Skip to content

Secure IT

Stay Secure. Stay Informed.

Primary Menu
  • Home
  • Sources
    • Krebs On Security
    • Security Week
    • The Hacker News
    • Schneier On Security
  • Home
  • Security Week
  • US Seize Garantex in Cryptocurrency Money Laundering Bust
  • Security Week

US Seize Garantex in Cryptocurrency Money Laundering Bust

Ryan Naraine Published: March 7, 2025 | Updated: March 7, 2025 2 min read
1 views

The US Justice Department on Friday announced the seizure of the online infrastructure used to run Garantex, a major cryptocurrency exchange accused of facilitating multi-billion dollar money laundering and sanctions violations.

The department said it worked with law enforcement partners in Europe to seize three domain names — garantex.org, garantex.io, and garantex.academy — effectively shuttering a cryptocurrency exchange linked to ransomware extortions and services to “transnational criminal organizations, including terrorist groups.”

According to court documents, Garantex processed at least $96 billion in cryptocurrency transactions since April 2019.

In tandem with the shutdown, the DOJ also unsealed an indictment charging Lithuanian Aleksej Besciokov and Russian Aleksandr Mira Serda with money laundering and conspiracy to violate sanctions and operate an unlicensed money transmitting business.

The Department alleges that Besciokov served as Garantex’s primary technical administrator and was responsible for maintaining the exchange’s critical infrastructure and reviewing transactions. 

Mira Serda, identified as the exchange’s co-founder and chief commercial officer, is accused of helping to conceal the illicit activities taking place on the platform. 

The indictment details how both men allegedly knew that criminal proceeds were being laundered through Garantex and took deliberate steps to hide these activities, including providing incomplete account information to law enforcement.

In April 2022, the US government sanctioned Garantex for its role in laundering funds from ransomware attacks and darknet markets. Despite these sanctions, the DOJ now says the admins redesigned Garantex’s operations to evade US rules. One method involved moving operational cryptocurrency wallets to new virtual currency addresses daily to obscure transactions and hinder detection by US exchanges.

Advertisement. Scroll to continue reading.

In the seizure operation, German and Finnish law enforcement agencies also took control of servers hosting Garantex’s operations, while U.S. officials recovered earlier copies of customer and accounting databases. 

More than $26 million in funds linked to the money laundering activities have been frozen, the department said.

Founded in late 2019, Garantex operates out of Moscow and St Petersburg and the US government has linked its transactions with illicit actors and darknet markets, including from Russian ransomware gangs Conti and Hydra.

In February 2022, Garantex lost its license to provide virtual currency services after supervision by Estonia’s Financial Intelligence Unit revealed critical AML/CFT deficiencies and found connections between Garantex and wallets used for criminal activity.  

“Garantex received hundreds of millions in criminal proceeds and was used to facilitate various crimes, including hacking, ransomware, terrorism, and drug trafficking, often with substantial impact to US victims,” the department added.

Related: US Treasury Sanctions Crypto Exchange in Anti-Ransomware Crackdown

Related: Germany Shuts Down Darknet Platform Specializing in Drugs

Related: FBI Says North Korea Hacked Bybit as Details of $1.5B Heist Emerge

Related: Social Engineering Sparked $1.4 Billion Supply Chain Cryptocurrency Heist

About The Author

Ryan Naraine

See author's posts

Original post here

What do you feel about this?

  • Security Week

Post navigation

Previous: In Other News: EntrySign AMD Flaw, Massive Attack Targets ISPs, ENISA Report
Next: Feds Link $150M Cyberheist to 2022 LastPass Hacks

Author's Other Posts

Huntress Documents In-The-Wild Exploitation of Critical Gladinet Vulnerabilities Cybersecurity_News-SecurityWeek.jpg

Huntress Documents In-The-Wild Exploitation of Critical Gladinet Vulnerabilities

April 14, 2025 0 0
Trend Micro Flags Incomplete Nvidia Patch That Leaves AI Containers Exposed Nvidia.jpeg

Trend Micro Flags Incomplete Nvidia Patch That Leaves AI Containers Exposed

April 14, 2025 0 1
Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle Ivanti-e1736941837602.jpg

Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle

April 11, 2025 0 0
Trump Revokes Security Clearance for Ex-CISA Director Chris Krebs White-House-Cybersecurity.jpg

Trump Revokes Security Clearance for Ex-CISA Director Chris Krebs

April 10, 2025 0 0

Related Stories

Cybersecurity_News-SecurityWeek.jpg
  • Security Week

Insurance Firm Lemonade Says API Glitch Exposed Some Driver’s License Numbers

Ionut Arghire April 15, 2025 0 2
ransomware.jpeg
  • Security Week

Kidney Dialysis Services Provider DaVita Hit by Ransomware

Ionut Arghire April 15, 2025 0 0
Cybersecurity_News-SecurityWeek.jpg
  • Security Week

Conduent Says Names, Social Security Numbers Stolen in Cyberattack

Ionut Arghire April 15, 2025 0 0
Cybersecurity_News-SecurityWeek.jpg
  • Security Week

2.6 Million Impacted by Landmark Admin, Young Consulting Data Breaches

Ionut Arghire April 15, 2025 0 2
VC-Funding_China-tech.jpg
  • Security Week

China Pursuing 3 Alleged US Operatives Over Cyberattacks During Asian Games

Associated Press April 15, 2025 0 0
Satellite-Link-Cybersecurity.jpg
  • Security Week

Blockchain, Quantum, and IoT Firms Unite to Secure Satellite Communications Against Quantum Threats

Kevin Townsend April 15, 2025 0 1

Trending Now

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims grinex.jpg 1

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

April 19, 2026 0 0
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet botnet-ddos.jpg 2

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

April 19, 2026 0 0
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched defender.jpg 3

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

April 19, 2026 0 0
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul google-ads-android.jpg 4

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

April 19, 2026 0 0

Connect with Us

Social menu is not set. You need to create menu and assign it to Social Menu on Menu Settings.

Trending News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims grinex.jpg 1
  • The Hacker News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

April 19, 2026 0 0
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet botnet-ddos.jpg 2
  • The Hacker News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

April 19, 2026 0 0
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched defender.jpg 3
  • The Hacker News

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

April 19, 2026 0 0
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul google-ads-android.jpg 4
  • The Hacker News

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

April 19, 2026 0 0
NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions nist-cve.jpg 5
  • The Hacker News

NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions

April 17, 2026 0 1
Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts europol.jpg 6
  • The Hacker News

Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts

April 17, 2026 0 0
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation apachemq.jpg 7
  • The Hacker News

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

April 17, 2026 0 0

You may have missed

grinex.jpg
  • The Hacker News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

[email protected] The Hacker News April 19, 2026 0 0
botnet-ddos.jpg
  • The Hacker News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

[email protected] The Hacker News April 19, 2026 0 0
defender.jpg
  • The Hacker News

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

[email protected] The Hacker News April 19, 2026 0 0
google-ads-android.jpg
  • The Hacker News

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

[email protected] The Hacker News April 19, 2026 0 0
Copyright © 2026 All rights reserved. | MoreNews by AF themes.