UPDATE 10/24/25: The European Commission adopts its 19th package of sanctions against Russia
On October 23, 2025, the European Commission adopted its 19th package of sanctions against Russia, in view of Russia’s continued and escalating aggression against Ukraine. The package includes financial measures that detail a transaction ban on the A7A5 stablecoin and two affiliated Kyrgyz firms, Old Vector and Grinex. The package also sanctions five additional Russian banks and five banks across Kyrgyzstan and Tajikistan.
UPDATE 8/20/25: OFSI sanctions Grinex, Old Vector, and Meer for Russian Sanctions Evasion via Kyrgyzstani Crypto Networks
On August 20, 2025, the UK’s Office of Financial Sanctions Implementation (OSFI) also sanctioned Garantex successor Grinex and the Kyrgyzstani company Old Vector LLC; in addition, OFSI sanctioned the Kyrgyzstani company CJSC Tengricoin, which operates the crypto exchange Meer.kg, mentioned below as a key facilitator of A7A5 trades. Also included in this designation were the individuals Leonid Shumakov, Kantemir Kaparbekovich Chalbayev, and Zhanyshbek Uulu Nazerbak and the entities OJSC Capital Bank of Central Asia and Altair Holding SA. OFSI’s designations today denote a key enforcement action to disrupt crypto and financial networks used by Russia to evade sanctions.
TL;DR
- A7A5 is a Russian ruble-backed token issued by the Kyrgyzstani company Old Vector, which was sanctioned today. It is backed by deposits at sanctioned Russian bank Promsvyazbank (PSB) and has seen significant trading volume increases since inception, processing over $51.17 billion. Grinex, which was also designated by OFAC in today’s action, has been the primary platform facilitating A7A5 trades.
- The token operates within a narrow ecosystem of Russian-linked financial services and platforms, with trades occurring most frequently between Monday and Friday, suggesting it is intended as an internal medium of exchange for businesses, rather than a retail token designed for mainstream use.
- A decentralized exchange (DEX) enabling A7A5 to mainstream stablecoin swaps raises concerns about potential sanctions evasion by providing a bridge to mainstream cryptocurrency services.
- Early A7A5 token liquidity for Grinex can be traced back to Garantex, providing a clear on-chain link between the two services.
- The inception of A7A5 and its observed usage falls in line with Russian legislation passed last year that signaled a deliberate effort to build alternative financial infrastructure to mitigate the effect of Western sanctions.
In a sweeping enforcement action, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has re-designated cryptocurrency exchange Garantex and sanctioned its successor, Grinex, along with companies affiliated with the Russian ruble-backed token, A7A5. Among those, the Kyrgyzstani company, Old Vector, was sanctioned for its role in working with Garantex and the Russian company A7 LLC and its subsidiaries to create and distribute the A7A5 token. Backed by the Russian ruble, A7A5 was designed to provide a cross-border settlement platform in an effort to evade international sanctions.
Garantex has facilitated over $100 million in illicit transactions tied to ransomware actors and darknet markets since 2019. Despite being sanctioned in 2022, the exchange continued its operations by building infrastructure to obfuscate its activity on the blockchain and provide services to sanctioned entities and other illicit actors. In March 2025, U.S. and international law enforcement disrupted Garantex’s operations, seizing infrastructure and indicting senior leadership, prompting the creation of Grinex.
Additionally, key Garantex executives, including Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky, have actively supported the Garantex platform’s role in facilitating cybercrime and sanctions evasion by securing infrastructure, legitimizing operations, and leveraging partner networks to move illicit funds beyond Russia. OFAC has designated these individuals, along with affiliated entities, InDeFi Bank and Exved, for their roles in enabling crypto-mediated trade in an effort to evade sanctions.
Today’s designation highlights how the Russian ruble-backed token plays a significant role in facilitating sanctions evasion and denotes an evolutionary step in line with Russian legislation passed last year legalizing the use of crypto for cross-border payments.
This blog explores A7A5’s origins, its ties to the sanctioned exchanges Garantex and Grinex, and its role in the Russian crypto ecosystem.
What is A7A5?
A7A5 is a Russian ruble-backed token traded on the Tron and Ethereum blockchains. It is issued under Kyrgyzstan regulations, but backed by ruble deposits held at PSB, a Russian bank subject to sanctions in multiple jurisdictions. A7A5 was initially developed for customers of A7 LLC, a Russian company sanctioned today by OFAC, and previously by the European Union and the UK for facilitating cross-border sanctions evasion. Additionally, A7 LLC is tied to fugitive businessman Ilan Șor, who is wanted for fraud and election interference in Moldova.
In recent months, trading volumes have steeply increased for the token. Through the end of July 2025, A7A5 has processed over $51.17 billion in volume. The number of services offering A7A5 trades is limited to a fairly small subset of exchanges, primarily those with Russian ties, with the highest volumes processed through Grinex.
Notably, A7A5 trading occurs predominantly on a limited schedule between Monday and Friday, suggesting that A7A5 is a medium of business exchange as opposed to a retail token. Further, an obscure decentralized exchange (DEX) facilitating trades from A7A5 to dollar-backed stablecoins raises potential concerns about the ruble-backed token entering the mainstream crypto ecosystem.
Contact information on A7A5’s official website is no longer available, but it previously listed a representative office at Federation Tower. This Moscow City skyscraper serves as an operational headquarters for several cryptocurrency businesses that have facilitated extensive money laundering. These include multiple sanctioned exchanges such Suex, Chatex, Garantex, and Crypto Explorer DMCC, as well as other Russian exchanges, such as Rapira.
While A7A5 growth was initially slow, trading volumes surged to a peak of 524.8 billion tokens moved in the week of July 21, worth approximately $6.66 billion. Growth in the overall circulation of A7A5 corresponds with key events, as shown in the graph below. A7A5 volumes sharply increased following the Garantex takedown and subsequent launch of Grinex in mid-March; the launch of the Kyrgyzstani exchange Meer at the beginning of April; and the A7A5 launch on the sanctioned Russian exchange Bitpapa in mid-June. While each of these events individually may not signal a direct impact on the overall increase in activity, these moves highlight broadened access to the token and greater adoption in the Russian cryptocurrency ecosystem.
Unlike mainstream tokens that aim for global adoption, A7A5 seems to serve a notably narrow purpose: facilitating transactions within a limited ecosystem. The tokens’ limited utility and controlled circulation suggest it was designed to serve as an internal medium of exchange rather than a broadly traded cryptocurrency.
A7A5 trading is currently offered on a limited number of services, several of which have notable Russia ties, including:
- Grinex is registered in Kyrgyzstan and has been confirmed as the successor to the sanctioned Russian exchange Garantex. Grinex was accepting transfers from Garantex customers at Federation Tower nearly immediately after the shutdown (see section below for more information on the relationship between Garantex and Grinex).
- Bitpapa is a peer-to-peer (P2P) exchange sanctioned by OFAC that facilitated millions in payments for OFAC-designated Russian cryptocurrency businesses Garantex and Hydra, the darknet market, as well as various other illicit actors.
- Meer was officially registered in Kyrgyzstan around the same time as the launch of A7A5 and was one of the first services to advertise A7A5 trading on its platform.
In addition to A7A5’s usage on only a limited number of services, its weekly trading patterns also reveal its limited use within a relatively closed ecosystem. A7A5 trades occur predominantly during the typical Monday-Friday work week. The largest volume of trades occurs at the beginning of the work week, with volumes tapering off later in the work week and very limited trades on weekends.
These trading patterns suggest that A7A5 is primarily being used by businesses operating Monday through Friday, which would align with Russia’s legislative goals of facilitating cross-border transfers for Russian businesses via cryptocurrency.
What is the A7A5 DEX?
While A7A5’s distribution and usage is limited to a closed ecosystem, an A7A5 DEX that facilitates trading from A7A5 to mainstream stablecoins opens the door for swapped A7A5 to enter the broader crypto ecosystem beyond Russia. Using A7A5 reserves and other stablecoin liquidity from its operator as a balance sheet, the A7A5 DEX enables swaps between A7A5 and mainstream stablecoins, with new liquidity releases advertised on its social media pages on a daily basis. It’s worth noting that, unlike typical DEXs, where the swap ratio is set by the market, the A7A5 DEX uses a centrally controlled swap ratio.
To date, $1.46 billion of value associated with A7A5 has moved through this DEX, with downstream stablecoin funds reaching several mainstream services, no-KYC exchanges, and payment processors with Russian links, further expanding the reach of A7A5.
What is the relationship between A7A5, Garantex, and Grinex?
As discussed above, A7A5’s native token usage is limited to a small number of services and the highest volumes of A7A5 trading occurs on Grinex. Let’s explore what these links are.
Garantex’s takedown in March resulted in the seizure of their domains and servers and the freezing of over $26 million in illicit funds. In the wake of the takedown, users scrambled to find out if funds in their Garantex accounts were still available, and if so, how they could access them.
In several social media posts, users claimed they were able to transfer their funds over to a new service called Grinex by visiting Garantex’s office at Federation Tower.
While these off-chain data points indicated signs of a rebrand, on-chain data also demonstrated a strong relationship between the two services. Users who had previously sent funds from the Garantex platform began to process withdrawals through Grinex after the Garantex shut down. The Chainalysis Reactor graph below shows a representative subset of those users:
Another on-chain link was the movement of A7A5 tokens from Garantex to Grinex following the Garantex takedown via the sanctioned Kyrgyzstani company Old Vector. Garantex had received newly minted A7A5 tokens as far back as February (remember, the A7A5 token contracts were created in late January). Following the Garantex takedown on March 6, a large volume of A7A5 tokens were transferred from Old Vector to Garantex and were later burned on March 10.
On the same day, the same amount of tokens burned by Garantex were minted into circulation and deposited back into a wallet associated with Old Vector. The funds ultimately reached Grinex, providing it with newly minted A7A5 liquidity. Therefore, it appears likely that tokens burned by Garantex were minted to be provisioned to this new rebranded entity, Grinex.
While off-chain claims of Garantex’s connections to Grinex were convincing, the immutability and transparency of the blockchain provided even stronger evidence linking the two operations.Today’s designation verifies these inextricable links between entities.
Implications for sanctions compliance and monitoring
Russia’s evolving cryptocurrency legislation in the past year, particularly the legalization of mining and cross-border crypto payments, signaled a deliberate effort to build alternative financial infrastructure in an attempt to mitigate Western sanctions. Our on-chain analysis has shown how this strategy has been employed across various ecosystems, including sanctioned Russian cryptocurrency exchanges, laundering services, military procurement networks, and even weapons and commodity trade. Entities in these networks have facilitated high volumes of transfers, providing crypto-to-crypto or ruble-to-crypto liquidity. They have offered potential pathways for sanctions evasion to be conducted via cross-border transactions outside of traditional financial systems. Today’s designation further reinforces Russia’s efforts to evade sanctions through facilitating cryptocurrency payment rails. However, the transparency of the blockchain presents an opportunity to identify and disrupt these networks.
The emergence of the A7A5 network sanctioned today further illustrates how Russia is operationalizing these alternative payment rails. Through the end of July, A7A5 has processed over $51.17 billion in volume, with patterns of activity suggesting use by entities operating within the business work week. Backed by sanctioned Russian institutions, A7A5 is providing a new, crypto-native avenue to bypass the ever tightening sanctions against Russia. Time will tell if A7A5 will expand to a larger retail market, as a newer offering advertised on A7A5’s website allows users to purchase A7A5 tokens with PSB bank cards.
With Chainalysis’ solutions, organizations can monitor and detect exposure to high-risk activity associated with the entities sanctioned today, including cryptocurrency addresses for Garantex, Grinex, and Old Vector. Additionally, our cross-chain monitoring capabilities enable real-time tracking of A7A5 , while Chainalysis Sentinel provides a comprehensive view of token ecosystems by analyzing risk exposure across more than 35 categories and monitoring daily transactions, giving an ecosystem view of tokens like A7A5. Chainalysis continues to monitor these developments closely, helping partners and governments identify emerging risks and enforce global compliance standards.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.