that after Garantex was shut down, trading volumes on ABCeX and Rapira increased significantly.

EU’s nuclear option: a comprehensive ban on crypto transactions with Russia

This context led to the EU proposing its 20th sanctions package on February 6.

European Commission President Ursula von der Leyen’s proposal is arguably the most aggressive to date: a total ban on all transactions between EU entities and Russian crypto service providers, blocking Russia’s central bank digital currency (digital ruble), and explicitly targeting “shell entities spun off from already sanctioned platforms.”

The plan is scheduled for formal adoption on February 24, the fourth anniversary of the Russia-Ukraine war. However, it requires unanimous approval from all 27 member states, and at least three countries have expressed reservations about a full ban.

Even if approved, enforcement challenges remain significant. Aifory Pro’s operations in Dubai and Turkey are outside EU jurisdiction. ABCeX’s wallet obfuscation makes on-chain attribution difficult. And A7A5’s transactions on Tron are inherently peer-to-peer, bypassing any regulated gateways.