Shutdown Russian Exchange Garantex is Still Laundering Crypto via Tornado Cash

According to an exclusive report from Global Ledger, Russian exchange Garantex, which was forced to shut down in March, is still actively laundering cryptocurrency.

On-chain data suggests Garantex has used Tornado Cash to transfer ETH worth over $261,000. Despite US sanctions, the firm is experimenting with ways to continue its laundering operations.

Garantex Still Operates from the Shadows

Garantex, a Russian crypto exchange, has suffered major setbacks after recent international money laundering sanctions. The DOJ seized its domains, Indian authorities arrested its co-founder, and Tether froze over $28 million of its assets in March.

Since then, Garantex allegedly ceased operations, but new data suggests that it’s using Tornado Cash to move Ethereum.

“We’ve identified a suspicious flow from an active Garantex wallet to Tornado Cash, suggesting continued laundering activity despite formal shutdowns. Garantex’s operational wallets remain active on Ethereum, and assets are still being funneled through obfuscation routes. In total, around $261,000 are on the move from Garantex’s hot wallets on Ethereum,” Global Ledger claimed.

A few months ago, BeInCrypto reported that Garantex had allegedly rebranded to Grinex after shutting down. The exchange used ruble-backed stablecoin A7A5 to transfer funds into the new platform.

Today, Global Ledger identified another batch of ETH tokens transferred from a Grantex hot wallet to the Tornado Cash mixer.

Garantex Sends ETH To Tornado Cash. Source: Global Ledger

Specifically, the Garantex hot wallet initiated a transfer of 99 ETH, valued at approximately $261,000, to an intermediate address.

From this intermediate wallet, the ETH was split into three separate transactions, which were sent to another intermediary wallet (0x3f…7e6a). This indicates an effort to layer and obscure the trail, an established money laundering technique.

So, what does it mean? The wallet originally attributed to Garantex remains capable of executing transactions. Despite DOJ claims of fully shutting it down, the exchange’s infrastructure is still at least partially intact.

Previously, Chainalysis identified that Garantex received funds from all sorts of criminal activities. Most of its funds included stolen crypto linked to major hacks, ransomware, and darknet markets.

So, it won’t be farfetched to claim that the exchange is still trying to launder these illicit funds through the active Ethereum wallet.

Illicit Funds Received by Garantex. Source: Chainalysis

Tornado Cash, for its part, has also had some trouble with the law. Although the company won a few legal breakthroughs in 2025, the DOJ reaffirmed its commitment to prosecuting co-founder Roman Storm.

Crypto enforcement has been gutted under the Trump administration, but officials remain committed to prosecuting major criminals.