The World Beyond SWIFT (Part 2) Moscow’s Underground Ledger: Garantex, Cryptex, and Shadow Settlement System

Surface is a Trading Platform, Underneath are Two Dark Rivers

Public information shows that Garantex was established in Moscow in 2019, with its registered office located in the Moscow landmark Federation Tower, co-founded by individuals such as Stanislav Drugalev and Sergey Mendeleev. In April 2022, it was sanctioned by the US OFAC due to associated transactions with the darknet market Hydra, ransomware Conti, among others. At least $100 million in transactions were directly identified as related to criminal activities, but after the sanctions, it remains “one of the main channels for Russian funds in and out of the world”.

The ICIJ investigation has pushed the spotlight beyond ownership structures, and the image begins to distort:

• •
  A company deeply linked to Garantex is named Fintech Corporation — it is both the owner of the Garantex App and the operator of brands such as “Garantex Academy”;
• •
  Russian company registration records show that Fintech holds a 50% stake in a debt collection company named “Academy of Conflicts,” with the other half controlled by “gang leader” Alexander Tsarapkin, who was convicted of extortion and sentenced to seven years in prison for his involvement in an extortion ring;
• •
  Fintech’s key shareholder Pavel Karavatsky previously served on the board of Peresvet Bank, which was later taken over by Rosneft (Russian state-owned oil company); Fintech also initially used contact information and email domains related to a Rosneft logistics subsidiary.

Looking back along the cold paper chain of company registrations reveals a combination of state oil capital + violent debt collection company + sanctioned crypto exchange.

This does not mean “Rosneft is pulling the strings at Garantex,” but it is enough to illustrate that Garantex’s ability to continue processing billions of dollars’ worth of stablecoin liquidity after facing pressure from OFAC, Tether, and the EU is not solely dependent on “technology and entrepreneurial spirit.”

It is a central gear embedded in a larger network of state—grey capital.

OFAC-Designated “Stealth Exchange”

On the surface, Cryptex is also a “Russian cryptocurrency exchange platform” that supports instant exchange between fiat and virtual assets. However, on September 26, 2024, the U.S. Treasury’s OFAC added it, along with its operator Sergey Sergeevich Ivanov, to the sanctions list, accusing it of providing money laundering and settlement services to “fraud shops, ransomware organizations, dark web markets, and other criminal activities.”

Chainalysis' on-chain analysis has shown that since 2018, Cryptex has processed approximately $58.8 billion worth of cryptocurrency transactions, a significant portion of which originated from “high-risk to clearly illicit” source addresses. Another platform associated with Ivanov, PM2BTC, has been identified by FinCEN as a “primary money laundering concern,” with almost half of its business linked to criminal activity.

If Garantex leans more towards a “Russian ruble-stablecoin total settlement pool” both domestically and internationally, Cryptex / PM2BTC’s position is more geared towards a “lighter, more anonymous criminal money laundering entry point.”

What Doesn’t Kill Them is Not Just Any Single Platform, but an Entire Type of Structure

Structurally, Cryptex plays the role of a typical “sidekick decoy“: when batches of Garantex’s on-chain addresses are blacklisted, many dark web stores, scam syndicates, and ransomware operators redirect their settlement channels to Cryptex or PM2BTC-like KYC-free exchanges; and when Cryptex itself is sanctioned, a new “Cryptex 2.0” will appear under a different name.

This is a form of “decentralized evasion”:

• •
  Regulators take down the names, but the market generates the pattern itself.
• •
  In this network, Garantex is the heavyweight host;
• •
  Cryptex and PM2BTC act as frontend nodes specialized in “receiving dirty money, laundering it once, and then funneling it back to Garantex or other channels.”

Exved: USDT B2B Channel in Compliance Clothing

In December 2023, a “digital settlement exchange” named Exved quietly launched in Moscow.

The official positioning is quite simple:

• •
  To provide cross-border digital payment services to Russian local legal entities (businesses)
• •
  To support settlement using Tether’s USDT

Almost all public reports emphasize three points: Exved is specifically aimed at export and import enterprises, not retail customers; it provides an interface for businesses where the frontend may display “USD, USDT, or non-resident ruble (offshore ruble),” while the backend settles through offshore accounts and partner institutions; the project is technically supported by the InDeFi Smart Bank team and has obtained approval from the Central Bank of Russia and the Federal Financial Monitoring Service (Rosfinmonitoring).

From a regulatory narrative perspective, Exved is an innovative pilot with KYC.

Structurally, it looks more like: After traditional banks were locked out due to sanctions, it has paved the way for enterprises with a “compliant shell + stablecoin channel.”

It is not directly responsible for issuing any new coins but rather incorporates existing USDT under a nationally recognized B2B facade.

A7 and A7A5: The True Emergence of the Ruble-based “Shadow Stablecoin”

If Exved is still at the stage of “using USDT for cross-border settlement,” then A7 / A7A5 is the next step—putting the ruble itself on the blockchain.

Elliptic’s “A7 Leak” report lays out this system very clearly:

A7 is a group company specializing in cross-border payments for Russian enterprises and sanctions evasion;

• •
  51% of the shares are held by the Moldovan tycoon Ilan Shor—he was convicted in the 2014 “Moldovan bank fraud case” and sanctioned by the US for disrupting Moldova’s elections on Russia’s behalf;
• •
  Another major shareholder is the Russian state-owned defense bank Promsvyazbank (PSB).

A7A5 is a Ruble Stablecoin Developed by A7:

• •
  The issuer is registered in Kyrgyzstan as Old Vector LLC;
• •
  Each A7A5 token is claimed to be backed 1:1 by Ruble deposits held in a PSB account;
• •
  As of mid-2025, there are approximately 41.6 billion A7A5 tokens in circulation, with a total trading volume of around $68 billion;
• •
  Reuters cited data from Elliptic and TRM Labs stating that the cumulative transaction volume of A7A5 has surpassed $40 billion, with daily trading peaks exceeding $1 billion, and its market capitalization soared from $170 million to $521 million in two weeks.

More importantly, it does not have a substitute relationship with USDT but rather a “double-layered structure”:

Based on internal chat records disclosed by Elliptic, A7 staff have discussed using at least $10-20 billion worth of USDT to provide liquidity for A7A5 on various trading platforms—first injecting liquidity with USDT and then converting the chips to A7A5 to create “a deep stablecoin market”;

In July 2025, the A7 official Telegram channel directly announced injecting $100 million worth of USDT liquidity into the A7A5 DEX to meet the demand for “best price A7A5 ↔ USDT” in the market.

In this combination, the role of A7A5 becomes very clear: It is a “chainable Ruble liability” on the PSB balance sheet, using USDT as a credit engine to mitigate Tether freezing risks.

For Russian businesses, this means that even if they are kicked out of SWIFT and face difficulties with cross-border payments through traditional banking channels, they can still:

RUB → Deposit into PSB → A7A5 → Settle funds on-chain → Convert back to local fiat or USDT.

Externally, this may appear as a technological solution, but from a geopolitical perspective, it resembles a “Ruble Shadow Central Bank Pipeline” built outside the SWIFT system.

An excerpt from Elliptic’s “A7 Leak” report is particularly striking:

• •
  The A7 Group not only helps Russian enterprises navigate purchasing parts and discussing freight costs but has also been used to support political engineering within Moldova;
• •
  Leaked documents and on-chain records show that funds under Shor’s control flowed through stablecoins to a network and application suite named “Taito,” used to compensate political actors and cover propaganda expenses;
• •
  The US and the EU, in their sanction justifications, specifically accuse Shor of “using funds and a misinformation network to undermine Moldova’s democracy,” with A7 and its encrypted channel seen as critical infrastructure for this activity.

This does not imply that we can simply conclude that “PSB + A7A5 = Directly sending USDT to voters in a specific region,” as the publicly available information is not yet sufficient to draw such detailed connections.

However, what is certain is that with the same financial infrastructure supporting Russian businesses in evading sanctions, it is also providing a fund distribution tool for political influence operations.

When the sovereign bank (PSB), shadow payment group (A7), and on-chain stablecoin (A7A5) are intertwined, money ceases to be just an “economic variable” and becomes a cross-border, programmable geopolitical weapon.