Less than two weeks after it was removed by the international law enforcement authorities, the guaranteex-a Russian crypto exchange, popular with ransomware gangs and sanctions-evading oligarchs is already already risen from the ash and redirects himself as Grinex.

According to a new report by Swiss Blockchain Analysis Company Global Ledger, a number of data on and off-chain data indicates that Grinex is a direct successor to Garantex. Some liquidity from Garantex, including all Garantex’s holdings of a ruble-supported stableecoin called A7A5, has already been moved to Grinex-controlled wallets.

Global Ledger CEO Lex Fisun told Coindesk that in addition to on-chain data connecting Garantex with Grinex, there have been several off-chain indications that the two exchanges are closely linked. Fisun pointed to the rapid growth of Grinex, which he said had surpassed $ 40 million in volume in just two weeks, as well as a number of social media bands between the two exchanges.

Although other major blockchain analysis companies, including TRM laboratories and chainalysis, have not yet confirmed Global Ledger’s conclusions, Chainalysis’s leader of the National Security Information Andrew Fierman told Coindesk that he had seen several indicators that Grinex was likely to be the Rebrand of Garantex.

Fierman pointed to a recent Telegram commentary from Sergey Mendelev, one of the original founders of Garantex who announced the creation of Grinex and claimed similarities between the two exchanges, was random – followed by two crying laughter emojis. Both Fierman and Fisun told Coindesk that there were several reports of Garantex users who were going to Garantex’s personal offices in Europe and the Middle East and transfer their crypto from Garantex to Grinex. Both also pointed out the similarities of the two platforms user interfaces.

Although the evidence is certainly convincing, Fierman said until Chainalysis ends his review of Grinex’s infrastructure, it cannot definitely validate the accuracy of the global headbox report.

But if Grinex is actually a rebrand of Garantex, it would not be the first time a sanctioned exchange is reintroduced himself after a shutdown. In 2017, the Russian crypto exchange BTC-E was removed by US law enforcement and then redirected as Wex. However, wex did not last a year later due to internal conflict and struggle between its remaining leadership. Similarly, sanctioned Russian exchange was redirected as Chatx and was then sanctioned again.

The problem of sanctions

The rapid resuscitation of the Garantex demonstrates the challenge of sanctions, especially against criminal operations such as non-compatible exchanges, Darknet-Marketsplaces and Ransomware Bands that can simply multiply to avoid detection.

“Sanctions evasion will happen,” Fierson said. “Because if you are sanctioned, you will not just accept that you can no longer implement any financial transactions. You will look to avoid detection, but it can be, whether it is creating shell companies, creating new crypto cartoons -and the greater the operation and the more prominent, the more technically advanced you have to be to actually work.”

Feirson said this problem is not unique to crypto, but crypto-related sanctions give law enforcement a unique opportunity to follow the money after sanctions are imposed.

“The unique aspect of blockchain is that it is transparent and unchanging, and then what happens when a company is closed is much more examined,” Fierson said. “There is much more to examine on-chain. Guarantee is shut down, their binder is seized, but it does not prevent them from moving other assets. There is the opportunity to monitor what happens to these funds after office shutdown.”

A hydra-like network of potential successors

Whether Grinex is Garantex 2.0 or not, there are a number of other non-compatible Russian crypto exchanges that are eager and willing to take its place.

Ari Redbord, Global Head of Politics and Government Affairs at TRM Labs, Coindesk told that it was simply “premature” to definitely assess the relationship between Grinex and Guantex. “That being said, it is clear that other non-complied exchanges at high risk will try to fill the illegal financing left by Guantex,” he added.

A recent client report from TRM Labs appointed several possible successors, including Russian high-risk exchanges ABCEX and KEINE exchange.

Garantex is taking down

Garantex was wound up by international law enforcement from the US, Germany and Finland in a joint operation earlier this month seizing its domain and serving.

The U.S. Ministry of Finance for Foreign Asset Control (OFAC) first sanctioned the exchange in 2022, accused it of deliberately ease of money laundering to ransomware -bands such as Black Basta and Conti, as well as darknet markets such as Hydra.

According to court documents, the clientele also included North Korea’s state-sanctioned hacking team Lazarus group, which was behind the recent $ 1.4 billion bybit hack, as well as Russian oligarchs who used the service to avoid sanctions following Russia’s invasion of Ukraine.

Two of Guaranteex’s operators, Lithuanian national and Russian resident Aleksej Besciokov and Russian citizen and the United Arab Emirates, which residents Aleksandr Mira Serda has been indicted for having money laundering in connection with their work with Garantex. Besciokov was arrested while on vacation with his family in India earlier this month, and is expected to be handed over to the United States to face charges.