On March 6, 2025, U.S. authorities seized three Garantex web domains in a coordinated operation with Germany and Finland. The action also involved overseas server seizures and, according to a later Treasury announcement, the freezing of more than $26 million in cryptocurrency. Authorities alleged that the exchange handled funds connected to ransomware and other crimes; the indictments against its administrators are accusations, not convictions.
What did authorities seize?
The U.S. Secret Service carried out a seizure order authorized by a federal judge in Virginia against Garantex.org, Garantex.io and Garantex.academy. The domains displayed law-enforcement seizure notices. The Justice Department announced the operation on March 7, the day after the domains were seized. DOJ’s announcement describes the U.S. action and its international coordination.
The operation was broader than taking over web addresses, but it did not mean the United States physically took control of every part of Garantex or recovered every customer balance. German and Finnish authorities seized servers used to operate the exchange. DOJ also said U.S. authorities had previously obtained copies of server data, including customer and accounting databases. Treasury later reported that more than $26 million in cryptocurrency controlled by Garantex had been frozen. A frozen amount is not the same as all assets held by an exchange, and it does not by itself establish that customers will be repaid.
Why was Garantex targeted?
DOJ alleged that Garantex operated as a money-transmitting business without registering with the Financial Crimes Enforcement Network (FinCEN), despite doing substantial business in the United States. Authorities said the exchange facilitated money laundering and sanctions evasion and processed funds associated with hacking, darknet markets, ransomware, terrorism financing and drug trafficking. In 2022, Treasury had already sanctioned Garantex, citing its links to cybercrime and the Hydra darknet market. Treasury’s 2022 announcement gives that earlier sanctions context.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Crypto exchanges can be useful to criminal groups because they provide a place to exchange, consolidate or move digital assets, and may connect crypto activity to fiat currencies or local payment channels. The indictment describes alleged interactions with other virtual-currency exchanges and efforts to obscure transaction relationships. The indictment sets out the allegations; it does not establish them as proven facts.
What connects Garantex to ransomware?
In an August 14, 2025 announcement, Treasury said Garantex received millions of dollars directly from proceeds associated with Russia-linked ransomware operations involving Conti, Black Basta, LockBit, NetWalker and Phoenix Cryptolocker. Treasury identified transaction flows linked to those operations; that does not show that each group held a formal account at Garantex or that ransomware was the exchange’s only alleged illicit use. Treasury’s 2025 action also describes the agency’s broader allegations about Garantex and its successor.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Authorities also alleged that Garantex obscured links between wallet addresses and the exchange after sanctions were imposed. That is a claim about concealment and transaction activity, not proof that every customer or every transaction was criminal. Blockchain records can be analyzed alongside exchange records and other investigative evidence; a crypto transaction should not be treated as anonymous simply because it uses a wallet address rather than a person’s name.
What do the dollar figures mean?
The official figures measure different things, so they should not be added together or treated as rival estimates of criminal proceeds.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
| Figure | What it measures | Source and qualification |
|---|---|---|
| At least $96 billion | Total cryptocurrency transaction volume DOJ said Garantex processed since April 2019—not an allegation that the entire amount was illicit. | DOJ announcement, March 7, 2025: Justice Department. |
| More than $100 million | Transactions Treasury said were linked to illicit activity since 2019. | Treasury announcement, August 14, 2025: U.S. Treasury. |
| More than $26 million | Cryptocurrency Treasury said was frozen and controlled by Garantex; this is not a total valuation of all exchange assets or customer claims. | Treasury announcement, August 14, 2025: U.S. Treasury. |
Who was charged?
DOJ announced indictments against two alleged Garantex administrators:
- Aleksej Besciokov, whom DOJ described as a Lithuanian national and Russian resident.
- Aleksandr Mira Serda, whom DOJ described as a Russian national and United Arab Emirates resident. DOJ also identified a previous name, Aleksandr Ntifo-Siaw.
The charges included conspiracy to commit money laundering, operating an unlicensed money-transmitting business and sanctions-related offenses. An indictment is a formal accusation; the allegations must be proved in court. Treasury later reported Besciokov’s arrest in India after the indictment was unsealed. The cited official announcements do not establish the final disposition of the case.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Why did the operation involve several countries?
A domain seizure can disrupt a service’s public-facing access, but a website address is only one part of an exchange. Servers, wallets, operators, customers and counterparties can be located in different jurisdictions. The operation combined U.S. domain seizures and prosecution with German and Finnish server seizures, cryptocurrency freezes and access to investigative data. That combination made the disruption more consequential than a notice placed on a website alone.
The legal actions also serve different purposes. A domain seizure concerns specified online infrastructure under a judicially authorized process. Sanctions restrict dealings with designated parties and block property subject to U.S. jurisdiction. Criminal charges accuse named defendants of offenses that must be resolved in court. None of those steps, on its own, proves that every customer was involved in wrongdoing or settles customer claims.
Recommended Free Tools
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
What happened after the March 2025 disruption?
On August 14, 2025, Treasury redesignated Garantex and identified Grinex as a successor exchange. Treasury alleged that Garantex personnel created Grinex infrastructure after the March disruption, moved customer deposits to it and used the ruble-backed digital asset A7A5 in the process described by the agency. Treasury also designated Grinex and associated people and companies. These are Treasury’s characterizations of the successor operation; they do not establish that Grinex is legally identical to Garantex.
The episode illustrates why disrupting a platform does not necessarily eliminate the people, customer relationships or infrastructure connected to it. A successor service may attempt to preserve some of those functions, while sanctions and law-enforcement action can make access to funds and counterparties more difficult. Treasury’s announcement establishes its 2025 designations and allegations, not the current operating status of Grinex.
What does this mean for Garantex customers?
Seized domains, seized servers and frozen wallets can interrupt deposits, withdrawals, account access and liquidity. Those disruptions do not by themselves tell a customer whether a balance will be returned, forfeited or treated as a claim against an exchange. The official announcements cited here do not provide a complete accounting of customer balances, losses, compensation or the eventual fate of every account.
Using Garantex does not by itself establish criminal conduct. However, a customer’s transaction history, jurisdiction and connection to sanctioned parties or illicit flows may matter for compliance, asset freezes or an investigation. Anyone with funds or a legal interest should rely on official notices and qualified legal advice in the relevant jurisdiction rather than assume a domain seizure is the same as an insolvency process or restitution program.
Quick Recap
What remains unsettled?
- The final court outcomes for the indicted administrators.
- The total value of customer balances and any complete recovery or restitution process.
- The ultimate disposition of frozen cryptocurrency.
- The current status of any successor infrastructure beyond Treasury’s August 2025 action.
- The full extent to which publicly identified transaction flows can be attributed to particular ransomware actors.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
