When law enforcement dismantled Garantex in March 2025, the assumption was that Russia's primary crypto sanctions pipeline had been severed. As of February 2026, blockchain analytics firm Elliptic has identified five exchanges that collectively rebuilt that pipeline, processing billions in cryptoassets tied to sanctioned entities. The exchanges, ABCeX, Rapira, Exmo, Bitpapa, and Aifory Pro, did not merely absorb Garantex's leftovers. They expanded the playbook with P2P ruble trading, shared wallet infrastructure, and cash-to-crypto services stretching from Moscow to Dubai to Ankara.
The Five Exchanges and What Elliptic Found
Elliptic's report lays out the operational details of each platform.
ABCeX stands out for sheer volume. The exchange has processed at least $11 billion in cryptoassets and operates from Moscow's Federation Tower, the same building Garantex previously occupied. ABCeX facilitates both order-book and peer-to-peer ruble-to-crypto trading, and Elliptic found significant on-chain flows directed to Garantex and Aifory Pro. Transparency International Russia's investigation linked ABCeX directly to Garantex founder Sergey Mendeleev, identifying it as Garantex's third-largest on-chain counterparty.
Exmo presents a different compliance failure. The exchange split into two entities, Exmo.com and Exmo.me, claiming geographic separation. Elliptic's blockchain analysis shattered that narrative: both platforms share identical custodial hot wallet addresses, meaning deposits into either platform are pooled together. Exmo conducted more than $19.5 million in direct transactions with sanctioned entities including Garantex, Grinex, and Chatex. Approximately 9.7% of Exmo's outgoing crypto funds flow to OFAC-sanctioned targets, with 5% going specifically to Garantex.
Rapira is incorporated in Georgia but maintains a Moscow office. The exchange facilitates ruble-based trading and sent more than $72 million directly to Grinex, the exchange identified by TRM Labs as Garantex's operational successor. Russian authorities reportedly raided Rapira's Moscow offices in connection with suspected capital flight to Dubai.
Bitpapa registered in the UAE and operates as a P2P exchange converting rubles to cryptoassets. OFAC sanctioned Bitpapa in March 2024, but the platform continued operating. Elliptic found that approximately 9.7% of Bitpapa's outgoing crypto funds are destined for OFAC-sanctioned targets, and the exchange employs wallet rotation techniques to evade blockchain surveillance.
Aifory Pro runs the most creative operation. Based across Moscow, Dubai, and Turkey, the exchange offers cash-to-cryptoasset services and, notably, virtual payment cards funded with USDT that work through Apple Pay, allowing Russian users to bypass service restrictions imposed after the 2022 invasion. Aifory Pro also functions as a "Foreign Economic Activity Payment Agent" facilitating Russia-China trade settlements. Elliptic traced nearly $2 million in flows from Aifory Pro to Abantether, an Iranian exchange, connecting two of the world's most heavily sanctioned economies through a single crypto bridge.
Why Garantex's Takedown Was a Starting Gun, Not a Finish Line
On March 6, 2025, the U.S. Secret Service, partnering with German and Finnish law enforcement, seized Garantex's server infrastructure. The following day, the Department of Justice unsealed indictments against Garantex executives Aleksandr Mira Serda and Aleksej Besciokov. At the time, the operation was presented as a major victory for sanctions enforcement.
The reality proved more complicated. Within weeks, Garantex's customer base and funds migrated to Grinex, which TRM Labs identified as a likely Garantex rebrand. OCCRP reported that Garantex's network survived sanctions by decentralizing across multiple successor platforms rather than concentrating operations in a single entity. The Sprintex and ABCeX projects share contacts, Telegram bots, and registration addresses in Moscow City with the original Garantex infrastructure.
Tether froze approximately $27 million in USDT connected to Garantex during the takedown, but the freezing mechanism proved insufficient against a distributed network. The five exchanges Elliptic identified collectively handle far more volume than Garantex ever did at its peak.
The $11 Billion Federation Tower Problem
ABCeX's $11 billion processing volume deserves particular scrutiny. For context, Garantex processed an estimated $96 billion in total lifetime volume before its shutdown. ABCeX achieving $11 billion while operating from Garantex's former physical offices, with documented ties to Garantex's founder, suggests the takedown merely reshuffled the organizational chart rather than disrupting the underlying financial infrastructure.
The Federation Tower connection is not coincidental. Moscow City's twin skyscrapers have become a recurring address in crypto sanctions investigations. Elliptic's 2026 regulatory outlook warned that "sanctions enforcement will intensify" throughout 2026, but enforcement faces a structural disadvantage: shutting down one exchange in a jurisdiction that tolerates them simply diverts volume to the next one in the same building.
What This Means for Crypto Users and the Compliance Landscape
For users of legitimate crypto cards and exchanges, the Elliptic report carries practical implications.
First, exchanges operating in or routing through Russia-linked intermediaries face escalating regulatory risk. Any platform processing ruble-denominated crypto trades without robust sanctions screening is now on a collision course with OFAC, the EU's sanctions regime, and potentially the UK's Office of Financial Sanctions Implementation. Users holding funds on exchanges with weak compliance programs risk having assets frozen if their platform is sanctioned next.
Second, the shared wallet infrastructure problem exposed at Exmo illustrates how geographic separation claims can be meaningless on-chain. When two supposedly independent entities share the same hot wallets, blockchain analytics can prove operational unity regardless of corporate structure. This has implications for any exchange claiming regional compliance while maintaining shared technical infrastructure.
Third, Aifory Pro's USDT-funded Apple Pay cards represent a novel sanctions evasion vector that blurs the line between traditional payments and crypto. Users in sanctioned jurisdictions gaining access to Apple Pay through crypto-loaded virtual cards undermines both Apple's compliance framework and the card networks' sanctions screening. For self-custody card providers operating in EEA and APAC markets, this kind of abuse raises the compliance bar for everyone in the space.
The Broader Enforcement Outlook
Elliptic's report arrives one day after TRM Labs data revealed that the A7A5 ruble stablecoin processed $72 billion in one year, with $39 billion tied directly to sanctions evasion. Together, these two reports paint a picture of Russian sanctions infrastructure that is not shrinking but actively professionalizing.
The EU is already weighing a full crypto transaction ban with Russian entities, a measure that would go beyond individual exchange designations to blanket prohibition. Whether such a broad measure is technically enforceable against P2P platforms and shared wallet schemes is the open question.
For exchanges like Binance, OKX, and KuCoin that operate globally, the enforcement trajectory is clear: blockchain analytics firms are building increasingly detailed maps of sanctions-linked flows, and any exchange with measurable exposure to these five platforms will face scrutiny. The days of claiming ignorance about counterparty risk are ending.
The U.S. Treasury's approach has shifted from targeting individual exchanges to mapping entire networks. The Garantex indictment set the precedent, and the Elliptic report provides the roadmap for which nodes to target next. ABCeX, with its $11 billion volume and Federation Tower address, sits at the top of that list.
FAQ
Which five exchanges did Elliptic identify? ABCeX, Exmo, Rapira, Bitpapa, and Aifory Pro. Each facilitates ruble-to-crypto conversion or direct transactions with sanctioned entities like Garantex and Grinex.
How much volume have these exchanges processed? ABCeX alone processed at least $11 billion. Rapira sent over $72 million to Grinex. Exmo conducted $19.5 million in direct transactions with sanctioned entities. Combined volumes likely exceed $12 billion.
What happened to Garantex? U.S. Secret Service and European law enforcement seized Garantex's infrastructure in March 2025 and indicted two executives. The exchange's customer base migrated to Grinex and other successor platforms within weeks.
Are these exchanges still operating? Yes. Despite Bitpapa being sanctioned by OFAC in March 2024, it continues to operate. The other four exchanges remain active as of February 2026.
How does this affect regular crypto users? Users on exchanges with weak compliance screening face risks of asset freezes if their platform is found routing funds through sanctioned intermediaries. Using well-regulated exchanges and self-custody wallets reduces counterparty exposure.
Overview
Blockchain analytics firm Elliptic has identified five crypto exchanges, ABCeX, Exmo, Rapira, Bitpapa, and Aifory Pro, that collectively rebuilt Russia's crypto sanctions evasion infrastructure after Garantex was shut down in March 2025. ABCeX alone processed $11 billion from Garantex's former offices in Moscow's Federation Tower. Exmo's shared wallet infrastructure exposed the fiction of geographic separation. Aifory Pro introduced USDT-funded Apple Pay cards that bypass Russian service restrictions. The report arrives as the EU considers a blanket crypto transaction ban with Russian entities and U.S. enforcement shifts from targeting individual exchanges to mapping entire networks.
Recommended Reading
- Russia Built a $39 Billion Sanctions Pipeline on a Ruble Stablecoin
- Iran Rial Collapse Mirrors Lebanon Crisis as Citizens Turn to Bitcoin and Self-Custody
- Coinbase Custodies 80 Percent of US Crypto ETF Assets
