A World Beyond SWIFT (II): Moscow's Underground Ledger—Garantex, Cryptex, and the Shadow Settlement System

Original Title: "Beyond SWIFT (II): Moscow's Underground Ledger: Garantex, Cryptex, and the Shadow Settlement System"

Author: Anita

Note from Rhythm: This article is part of the "Beyond SWIFT" series. For the previous article, see: . The following is the main content:

Three years after the West cut Russia off from SWIFT, the Kremlin has not been financially suffocated. On the contrary, a massive "shadow financial machine" is operating inside Moscow's Federation Tower.

This machine no longer relies on JPMorgan, nor does it fear dollar freeze orders. According to documents from the U.S. Treasury, blockchain analysis reports, and ICIJ investigative data, this machine is roughly composed of three interlocking gears:

Garantex (Black Market Hub), Cryptex (Secret Backup), and the Exved / A7 System (National B2B Channel and "On-chain Ruble").

Phoenix Garantex—The Intersection of Gangs and Oil Capital

On the U.S. Treasury's sanctions list, Garantex has long been highlighted in red; in Russia's gray trade and capital flight system, it is an indispensable "central clearinghouse."

1. On the surface, a trading platform; underneath, two dark rivers

Public information shows that Garantex was founded in Moscow in 2019, with its registered office in the landmark Federation Tower, co-founded by Stanislav Drugalev and Sergey Mendeleev, among others. In April 2022, it was sanctioned by the U.S. OFAC for transactions linked to darknet market Hydra, ransomware Conti, and others. At least $100 million in transactions were directly identified as crime-related, but even after sanctions, it remains "one of the main channels for Russian funds to flow in and out of the world."

ICIJ's investigation zooms in beyond the equity structure, and the picture begins to distort:

· A company deeply tied to Garantex is called Fintech Corporation—it is both the owner of the Garantex App and the operator of brands such as "Garantex Academy";

· Russian company registration records show that Fintech holds 50% equity in a debt collection company, "Academy of Conflicts," while the other half is controlled by "gang leader" Alexander Tsarapkin, who was convicted of extortion and sentenced to seven years in prison for leading an extortion gang;

· Key Fintech shareholder Pavel Karavatsky once served on the board of Peresvet Bank, which was later taken over by Rosneft (Russian state-owned oil company); in its early days, Fintech also used contact information and email domains related to Rosneft's logistics subsidiary.

Looking back along this cold paper trail of company registrations, we see state oil capital + violent debt collection company + sanctioned crypto trading platform.

This does not mean "Rosneft is running Garantex," but it does show that Garantex's ability to continue handling billions of dollars in stablecoin liquidity after being squeezed by OFAC, Tether, and the EU is not simply due to "technology and entrepreneurial spirit."

It is a central gear embedded in a larger national—gray capital network.

Cryptex—The "Plan B" Operating on Garantex's Flank

When Garantex became a sample under the regulatory spotlight, "only using it and nothing else" became too risky for black and gray funds. The market naturally grows backup routes, and Cryptex is the most typical among them.

1. The "Invisible Exchanger" Named by OFAC

On the surface, Cryptex is also a "Russian cryptocurrency exchange platform," supporting instant swaps between fiat and virtual assets. But on September 26, 2024, the U.S. Treasury's OFAC placed it and its operator Sergey Sergeevich Ivanov on the sanctions list, accusing it of "providing money laundering and settlement services for fraud shops, ransomware organizations, darknet markets, and other criminal activities."

According to on-chain analysis by Chainalysis, since 2018, Cryptex has processed about $5.88 billion in crypto transactions, a significant portion of which came from "high-risk or clearly illegal" source addresses. Another platform associated with Ivanov, PM2BTC, was designated by FinCEN as a "primary money laundering concern," with nearly half its business related to criminal activity.

If Garantex is more like a "total clearing pool for ruble-stablecoin flows inside and outside Russia," Cryptex / PM2BTC is more of a "lighter, more anonymous criminal money laundering entry point."

2. What Can't Be Killed Is Not a Single Platform, But an Entire Structure

Structurally, Cryptex plays the role of a typical "flanking substitute": when Garantex's on-chain addresses are blacklisted batch after batch, many darknet shops, scam gangs, and ransomware operators switch their settlement channels to no-KYC exchangers like Cryptex or PM2BTC; and when Cryptex itself is sanctioned, a new "Cryptex 2.0" will appear under another name.

This is a "decentralized evasion" model:

(1) What regulation takes down is the name; what the market grows is the model itself.

(2) In this network, Garantex is the heavyweight host;

(3) Cryptex and PM2BTC are the front-end nodes specializing in "taking dirty money, laundering it, and then sending it to Garantex or other channels."

Exved, A7A5, and PSB—The Prototype of Sovereign "Shadow Banks"

If Garantex is the black market and Cryptex is the gray industry, then the group of Exved + A7 / A7A5 + PSB is closer to a national on-chain laboratory project.

It is not used to evade a single payment, but to rewrite "how Russia pays externally."

1. Exved: A USDT B2B Channel Disguised as Compliance

In December 2023, a "digital settlement trading platform" called Exved quietly launched in Moscow.

The official positioning is simple:

a. Provide cross-border digital payment services for Russian local legal entities (enterprises)

b. Support Tether's USDT for external settlements

Almost all public reports emphasize three points: Exved is specifically for export and import enterprises, not retail users; it provides enterprises with an interface that may display "USD, USDT, or offshore ruble" on the front end, while the back end completes final settlement through offshore accounts and partner institutions; the project is technically supported by the InDeFi Smart Bank team and has been approved by the Central Bank of Russia and the Federal Financial Monitoring Service (Rosfinmonitoring).

From a regulatory narrative, Exved is an innovative pilot with KYC.

Structurally, it is more like: after traditional banks are locked down by sanctions, a "compliant shell + stablecoin channel" built for enterprises.

It does not directly issue any new coins, but incorporates existing USDT under a state-recognized B2B shell.

2. A7 and A7A5: The True Debut of the Ruble "Shadow Stablecoin"

If Exved is still at the stage of "using USDT for cross-border settlement," then A7 / A7A5 is the next step—putting the ruble itself on-chain.

Elliptic's "A7 Leak" report breaks down this system clearly:

a. A7 is a group company specializing in cross-border payments and sanctions evasion for Russian enterprises;

· 51% equity is held by Moldovan oligarch Ilan Shor—convicted for the 2014 Moldovan banking "big hole case" and sanctioned by the U.S. for helping Russia undermine Moldovan elections;

· Another major shareholder is Russian state defense bank Promsvyazbank (PSB).

b. A7A5 is a ruble stablecoin developed by A7:

· Issued by Old Vector LLC registered in Kyrgyzstan;

· Each A7A5 is claimed to be backed 1:1 by ruble deposits held in PSB accounts;

· As of mid-2025, about 41.6 billion A7A5 are in circulation, with a total transaction volume of about $68 billion;

· According to Reuters citing Elliptic and TRM Labs data, A7A5's cumulative transfer volume has exceeded $40 billion, with daily peak trading over $1 billion, and its market cap soared from $170 million to $521 million in two weeks.

More importantly, its relationship with USDT is not substitution, but a "dual-layer structure":

According to internal chat logs disclosed by Elliptic, A7 employees discussed using at least $1 billion to $2 billion in USDT to provide market making for A7A5 on various trading platforms—first using USDT to create liquidity, then swapping chips for A7A5 to make it look "like a deep stablecoin market";

In July 2025, A7's official Telegram channel directly announced the injection of $100 million equivalent USDT liquidity into the A7A5 DEX to meet market demand for "A7A5 ↔ USDT best price."

With this combination, A7A5's role becomes very clear: it is an "on-chain ruble liability" attached to PSB's balance sheet, using USDT as a credit engine to avoid Tether freeze risks.

For Russian enterprises, this means that even if kicked out of SWIFT and unable to complete cross-border payments via bank accounts, they can still:

Ruble → deposit in PSB → A7A5 → settle payments on-chain → convert back to local fiat or USDT.

Externally, this is a technical product; from a geopolitical perspective, it is more like a "ruble version of a shadow central bank pipeline" built outside the SWIFT system.

Elliptic's "A7 Leak" report contains a particularly striking passage:

· The A7 group not only helps Russian enterprises buy components and negotiate shipping, but is also used to support political projects within Moldova;

· Leaked documents and on-chain records show that funds under Shor's control flowed via stablecoins into an application and organizational network called "Taito," used to pay political activity participants and cover propaganda expenses;

· The U.S. and EU, in their sanction statements, explicitly accuse Shor of "using funds and disinformation networks to undermine Moldovan democracy," and A7 and its crypto channels are seen as key infrastructure for these activities.

This does not mean we can simply conclude "PSB + A7A5 = directly paying voters in a region with USDT to buy votes"; public materials are not sufficient to draw such a fine line.

But it is certain that the same financial infrastructure is helping Russian enterprises buy goods and evade sanctions, while also providing funding tools for political influence operations.

When a sovereign bank (PSB), a shadow payment group (A7), and an on-chain stablecoin (A7A5) are tied together,

money is no longer just an "economic variable," but a cross-border, programmable geopolitical weapon.

Below SWIFT Is the Dollar, Beyond SWIFT Is the Shadow Network

If you abstract all this into a diagram, you would see the following structure:

· Garantex: Aggregates Russian retail users, gray trade, black money, and some energy-related funds into a "ruble ↔ stablecoin" black market central clearing pool;

· Cryptex / PM2BTC-type no-KYC exchangers: Provide a "boarding and laundering" front-end entry for ransomware, scam shops, and some sanctioned entities;

· Exved + A7 / A7A5 + PSB: Extend this network from "civilian and black" to "semi-official B2B payments" and "on-chain ruble sovereign projects"—splitting what could only be computed on the central bank's balance sheet into a token that can jump across Tron and Ethereum.

In this network, USDT is the blood, PSB's ruble deposits are the skeleton, Garantex / Cryptex are the capillaries, and A7A5 is the newly grown heart valve—its existence is to keep this cycle beating outside SWIFT.

This is not a joke about sanctions, but a stress test of the upper limits of the global financial order.

When a major country expelled from SWIFT begins to skillfully use stablecoins, shadow platforms, and its own "on-chain ruble" to conduct trade and political projects, the question is no longer: "Can Russia be cut off?" but: "Outside the dollar and SWIFT, will there emerge a financial sewer that can never be fully cleaned up?"

And the machine running inside Moscow's Federation Tower is just the first segment of this sewer.

References

<1>

<2>

<3>

<4> FinCEN – Advisory FIN-2023-A002

<5>

<6>OFAC Notice – September 26, 2024

<7>U.S. Treasury Press Release – April 5, 2022

<8>Chainalysis Crypto Crime Report 2023

<9>

<10>

<11>

<12>

Original link