Original Title: "Beyond SWIFT (II) Moscow's Underground Ledger: Garantex, Cryptex, and the Shadow Settlement System"
Original Author: Anita (X: @Anitahityou)
Rhythm Note: This article is part of the "Beyond SWIFT" series. The previous article can be found here: "The World Beyond SWIFT: Russia and the Secret Economy of Cryptocurrency" . The following is the main content:
Three years after the West severed Russia's connection to SWIFT, the Kremlin has not fallen into financial suffocation. On the contrary, a massive "shadow financial machine" is operating within the Moscow Federation Tower.
This machine no longer relies on JPMorgan and is not afraid of dollar freeze orders. According to U.S. Treasury documents, blockchain analysis reports, and ICIJ investigative data, this machine is roughly composed of three interlocking layers:
Garantex (Black Market Hub), Cryptex (Secret Backup), and Exved / A7 System (National-level B2B Channel and "On-chain Ruble").
Phoenix Garantex—The Intersection of Gangsters and Oil Capital
On the U.S. Treasury's sanctions list, Garantex is a name that has long been marked red; in Russia's gray trade and capital flight system, it is an indispensable "clearinghouse."
1. On the surface, a trading platform, underneath are two dark rivers
Public information shows that Garantex was established in Moscow in 2019, with its registered office located in the Moscow landmark Federation Tower, co-founded by Stanislav Drugalev and Sergey Mendeleev among others. In April 2022, it was sanctioned by the U.S. OFAC for transactions related to the dark web market Hydra and ransomware Conti, with at least $100 million in transactions directly identified as related to criminal activities, but after the sanctions, it remains "one of the main channels for Russian funds to enter and exit the world."
ICIJ's investigation zooms in on the equity structure, and the picture begins to distort:
A company deeply bound to Garantex is called Fintech Corporation—it is both the owner of the Garantex App and the operator of brands like "Garantex Academy";
Russian company registration records show that Fintech holds a 50% stake in a debt collection company called "Academy of Conflicts," with the other half controlled by Alexander Tsarapkin, a "gang leader" convicted of extortion and sentenced to seven years in prison for his involvement in an extortion gang;
Fintech's key shareholder Pavel Karavatsky previously served on the board of Peresvet Bank, which was later taken over by Rosneft (Russian state-owned oil company); Fintech also initially used contact information and email domains related to Rosneft's logistics subsidiary.
Looking back at this cold paper chain of company registration reveals state oil capital + violent debt collection company + sanctioned cryptocurrency trading platform.
This does not mean that "Rosneft is operating Garantex," but it is enough to explain that Garantex's ability to continue processing billions of dollars in stablecoin liquidity despite the triple pressure from OFAC, Tether, and the EU is not solely due to "technology and entrepreneurial spirit."
It is a central gear embedded in a larger national—gray capital network.
Cryptex—The "Plan B" Wandering Alongside Garantex
As Garantex becomes a sample under regulatory spotlight, "doing only this and nothing else" becomes too dangerous for black and gray funds. The market will naturally grow backup routes, and Cryptex is one of the most typical.
1. The "Stealth Exchange" Named by OFAC
Cryptex also appears to be a "Russian cryptocurrency exchange platform," supporting instant exchanges between fiat and virtual assets. However, on September 26, 2024, the U.S. Treasury's OFAC added it and its operator Sergey Sergeevich Ivanov to the sanctions list, accusing it of providing money laundering and settlement services for "fraud shops, ransomware organizations, dark web markets, and other criminal activities."
Chainalysis's on-chain analysis shows that since 2018, Cryptex has processed approximately $5.88 billion in cryptocurrency transactions, a significant portion of which comes from "high-risk and even clearly illegal" source addresses. Another platform associated with Ivanov, PM2BTC, has been identified by FinCEN as a "primary money laundering concern," with nearly half of its business related to criminal activities.
If Garantex leans more towards being a "total clearing pool for rubles and stablecoins inside and outside Russia," Cryptex / PM2BTC's position is more like "a lighter, more anonymous entry point for criminal money laundering."
2. What cannot be killed is not a single platform, but an entire structure
Structurally, Cryptex plays the role of a typical "flank substitute": when Garantex's on-chain addresses are blacklisted in batches, many dark web shops, scam groups, and ransomware operators will shift their settlement channels to Cryptex or PM2BTC, which are non-KYC exchanges; and when Cryptex itself is sanctioned, a new "Cryptex 2.0" will emerge under a different name.
This is a "decentralized evasion" model:
(1) What regulators take down is the name, while the market grows the model itself.
(2) In this network, Garantex is the heavyweight host;
(3) Cryptex and PM2BTC are the front-end nodes specifically responsible for "receiving dirty money, washing it, and then sending it to Garantex or other channels."
Exved, A7A5, and PSB—The Prototype of Sovereign-level "Shadow Banking"
If Garantex is the black market and Cryptex is the gray industry, then the combination of Exved + A7 / A7A5 + PSB is closer to a national-level experimental project on-chain.
It is not meant to evade a single transaction, but to rewrite "how Russia pays abroad."
1. Exved: A USDT B2B Channel Dressed in Compliance
In December 2023, a "digital settlement trading platform" named Exved quietly launched in Moscow.
The official positioning is simple:
a. To provide cross-border digital payment services for local legal entities (businesses) in Russia
b. To support the use of Tether's USDT for external settlements
Almost all public reports emphasize three points: Exved is specifically aimed at export and import enterprises, not individual investors; it provides a front-end interface for businesses, which may display "dollars, USDT, or offshore rubles" on the front end, while the final settlement is completed through offshore accounts and partner institutions in the back end; the project is technically supported by the InDeFi Smart Bank team and has received approval from the Central Bank of Russia and the Federal Financial Monitoring Service (Rosfinmonitoring).
From a regulatory narrative perspective, Exved is an innovative pilot with KYC.
Structurally, it resembles: a "compliance shell + stablecoin channel" built for enterprises after traditional banks were sanctioned and locked down.
It does not directly issue any new currency but incorporates existing USDT under a state-recognized B2B shell.
2. A7 and A7A5: The True Emergence of the Ruble Version of "Shadow Stablecoin"
If Exved is still at the level of "using USDT for cross-border settlements," then A7 / A7A5 is the next step—putting the ruble itself on-chain.
Elliptic's report "A7 Leak" breaks down this system clearly:
a. A7 is a group company specifically aimed at Russian enterprises for cross-border payments and sanctions evasion;
51% of the shares are held by Moldovan oligarch Ilan Shor—he was convicted due to the "big hole case" in the Moldovan banking sector in 2014 and was sanctioned by the U.S. for undermining Moldovan elections for Russia;
Another major shareholder is the Russian state-owned defense bank Promsvyazbank (PSB).
b. A7A5 is the ruble stablecoin developed by A7:
The issuing entity is Old Vector LLC, registered in Kyrgyzstan;
Each A7A5 is claimed to be backed 1:1 by ruble deposits held in PSB accounts;
As of mid-2025, approximately 41.6 billion A7A5 are in circulation, with a total transaction volume of about $68 billion;
Reuters cites data from Elliptic and TRM Labs stating that the cumulative transfer scale of A7A5 has exceeded $40 billion, with daily transaction peaks exceeding $1 billion, and its market value skyrocketed from $17 million to $52.1 million within two weeks.
More importantly, the relationship between it and USDT is not one of substitution, but a kind of "dual-layer structure":
From the internal chat records disclosed by Elliptic, A7 employees discussed using at least $1 billion to $2 billion in USDT to provide liquidity for A7A5 on various trading platforms—first using USDT to create liquidity, then swapping the chips for A7A5 to make it appear "like a deep stablecoin market";
In July 2025, the official A7 Telegram channel directly announced the injection of $100 million equivalent in USDT liquidity into the A7A5 DEX to meet market demand for "optimal prices between A7A5 and USDT."
Under this combination of strategies, A7A5's role becomes very clear: it is an "on-chain ruble liability" anchored to the PSB balance sheet, using USDT as a credit engine to evade Tether freeze risks.
For Russian enterprises, this means that even if they are kicked out of SWIFT and bank accounts struggle to complete cross-border payments, they can still:
Ruble → Deposit in PSB → A7A5 → Settle goods on-chain → Then exchange back to local currency or USDT.
From the outside, this is a technical product; from a geopolitical perspective, it resembles a "ruble version of a shadow central bank pipeline" built outside the SWIFT system.
In Elliptic's "A7 Leak" report, there is a particularly striking segment:
The A7 group not only helps Russian companies circumvent sanctions to purchase components and negotiate freight but is also used to support political engineering within Moldova;
Leaked documents and on-chain records show that funds under Shor flow through stablecoins to a network of applications and organizations called "Taito," used to distribute rewards to political activity participants and pay for propaganda;
The U.S. and EU explicitly accuse Shor in their sanctions rationale of "using funds and a false information network to undermine Moldovan democracy," and A7, along with its crypto channel, is seen as one of the critical infrastructures for this activity.
This does not mean we can simply conclude that "PSB + A7A5 = directly giving USDT to voters in a certain region to buy votes"; public materials are still insufficient to draw such fine lines.
But it is certain that the same financial infrastructure is both helping Russian companies buy goods and circumvent sanctions, while also providing a funding distribution tool for political influence actions.
When the sovereign bank (PSB), shadow payment group (A7), and on-chain stablecoin (A7A5) are tied together,
money is no longer just an "economic variable," but a cross-border, programmable geopolitical weapon.
Below SWIFT is the dollar, beyond SWIFT is the shadow network
If we abstract all of this into a diagram, you would see the following structure:
Garantex: Aggregates Russian retail investors, gray trade, dirty money, and some energy-related funds into a "black market clearing pool for ruble ↔ stablecoin";
Cryptex / PM2BTC and similar non-KYC exchanges: Provide a front-end entry point for ransomware, scam shops, and some sanctioned entities to "get in and wash money";
Exved + A7 / A7A5 + PSB: Extend this network from "civilian and black" to "semi-official B2B payments" and "on-chain ruble sovereignty projects"—breaking down what could originally only be calculated on the central bank's balance sheet into a token that can jump on Tron and Ethereum.
In this network, USDT is the blood, PSB's ruble deposits are the skeleton, Garantex / Cryptex are the capillaries, and A7A5 is a newly grown heart valve—its existence is to keep this circulation beating outside of SWIFT.
This is not a mere jest at sanctions but a pressure test regarding the limits of the global financial order.
When a major country expelled from SWIFT begins to skillfully use stablecoins, shadow platforms, and its own "on-chain ruble" to complete trade and political engineering, the question is no longer: "Can Russia be sanctioned?" but rather: "Will a financial sewer system that can never be cleaned grow outside the dollar and SWIFT?"
And the machine operating in the Moscow Federation Tower is just the first segment of this sewer.
References
1>https://home.treasury.gov/news/press-releases/jy0713
2>https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-list-data-formats
3>https://www.icij.org/investigations/shadow-money/
4> FinCEN – Advisory FIN-2023-A002
5>https://tass.ru/ekonomika
6>OFAC Notice – September 26, 2024
7>U.S. Treasury Press Release – April 5, 2022
8>Chainalysis Crypto Crime Report 2023
9>https://cryptonews.com/news/russias-exved-launches-cross-border-payment-service-powered-by-tethers-usdt-stablecoin
10> https://en.wikipedia.org/wiki/Garantex?utm_source=chatgpt.com
11>https://www.chainalysis.com/blog/ofac-sanctions-russian-exchange-cryptex-uaps-fraud-shop-2024/?
12>https://zh.spaziocrypto.com/wen-ding-bi/e-luo-si-wen-ding-bi-a7a5-zai-4-ge-yue-nei-liu-dong-93-yi-mei-yuan
This article is from a submission and does not represent the views of BlockBeats.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
