Skip to content

Secure IT

Stay Secure. Stay Informed.

Primary Menu
  • Home
  • Sources
    • Krebs On Security
    • Security Week
    • The Hacker News
    • Schneier On Security
  • Home
  • Uncategorized
  • Krebs On Security
  • Alleged Co-Founder of Garantex Arrested in India
  • Krebs On Security

Alleged Co-Founder of Garantex Arrested in India

BrianKrebs Published: March 11, 2025 | Updated: March 11, 2025 2 min read
1 views

Authorities in India today arrested the alleged co-founder of Garantex, a cryptocurrency exchange sanctioned by the U.S. government in 2022 for facilitating tens of billions of dollars in money laundering by transnational criminal and cybercriminal organizations. Sources close to the investigation told KrebsOnSecurity the Lithuanian national Aleksej Besciokov, 46, was apprehended while vacationing on the coast of India with his family.

Aleksej Bešciokov, “proforg,” “iram”. Image: U.S. Secret Service.

On March 7, the U.S. Department of Justice (DOJ) unsealed an indictment against Besciokov and the other alleged co-founder of Garantex, Aleksandr Mira Serda, 40, a Russian national living in the United Arab Emirates.

Launched in 2019, Garantex was first sanctioned by the U.S. Treasury Office of Foreign Assets Control in April 2022 for receiving hundreds of millions in criminal proceeds, including funds used to facilitate hacking, ransomware, terrorism and drug trafficking. Since those penalties were levied, Garantex has processed more than $60 billion, according to the blockchain analysis company Elliptic.

“Garantex has been used in sanctions evasion by Russian elites, as well as to launder proceeds of crime including ransomware, darknet market trade and thefts attributed to North Korea’s Lazarus Group,” Elliptic wrote in a blog post. “Garantex has also been implicated in enabling Russian oligarchs to move their wealth out of the country, following the invasion of Ukraine.”

The DOJ alleges Besciokov was Garantex’s primary technical administrator and responsible for obtaining and maintaining critical Garantex infrastructure, as well as reviewing and approving transactions. Mira Serda is allegedly Garantex’s co-founder and chief commercial officer.

Image: elliptic.co

In conjunction with the release of the indictments, German and Finnish law enforcement seized servers hosting Garantex’s operations. A “most wanted” notice published by the U.S. Secret Service states that U.S. authorities separately obtained earlier copies of Garantex’s servers, including customer and accounting databases. Federal investigators say they also froze over $26 million in funds used to facilitate Garantex’s money laundering activities.

Besciokov was arrested within the past 24 hours while vacationing with his family in Varkala, a major coastal city in the southwest Indian state of Kerala. An officer with the local police department in Varkala confirmed Besciokov’s arrest, and said the suspect will appear in a Delhi court on March 14 to face charges.

Varkala Beach in Kerala, India. Image: Shutterstock, Dmitry Rukhlenko.

The DOJ’s indictment says Besciokov went by the hacker handle “proforg.” This nickname corresponds to the administrator of a 20-year-old Russian language forum dedicated to nudity and crudity called “udaff.”

Besciokov and Mira Serda are each charged with one count of conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison. Besciokov is also charged with one count of conspiracy to violate the International Economic Emergency Powers Act—which also carries a maximum sentence of 20 years in person—and with conspiracy to operate an unlicensed money transmitting business, which carries a maximum sentence of five years in prison.

About The Author

BrianKrebs

See author's posts

Original post here

What do you feel about this?

  • Krebs On Security

Post navigation

Previous: Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub-Based Attacks
Next: New Ballista IoT Botnet Linked to Italian Threat Actor

Author's Other Posts

FBI Probes Service Selling 153M+ Drivers Licenses nexus-phegseth.png

FBI Probes Service Selling 153M+ Drivers Licenses

September 1, 2026 0 0
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

August 31, 2026 0 0
Who’s Tracking You? Use This New Service to Find Out decryptads-ESPN.png

Who’s Tracking You? Use This New Service to Find Out

August 31, 2026 0 0
Microsoft Plugs Nearly 400 Security Holes workingonpc.png

Microsoft Plugs Nearly 400 Security Holes

August 31, 2026 0 0

Related Stories

nexus-phegseth.png
  • Krebs On Security

FBI Probes Service Selling 153M+ Drivers Licenses

BrianKrebs September 1, 2026 0 0
  • Krebs On Security

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

BrianKrebs August 31, 2026 0 0
decryptads-ESPN.png
  • Krebs On Security

Who’s Tracking You? Use This New Service to Find Out

BrianKrebs August 31, 2026 0 0
workingonpc.png
  • Krebs On Security

Microsoft Plugs Nearly 400 Security Holes

BrianKrebs August 31, 2026 0 0
moucka-surveillance.png
  • Krebs On Security

Canadian Man Pleads Guilty in Snowflake Extortions

BrianKrebs August 31, 2026 0 0
h96-amazon.png
  • Krebs On Security

Read This Before You Buy That TV Streaming Stick

BrianKrebs August 31, 2026 0 0

Trending Now

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication micro.jpg 1

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

September 6, 2026 0 0
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner rev.jpg 2

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

September 6, 2026 0 0
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores adobe-exploit.jpg 3

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

September 5, 2026 0 0
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials jet.jpg 4

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

September 5, 2026 0 0

Connect with Us

Social menu is not set. You need to create menu and assign it to Social Menu on Menu Settings.

Trending News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication micro.jpg 1
  • The Hacker News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

September 6, 2026 0 0
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner rev.jpg 2
  • The Hacker News

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

September 6, 2026 0 0
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores adobe-exploit.jpg 3
  • The Hacker News

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

September 5, 2026 0 0
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials jet.jpg 4
  • The Hacker News

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

September 5, 2026 0 0
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code vmware-host.jpg 5
  • The Hacker News

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

September 5, 2026 0 0
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted trezor.jpg 6
  • The Hacker News

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted

September 5, 2026 0 0
Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel agents-openai.jpg 7
  • The Hacker News

Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel

September 5, 2026 0 0

You may have missed

micro.jpg
  • The Hacker News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

[email protected] The Hacker News September 6, 2026 0 0
rev.jpg
  • The Hacker News

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

[email protected] The Hacker News September 6, 2026 0 0
adobe-exploit.jpg
  • The Hacker News

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

[email protected] The Hacker News September 5, 2026 0 0
jet.jpg
  • The Hacker News

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

[email protected] The Hacker News September 5, 2026 0 0
Copyright © 2026 All rights reserved. | MoreNews by AF themes.