Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesOn September 26, 2024, the U.S. Treasury Department used several authorities against a Russian-linked cryptocurrency laundering network: the Office of Foreign Assets Control (OFAC) designated the Cryptex exchange and alleged money launderer Sergey “Taleon” Ivanov; the Financial Crimes Enforcement Network (FinCEN) identified PM2BTC as a “primary money laundering concern”; and U.S. and Dutch authorities seized related domains and infrastructure. The measures disrupted important payment channels, but later enforcement showed that successor services can emerge.
What happened on September 26, 2024?
The Treasury action was a coordinated financial, law-enforcement and diplomatic operation, not simply a list of newly sanctioned websites. According to the Treasury announcement:
- OFAC designated Cryptex, an exchange registered in St. Vincent and the Grenadines but operating in Russia.
- OFAC designated Sergey Sergeevich Ivanov, also known as “Taleon,” whom Treasury described as a Russian money launderer serving ransomware actors, initial-access brokers, darknet-market vendors and other criminal services.
- FinCEN identified PM2BTC as a primary money-laundering concern under section 9714(a) of the Combating Russian Money Laundering Act.
- The U.S. Secret Service, Netherlands Police and Dutch FIOD seized websites or infrastructure linked to PM2BTC, UAPS and Cryptex.
- Prosecutors unsealed an indictment charging Ivanov and Timur Shakhmametov, while the State Department offered up to $10 million for information leading to Ivanov’s arrest or conviction.
The legal distinction matters: Cryptex and Ivanov were OFAC designations. PM2BTC was targeted through FinCEN’s separate anti-money-laundering authority, which restricts specified financial dealings. Calling both exchanges simply “sanctioned” loses that difference.
Who were Cryptex, PM2BTC and Ivanov?
Cryptex
Treasury said Cryptex had received more than $51.2 million in funds derived from ransomware attacks. It also attributed more than $720 million in transactions to Cryptex involving services frequently used by Russian cybercriminals, including fraud shops, mixers, exchanges with weak or absent know-your-customer controls and Garantex. These are government allegations and attributed transaction analyses, not a finding that every Cryptex customer or payment was criminal.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
PM2BTC
FinCEN said PM2BTC facilitated direct cryptocurrency-to-ruble exchanges, used U.S.-sanctioned financial institutions and helped enable sanctions evasion. Nearly half of the activity FinCEN examined had links to illicit activity, and the service allegedly lacked a credible anti-money-laundering and KYC program. The FinCEN order prohibits certain covered financial institutions from transmitting funds involving PM2BTC.
Ivanov
Treasury alleged that Ivanov processed hundreds of millions of dollars for criminal actors, functioning as a financial facilitator rather than as a ransomware operator. The government’s description connects him to multiple cybercrime services; it does not establish that he personally operated every ransomware campaign whose proceeds allegedly passed through the network.
How exchanges fit into a ransomware money trail
Ransomware groups typically demand virtual currency, but payment is only the beginning of the financial chain. A facilitator can aggregate payments, move assets between wallets, convert cryptocurrency into rubles or other fiat currency, and provide liquidity to criminal customers. Mixers, darknet markets, fraud shops, over-the-counter brokers and exchanges with weak controls can add further layers.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- A victim pays a ransom to a wallet controlled by an extortion group.
- Funds move through additional wallets or services to obscure the source and consolidate balances.
- An exchange or broker converts cryptocurrency or arranges fiat settlement.
- Proceeds may be withdrawn, transferred to other criminal services or reinvested in infrastructure.
The strongest official record for the September 2024 case concerns this financial-facilitation role. It does not support describing Cryptex or PM2BTC as ransomware gangs themselves. In a later action, Treasury linked Garantex-related transactions to proceeds associated with Conti, Black Basta, LockBit, NetWalker, Phoenix Cryptolocker and Ryuk; those references provide context for the laundering ecosystem, not proof that every exchange transaction was a ransom payment.
Recommended Free Tools
What the measures mean legally
OFAC designations
When OFAC designates a person or entity, property and interests in property in the United States or in the possession or control of U.S. persons are blocked. U.S. persons generally may not transact with the blocked party. Banks, exchanges, custodians and other covered businesses can face enforcement exposure if they process prohibited transactions. OFAC’s 50 Percent Rule can also apply to entities owned, directly or indirectly, 50% or more by blocked persons, even when that entity has a different name.
FinCEN’s PM2BTC action
FinCEN’s “primary money-laundering concern” finding is not an OFAC designation. It allows Treasury to prohibit or condition specified transactions between PM2BTC and covered financial institutions. Compliance teams must follow the terms of the order rather than assume that the two authorities have identical effects.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Why a live website proves nothing
A domain that still resolves, an app that remains downloadable or a transaction that appears to process outside the United States is not evidence that a service is permissible. Screening should consider aliases, ownership, wallet addresses, counterparties, intermediaries and the full transaction context.
Garantex and the successor-service problem
Garantex provides the clearest precedent. OFAC designated it on April 5, 2022, after Treasury said it had processed more than $100 million associated with illicit actors and darknet markets, including nearly $6 million linked to Conti and about $2.6 million linked to Hydra. Estonia’s financial-intelligence authorities had revoked Garantex’s license in February 2022 after identifying anti-money-laundering and counter-terrorist-financing deficiencies and links to criminal wallets. See the 2022 Treasury action.
On March 6, 2025, U.S., German and Finnish authorities disrupted Garantex infrastructure, seized its web domain and froze more than $26 million in cryptocurrency, according to Treasury. The Justice Department unsealed indictments against Garantex executives the next day. Treasury later said customer funds and activity moved toward Grinex, including through the ruble-backed A7A5 digital asset. On August 14, 2025, OFAC designated Grinex and related people and companies, describing it as Garantex’s successor and alleging that Garantex personnel created it to continue operations despite sanctions and asset freezes. The account appears in the 2025 Treasury announcement.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
This sequence illustrates why a designation is a disruption, not a guaranteed permanent shutdown. Networks may rebrand, register new entities, migrate customers and balances, use peer-to-peer or over-the-counter settlement, and fragment activity across jurisdictions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What businesses and exchanges should do
- Screen customers, beneficial owners, aliases, wallet addresses and counterparties against current sanctions information.
- Assess indirect exposure through nested exchanges, mixers, bridges, OTC brokers, stablecoins and successor brands.
- Investigate unusual ruble settlements, rapid pass-through activity and links to known criminal infrastructure.
- Escalate potential matches, preserve transaction records and document the decision to release, reject or freeze funds.
- Obtain sanctions counsel and consider applicable suspicious-activity reporting obligations when a transaction may involve blocked property or illicit proceeds.
A wallet not named on an OFAC list can still present risk through ownership, attribution, a sanctioned intermediary or transaction circumstances. Conversely, a transaction involving a flagged wallet may involve an unwitting victim; resolution requires documented, risk-based analysis rather than an automatic assumption about every customer.
What ordinary crypto users should know
The action did not make all cryptocurrency activity in Russia illegal, and it did not mean every Russian user or exchange was sanctioned. It did mean that a user can face blocked funds or account restrictions when a transaction path touches a designated person, entity or wallet.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
- Do not assume that a non-U.S. exchange is outside U.S. sanctions risk.
- Verify the legal entity and beneficial owners behind a service, not just its brand or domain.
- Check withdrawal destinations and intermediaries before sending funds.
- Keep invoices, wallet records, transaction hashes and correspondence that explain legitimate activity.
- If funds may have a sanctions nexus, stop moving them and seek qualified legal advice before attempting a refund or conversion.
Why the 2024 action still matters
The operation combined designations, a FinCEN restriction, domain seizures, an indictment and a reward offer. That whole-of-government approach can cut liquidity, banking access, infrastructure and counterparties at the same time. It also publicly identifies aliases, companies and transaction patterns that help other institutions improve screening.
Its limits are equally important: sanctions do not erase blockchain history, freeze every related wallet or prevent criminals from creating new domains and entities. The Garantex-to-Grinex sequence shows an iterative contest in which disruption is followed by migration, rebranding and renewed enforcement.
The Bottom Line
The September 26, 2024 action disrupted Cryptex, PM2BTC and Ivanov’s alleged laundering infrastructure, but it was not a blanket ban on Russian cryptocurrency use or a final defeat of ransomware finance. OFAC blocking rules and FinCEN restrictions operate differently, and the later Grinex case shows why businesses and users must evaluate ownership, wallets and transaction paths—not just exchange names.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
