Elliptic didn’t just publish another compliance memo. It dropped a map.
And the picture isn’t flattering for regulators.
Since 2022, Western sanctions have tried to choke off Russia-linked crypto channels. Freeze the big players. Cut off liquidity. Make it painful. The theory was simple: take down the hub, and the spokes collapse.
That’s not what happened.
What Elliptic is showing instead is something more adaptive — a dispersed, multi-node network of Russia-linked exchanges that never really disappeared. They just reorganized.
And in my view, that’s harder to fight than a single villain exchange with a logo and a press office.
From One Big Target to Five Smaller Ones
Remember when Garantex was taken down in March 2025? Domains seized. Infrastructure disrupted. Headlines declaring a decisive blow.
It looked clean.
But volumes didn’t vanish. They flowed sideways.
According to Elliptic, liquidity that once concentrated in Garantex spread across five platforms: ABCeX, Exmo, Rapira, Aifory Pro, and Bitpapa. Most of them are still unsanctioned.
That’s the key detail.
If you’ve watched financial crime enforcement long enough, this pattern isn’t surprising. Remove a central node and the network fragments. Smaller actors absorb the flow. They’re less visible. More flexible. Harder to collectively freeze.
In crypto, fragmentation has superpowers:
-
Wallet rotation
-
Instant address creation
-
Stablecoin settlement outside banking rails
You don’t need a single fortress exchange anymore. You need a constellation.
That’s what regulators are up against.
ABCeX and the Federation Tower Echo
One detail from Elliptic’s report stands out — not just financially, but symbolically.
ABCeX reportedly operates out of Moscow’s Federation Tower. Same building that previously housed Garantex.
That doesn’t prove operational continuity. But let’s not pretend optics don’t matter.
Elliptic says ABCeX has processed at least $11 billion in crypto transactions. There are reportedly significant transaction flows connecting it to both Garantex and Aifory Pro.
Shared building. Shared flow patterns. Similar clientele migration.
In sanctions environments, successor entities aren’t theoretical. They’re standard. New branding. Familiar infrastructure. Often familiar staff.
Unless formally designated, they operate in the gray zone.
And gray zones are durable.
Exmo and the Infrastructure Problem
Exmo is where the report gets more structurally interesting.
After Russia’s 2022 invasion of Ukraine, Exmo said it exited the Russian market by selling its regional business to Exmo.me. On paper, that’s clean separation.
But blockchain analysis reportedly shows something messier: shared custodial wallet infrastructure between the two platforms. Deposits pooling into identical hot wallets.
If accurate, that undercuts the narrative of full operational divorce.
Elliptic says Exmo conducted more than $19.5 million in direct transactions with sanctioned entities including Garantex, Grinex, and Chatex.
Shared infrastructure isn’t automatically illegal. But in a sanctions context, it’s radioactive.
The bigger issue isn’t just transaction value. It’s entanglement. When custody systems overlap, so does exposure.
That’s not a branding issue. That’s a structural one.
Bitpapa and the Wallet Shuffle
Bitpapa is the only one of the five that has actually been sanctioned. OFAC designated it in March 2024.
Elliptic found that about 9.7% of Bitpapa’s outgoing crypto flows reached sanctioned targets.
But the more revealing tactic is wallet rotation.
Addresses shift frequently. Clustering becomes harder. Analytics firms have to constantly refresh attribution models. Every new wallet is a mini reset.
Crypto transparency is real. But so is tactical churn.
Sanctions enforcement in blockchain ecosystems is reactive by design. You label yesterday’s wallet. Today, there’s a new one.
This isn’t theoretical cat-and-mouse. It’s operational reality.
Aifory Pro and Retail-Level Circumvention
Not all sanctions evasion stories involve oligarchs or geopolitical chess.
Aifory Pro reportedly operates across Moscow, Dubai, and Turkey. It offers cash-to-crypto services and virtual payment cards funded with USDT. Those cards can be used to access services Western providers have restricted in Russia.
That’s not abstract finance. That’s consumer bypass.
Stablecoins make this possible. Dollar-pegged tokens move value quickly without touching correspondent banking systems. No SWIFT. No waiting days for clearance.
Elliptic also notes nearly $2 million in flows from Aifory Pro to Abantether — suggesting additional cross-jurisdictional exposure.
Here’s the uncomfortable part: when retail users rely on these tools for everyday access, enforcement becomes politically complicated. You’re not just targeting elites. You’re affecting regular consumers.
That shifts the optics.
Rapira and Capital Flight Tension
Rapira adds another layer.
Incorporated in Georgia but maintaining a Moscow office, it reportedly transacted more than $72 million directly with sanctioned exchange Grinex.
Russian authorities raided Rapira’s Moscow offices in late 2025 over suspected capital flight to Dubai.
That’s the twist. Russia may resist Western sanctions, but it doesn’t necessarily welcome uncontrolled capital outflows.
So exchanges in this ecosystem navigate two pressures:
-
External sanctions
-
Internal enforcement
The fragmentation isn’t just global. It’s domestic too.
The Bigger Numbers
Zoom out.
Chainalysis reported illicit crypto addresses received $154 billion in 2025. TRM Labs put the number at $158 billion. Even allowing for overlap and estimation variance, that’s scale.
One particularly notable instrument is Russia’s ruble-backed A7A5 stablecoin, reportedly facilitating over $93.3 billion in transactions.
Not all of that is sanctions-related. But the magnitude tells you something: crypto is no longer marginal infrastructure.
It’s parallel infrastructure.
That’s a different enforcement challenge.
The EU’s Nuclear Option
The European Union is now considering a blanket ban on crypto transactions involving Russia.
Aggressive. Broad. Politically clear.
But how enforceable is it?
Crypto addresses aren’t stamped with passports. Attribution relies on analytics, compliance cooperation, and behavioral patterns. A blanket ban may deter regulated Western exchanges from servicing Russian-linked flows. It raises compliance costs.
It doesn’t erase offshore activity. It doesn’t stop peer-to-peer transfers.
Sanctions are jurisdictional. Blockchains are not.
That mismatch isn’t going away.
Fragmentation Is a Feature, Not a Bug
The most important takeaway from Elliptic’s report isn’t that evasion exists. Everyone knows that.
It’s how enforcement reshapes topology.
Take down Garantex. Liquidity disperses:
-
Some domestic
-
Some offshore
-
Some semi-compliant
-
Some opaque
Distributed networks are harder to dismantle than centralized hubs. That’s basic network theory.
The system adapts. Fast.
Russia’s Countermove
A senior Russian official acknowledged last year that sanctions can’t fully block Russians from crypto markets.
Now Russia is preparing a comprehensive crypto regulatory framework expected in July, aimed at licensed domestic trading platforms.
That’s not suppression. That’s formalization.
Legitimize exchanges. Channel activity into state-supervised venues. Reduce reliance on foreign rails.
It could tighten oversight internally. It could also institutionalize crypto as a sanctions-resilience mechanism.
Both can be true.
The Enforcement Dilemma
So what do regulators do?
Keep designating exchanges one by one, knowing successors will appear?
Target stablecoin issuers and on-ramps instead?
Push cross-jurisdictional analytics coordination?
Impose broader bans that risk collateral damage?
None of these options are clean. Each has trade-offs. Overreach is possible. Underreach is obvious.
What’s clear is that one-time takedowns don’t end the story.
They start a new chapter.
The Hard Truth
Crypto has matured into parallel financial infrastructure. Not fringe. Not experimental.
When a single exchange like ABCeX reportedly processes $11 billion, we’re not talking about hobbyists.
Sanctions enforcement today isn’t about freezing a bank account. It’s about tracing wallet clusters, tracking successor entities, and constantly updating attribution models across chains.
That’s operationally exhausting.
And here’s the part nobody says out loud: crypto rails can reconstitute themselves almost instantly. New brand. Same users. Same chains.
You can sanction the name.
You can’t sanction the protocol.
Regulators are no longer fighting a single exchange. They’re managing an adaptive network.
That’s a different battlefield entirely.
Disclaimer
This article is for informational and educational purposes only and does not constitute financial, investment, trading, or legal advice. Cryptocurrencies, memecoins, and prediction-market positions are highly speculative and involve significant risk, including the potential loss of all capital.
The analysis presented reflects the author’s opinion at the time of writing and is based on publicly available information, on-chain data, and market observations, which may change without notice. No representation or warranty is made regarding accuracy, completeness, or future performance.
Readers are solely responsible for their investment decisions and should conduct their own independent research and consult a qualified financial professional before engaging in any trading or betting activity. The author and publisher hold no responsibility for any financial losses incurred.