Garantex, a Russian crypto exchange popular with ransomware gangs and darknet markets, has been taken down in an international law enforcement operation, according to a Friday announcement from the U.S. Department of Justice (DOJ).

Seizure of Domains and Servers

On Thursday, a coalition of law enforcement agencies from the U.S., Germany, and Finland seized Garantex’s domains and servers, and froze nearly $28 million in crypto tied to the exchange with the help of stablecoin issuer Tether.

Sanctions Imposed

The U.S. Treasury’s Office of Foreign Asset Control (OFAC) sanctioned Garantex in 2022, accusing the exchange of knowingly facilitating money laundering for ransomware actors, including Conti and Black Basta, and darknet markets like Hydra, which, before its 2022 shut down, was once the largest darknet market in the world.

Little Effect from Sanctions

The sanctions had little to no effect on Garantex – according to data from blockchain sleuthing firm Elliptic, which aided the U.S. in its investigation, the exchange processed more than $60 billion in crypto transactions after being sanctioned. In total, the exchange has transacted over $96 billion.

Lack of Know-Your-Customer Information

According to court documents, Garantex collected virtually no know-your-customer (KYC) information about its clients, allowing criminals to use its services unchecked, and accounts were registered to customers using names like “Drug,” “hacker,” “taliban,” “Cashout, cleancoins,” and “God.”

Clients and Users

In addition to ransomware actors and darknet markets, Garantex’s clientele allegedly included North Korea’s state-sanctioned hacking squad, the Lazarus Group, which was behind the massive $1.5 billion Bybit heist last month, as well as Russian oligarchs, who used the service to evade international sanctions tied to the war in Ukraine. Sophisticated international sanctions evasion companies, like TGR Group, which cater to Russian elites, have been tied to Garantex.

Criminal Charges Filed

Following the seizure of Garantex’s servers and domains, two of its operators have been criminally charged in the U.S. for their connections to the exchange.

Charged Individuals

Lithuanian national and Russian resident Aleksej Besciokov, 46, has been charged with money laundering conspiracy, conspiracy to violate sanctions, and conspiracy to operate an unlicensed money transmitting business. Aleksandr Mira Serda, 40, a Russian citizen currently residing in the United Arab Emirates, has been charged with money laundering conspiracy.