The World Beyond SWIFT (Part 2) Moscow's Underground Ledger: Garantex, Cryptex, and Shadow Settlement System

Original Article Title: "Beyond SWIFT (Part 2) The Underground Ledger in Moscow: Garantex, Cryptex, and Shadow Settlement System"

Original Article Author: Anita(X: @Anitahityou)

Translator's Note: This article is part of the "Beyond SWIFT" series. The previous part can be found at: "The World Beyond SWIFT: Russia and the Cryptic Economy". The following is the main content:

Three years after the West cut off Russia's connection to SWIFT, the Kremlin did not suffocate financially. Instead, a massive "shadow financial machine" is operating within the Moscow Federation Tower.

This machine no longer relies on JPMorgan and is not afraid of US dollar freeze orders. According to US Treasury documents, blockchain analysis reports, and ICIJ investigation data, this machine is roughly composed of three interlocking layers:

Garantex (Black Market Hub), Cryptex (Secret Backup), and Exved / A7 System (National B2B Channel and "On-chain Ruble").

The Phoenix Garantex - Intersection of the Gang and Oil Capital

Garantex is a long-red flagged name on the US Treasury's sanctions list; within Russia's gray trade and capital flight system, it is an indispensable "central clearinghouse".

1. Surface is a trading platform, underneath are two dark rivers

Public information shows that Garantex was established in Moscow in 2019, with its registered office located in the Moscow landmark Federation Tower, co-founded by individuals such as Stanislav Drugalev and Sergey Mendeleev. In April 2022, it was sanctioned by the US OFAC due to associated transactions with the darknet market Hydra, ransomware Conti, among others. At least $100 million in transactions were directly identified as related to criminal activities, but after the sanctions, it remains "one of the main channels for Russian funds in and out of the world".

The ICIJ investigation has pushed the spotlight beyond ownership structures, and the image begins to distort:

· A company deeply linked to Garantex is named Fintech Corporation — it is both the owner of the Garantex App and the operator of brands such as "Garantex Academy";

· Russian company registration records show that Fintech holds a 50% stake in a debt collection company named "Academy of Conflicts," with the other half controlled by "gang leader" Alexander Tsarapkin, who was convicted of extortion and sentenced to seven years in prison for his involvement in an extortion ring;

· Fintech's key shareholder Pavel Karavatsky previously served on the board of Peresvet Bank, which was later taken over by Rosneft (Russian state-owned oil company); Fintech also initially used contact information and email domains related to a Rosneft logistics subsidiary.

Looking back along the cold paper chain of company registrations reveals a combination of state oil capital + violent debt collection company + sanctioned crypto exchange.

This does not mean "Rosneft is pulling the strings at Garantex," but it is enough to illustrate that Garantex's ability to continue processing billions of dollars' worth of stablecoin liquidity after facing pressure from OFAC, Tether, and the EU is not solely dependent on "technology and entrepreneurial spirit."

It is a central gear embedded in a larger network of state—grey capital.

Cryptex — The "Plan B" Skirting Around Garantex

As Garantex becomes a regulatory spotlight, relying solely on "just doing it" without diversification becomes too risky for black and grey funds. The market naturally grows backup routes, and Cryptex is one of the most typical among them.

1. OFAC-Designated "Stealth Exchange"

On the surface, Cryptex is also a "Russian cryptocurrency exchange platform" that supports instant exchange between fiat and virtual assets. However, on September 26, 2024, the U.S. Treasury's OFAC added it, along with its operator Sergey Sergeevich Ivanov, to the sanctions list, accusing it of providing money laundering and settlement services to "fraud shops, ransomware organizations, dark web markets, and other criminal activities."

Chainalysis' on-chain analysis has shown that since 2018, Cryptex has processed approximately $58.8 billion worth of cryptocurrency transactions, a significant portion of which originated from "high-risk to clearly illicit" source addresses. Another platform associated with Ivanov, PM2BTC, has been identified by FinCEN as a "primary money laundering concern," with almost half of its business linked to criminal activity.

If Garantex leans more towards a "Russian ruble-stablecoin total settlement pool" both domestically and internationally, Cryptex / PM2BTC's position is more geared towards a "lighter, more anonymous criminal money laundering entry point."

2. What doesn't kill them is not just any single platform, but an entire type of structure

Structurally, Cryptex plays the role of a typical "sidekick decoy": when batches of Garantex's on-chain addresses are blacklisted, many dark web stores, scam syndicates, and ransomware operators redirect their settlement channels to Cryptex or PM2BTC-like KYC-free exchanges; and when Cryptex itself is sanctioned, a new "Cryptex 2.0" will appear under a different name.

This is a form of "decentralized evasion":

(1) Regulators take down the names, but the market generates the pattern itself.

(2) In this network, Garantex is the heavyweight host;

(3) Cryptex and PM2BTC act as frontend nodes specialized in "receiving dirty money, laundering it once, and then funneling it back to Garantex or other channels."

Exved, A7A5, and PSB—The embryonic form of a sovereign-level "shadow bank"

If Garantex is the black market and Cryptex is the gray market, then the Exved + A7/A7A5 + PSB group is more akin to an on-chain laboratory experiment of a nation.

It is not designed to dodge a single transaction but to redefine "how Russia pays internationally" on the blockchain.

1. Exved: USDT B2B Channel in Compliance Clothing

In December 2023, a "digital settlement exchange" named Exved quietly launched in Moscow.

The official positioning is quite simple:

a. To provide cross-border digital payment services to Russian local legal entities (businesses)

b. To support settlement using Tether's USDT

Almost all public reports emphasize three points: Exved is specifically aimed at export and import enterprises, not retail customers; it provides an interface for businesses where the frontend may display "USD, USDT, or non-resident ruble (offshore ruble)," while the backend settles through offshore accounts and partner institutions; the project is technically supported by the InDeFi Smart Bank team and has obtained approval from the Central Bank of Russia and the Federal Financial Monitoring Service (Rosfinmonitoring).

From a regulatory narrative perspective, Exved is an innovative pilot with KYC.

Structurally, it looks more like: After traditional banks were locked out due to sanctions, it has paved the way for enterprises with a "compliant shell + stablecoin channel."

It is not directly responsible for issuing any new coins but rather incorporates existing USDT under a nationally recognized B2B facade.

2. A7 and A7A5: The True Emergence of the Ruble-based "Shadow Stablecoin"

If Exved is still at the stage of "using USDT for cross-border settlement," then A7 / A7A5 is the next step—putting the ruble itself on the blockchain.

Elliptic's "A7 Leak" report lays out this system very clearly:

a. A7 is a group company specializing in cross-border payments for Russian enterprises and sanctions evasion;

· 51% of the shares are held by the Moldovan tycoon Ilan Shor—he was convicted in the 2014 "Moldovan bank fraud case" and sanctioned by the US for disrupting Moldova's elections on Russia's behalf;

· Another major shareholder is the Russian state-owned defense bank Promsvyazbank (PSB).

b. A7A5 is a Ruble Stablecoin Developed by A7:

· The issuer is registered in Kyrgyzstan as Old Vector LLC;

· Each A7A5 token is claimed to be backed 1:1 by Ruble deposits held in a PSB account;

· As of mid-2025, there are approximately 41.6 billion A7A5 tokens in circulation, with a total trading volume of around $68 billion;

· Reuters cited data from Elliptic and TRM Labs stating that the cumulative transaction volume of A7A5 has surpassed $40 billion, with daily trading peaks exceeding $1 billion, and its market capitalization soared from $170 million to $521 million in two weeks.

More importantly, it does not have a substitute relationship with USDT but rather a "double-layered structure":

Based on internal chat records disclosed by Elliptic, A7 staff have discussed using at least $10-20 billion worth of USDT to provide liquidity for A7A5 on various trading platforms—first injecting liquidity with USDT and then converting the chips to A7A5 to create "a deep stablecoin market";

In July 2025, the A7 official Telegram channel directly announced injecting $100 million worth of USDT liquidity into the A7A5 DEX to meet the demand for "best price A7A5 ↔ USDT" in the market.

In this combination, the role of A7A5 becomes very clear: It is a "chainable Ruble liability" on the PSB balance sheet, using USDT as a credit engine to mitigate Tether freezing risks.

For Russian businesses, this means that even if they are kicked out of SWIFT and face difficulties with cross-border payments through traditional banking channels, they can still:

RUB → Deposit into PSB → A7A5 → Settle funds on-chain → Convert back to local fiat or USDT.

Externally, this may appear as a technological solution, but from a geopolitical perspective, it resembles a "Ruble Shadow Central Bank Pipeline" built outside the SWIFT system.

An excerpt from Elliptic's "A7 Leak" report is particularly striking:

· The A7 Group not only helps Russian enterprises navigate purchasing parts and discussing freight costs but has also been used to support political engineering within Moldova;

· Leaked documents and on-chain records show that funds under Shor's control flowed through stablecoins to a network and application suite named "Taito," used to compensate political actors and cover propaganda expenses;

· The US and the EU, in their sanction justifications, specifically accuse Shor of "using funds and a misinformation network to undermine Moldova's democracy," with A7 and its encrypted channel seen as critical infrastructure for this activity.

This does not imply that we can simply conclude that "PSB + A7A5 = Directly sending USDT to voters in a specific region," as the publicly available information is not yet sufficient to draw such detailed connections.

However, what is certain is that with the same financial infrastructure supporting Russian businesses in evading sanctions, it is also providing a fund distribution tool for political influence operations.

When the sovereign bank (PSB), shadow payment group (A7), and on-chain stablecoin (A7A5) are intertwined,

money ceases to be just an "economic variable" and becomes a cross-border, programmable geopolitical weapon.

Beneath SWIFT lies the Dollar, Beyond SWIFT lies the Shadow Network

If we were to abstract all of this into a single diagram, you would observe the following structure:

· Garantex: Aggregates Russian retail investors, grey trade, illicit funds, and a portion of energy-related capital into a "RUB ↔ Stablecoin" black-market aggregate settlement pool;

· Cryptex / PM2BTC-like No-KYC Exchange: Provides a frontend entry point for ransomware, scam shops, and certain sanctioned entities for "onboarding and whitewashing";

· Exved + A7 / A7A5 + PSB: It extends this network from the "civilian and black market" to "semi-official B2B payment" and the "on-chain Ruble sovereignty project" — splitting something that could only be computed on the central bank's balance sheet into a token that can hop on Tron or Ethereum.

In this network, USDT is the blood, PSB's Ruble deposit is the skeleton, Garantex / Cryptex is the capillary, and A7A5 is the newly grown heart valve — its existence is to keep this loop pulsating outside of SWIFT.

This is not a joke about sanctions but a stress test on the upper limit of the global financial order.

When a major country expelled from SWIFT starts proficiently using stablecoins, shadow platforms, and its own "on-chain Ruble" for trade and political engineering, the question is no longer: "Can Russia be cut off?" but rather: "Will a perpetually unclean financial underworld emerge outside the dollar and SWIFT?"

And the machine running inside the Moscow Federation Tower is just the first segment of this underworld.

References

<1>https://home.treasury.gov/news/press-releases/jy0713

<2>https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-list-data-formats

<3>https://www.icij.org/investigations/shadow-money/

<4> FinCEN – Advisory FIN-2023-A002

<5>https://tass.ru/ekonomika

<6>OFAC Notice – September 26, 2024

<7>U.S. Treasury Press Release – April 5, 2022

<8>Chainalysis Crypto Crime Report 2023

<9>https://cryptonews.com/news/russias-exved-launches-cross-border-payment-service-powered-by-tethers-usdt-stablecoin

<10> https://en.wikipedia.org/wiki/Garantex?utm_source=chatgpt.com

<11>https://www.chainalysis.com/blog/ofac-sanctions-russian-exchange-cryptex-uaps-fraud-shop-2024/?

<12> https://zh.spaziocrypto.com/wen-ding-bi/e-luo-si-wen-ding-bi-a7a5-zai-4-ge-yue-nei-liu-dong-93-yi-mei-yuan

Original Article Link

This article is a submitted contribution and does not represent the views of BlockBeats.