Author: Anita @anitahityou Three years after the West cut off Russia's connection to SWIFT, the Kremlin has not suffered a financial suffocation. On the contrary, a massive "shadow financial machine" is operating within the Federal Palace in Moscow. This machine no longer relies on JPMorgan Chase, nor is it afraid of a dollar freeze order. According to U.S. Treasury documents, blockchain analysis reports, and data from the ICIJ, this machine is roughly composed of three interlocking gears: Garantex (black market hub), Cryptex (hidden backup), and the Exved/A7 system (national-level B2B channel and "on-chain rubles"). Garantex the Phoenix – The Crossroads of Gangsters and Oil Capital Garantex is a name already highlighted in red on the U.S. Treasury Department's sanctions list; in Russia's grey trade and capital flight system, it is an indispensable "clearing house". 1. On the surface, it's an exchange; beneath, two hidden rivers flow. Public information shows that Garantex was established in Moscow in 2019, with its registered office located in the iconic Federal Building. It was co-founded by Stanislav Drugalev, Sergey Mendeleev, and others. In April 2022, it was sanctioned by the US OFAC for its associated transactions with the darknet market Hydra and the ransomware Conti. At least $100 million in transactions were directly identified as related to criminal activities. However, even after the sanctions, it remains "one of the main channels for Russian funds to enter and leave the world." When the ICIJ investigation zoomed in on the shareholding structure, the picture began to distort: A company deeply intertwined with Garantex is called Fintech Corporation—it is both the owner of the Garantex App and the operator of brands such as "Garantex Academy." Russian company registration records show that Fintech holds a 50% stake in a debt collection company called "Academy of Conflicts," while the other half is controlled by Alexander Tsarapkin, a "gang leader" convicted of extortion and previously sentenced to seven years in prison for extortion. Pavel Karavatsky, a key shareholder of Fintech, previously served on the board of directors of Peresvet Bank, which was later taken over by Rosneft (Russia's state-owned oil company); Fintech also initially used contact information and email domains associated with Rosneft's logistics subsidiary. Looking back from this cold, hard chain of company registration documents, we see state-owned oil capital, violent debt collection companies, and sanctioned cryptocurrency exchanges. This does not mean that "Rosneft is manipulating Garantex," but it is enough to show that Garantex's ability to continue handling billions of dollars of stablecoin liquidity despite being attacked from three sides by OFAC, Tether, and the EU is not simply due to "technology and entrepreneurial spirit." It is a central gear embedded in a larger national network of gray capital. Cryptex – Plan B lurking on Garantex's flank When Garantex becomes a case study under the regulatory spotlight, the strategy of "doing only Garantex and nothing else" becomes too dangerous for black and gray market funds. The market will naturally develop backup lines, and Cryptex is a prime example. 1. The "hidden redemption machine" named by OFAC Cryptex is ostensibly a "Russian cryptocurrency exchange platform" that supports instant exchange of fiat currency and virtual assets. However, on September 26, 2024, the U.S. Treasury Department's OFAC added it and its operator, Sergey Sergeevich Ivanov, to its sanctions list, accusing it of providing money laundering and settlement services for "fraud shops, ransomware organizations, darknet markets, and other criminal activities." Chainalysis's on-chain analysis revealed that Cryptex has processed approximately $5.88 billion in cryptocurrency transactions since 2018, a significant portion of which originated from "high-risk and even obviously illegal" source addresses. Another platform associated with Ivanov, PM2BTC, was identified by FinCEN as a "primary money laundering concern," with nearly half of its business related to criminal activities. If Garantex is more of a "ruble-stablecoin clearing pool both inside and outside Russia," then Cryptex/PM2BTC is positioned as a "lighter, more anonymous money laundering gateway." 2. What cannot be killed is not a single platform, but an entire structure. Structurally, Cryptex plays the role of a typical "flank substitute": when Garantex's on-chain addresses are blacklisted in batches, many dark web shops, fraud gangs, and ransomware operators will switch their settlement channels to KYC-free exchangers like Cryptex or PM2BTC; and when Cryptex itself is sanctioned, a new "Cryptex 2.0" will appear under a different name. This is a "decentralized evasion" model: (1) Regulation eliminates the name, but the market grows the model itself. (2) In this network, Garantex is a heavyweight host; (3) Cryptex and PM2BTC are front-end nodes that are specifically responsible for "receiving dirty money, washing it, and then throwing it into Garantex or other channels". Exved, A7A5, and PSB – the prototypes of sovereign-level “shadow banking” If Garantex is the black market and Cryptex is the gray market, then the Exved + A7 / A7A5 + PSB combination is closer to a country's on-chain laboratory project. It's not meant to evade a bill, but to rewrite the concept of "how Russia pays its foreign counterparts." 1. Exved: A USDT B2B channel disguised as a compliance platform In December 2023, a "digital settlement exchange" called Exved was quietly launched in Moscow. The official positioning is very simple: Provide cross-border digital payment services for Russian legal entities (companies). b. Supports external settlement using Tether's USDT. Almost all public reports emphasize three points: Exved is specifically aimed at export and import companies, not retail investors; it provides companies with an interface that may display "US dollars, USDT or non-resident rubles (offshore rubles)" on the front end, while the back end completes the final settlement through offshore accounts and partner institutions; the project is technically supported by the InDeFi Smart Bank team and has been approved by the Central Bank of Russia and the Federal Financial Monitoring Service (Rosfinmonitoring). From a regulatory perspective, Exved is an innovative pilot program with KYC (Know Your Customer) functionality. Structurally, it is more like a "compliance shell + stablecoin channel" built for enterprises after traditional banks were sanctioned and locked down. It doesn't directly issue any new currency; instead, it incorporates the existing USDT under a state-recognized B2B guise. 2. A7 and A7A5: The True Debut of the Ruble-Based "Shadow Stablecoin" If Exved is still at the level of "borrowing USDT for cross-border settlement", then A7 / A7A5 is the next step - putting the ruble itself on the blockchain. Elliptic's "A7 Leak" report breaks down this system very clearly: A7 is a group company that specializes in providing cross-border payment and sanctions circumvention services to Russian companies. 51% of the shares are held by Moldovan oligarch Ilan Shor—who was convicted in the 2014 Moldovan banking scandal and sanctioned by the United States for helping Russia disrupt the Moldovan elections; Another major shareholder is Promsvyazbank (PSB), the Russian state-owned defense bank. A7A5 is a ruble-based stablecoin developed by A7. The issuer is Old Vector LLC, registered in Kyrgyzstan; Each A7A5 coin is said to be backed 1:1 by ruble deposits held in the PSB account; As of mid-2025, there were approximately 41.6 billion A7A5 coins in circulation, with a total transaction value of approximately US$68 billion; Reuters, citing data from Elliptic and TRM Labs, reported that A7A5's cumulative transaction volume has exceeded $40 billion, with daily peak transaction volume exceeding $1 billion, and its market capitalization has surged from $170 million to $521 million in two weeks. More importantly, it is not a substitute for USDT, but rather a "two-tier structure": According to internal chat logs disclosed by Elliptic, A7 employees discussed using at least $1 billion to $2 billion in USDT to create market capitalization for A7A5 on various exchanges—first using USDT to create liquidity, and then exchanging the tokens for A7A5 to make it look "like a deep stablecoin market." In July 2025, the official A7 Telegram channel announced that it would inject $100 million worth of USDT liquidity into the A7A5 DEX to meet market demand for "A7A5 ↔ USDT best price". With this combination of measures, A7A5's role becomes very clear: it is an "on-chain ruble liability" attached to the PSB balance sheet, using USDT as a credit engine to avoid the risk of Tether freezing assets. For Russian companies, this means that even if they are kicked out of SWIFT and their bank accounts struggle to make cross-border payments, they can still: Rubles → Deposit into PSB → A7A5 → Settle payment on-chain → Exchange back to local fiat currency or USDT. From the outside, it is a technological product; from a geopolitical perspective, it is more like a "ruble-based shadow central bank pipeline" built outside the SWIFT system. In Elliptic's "A7 leak" report, one passage stands out: The A7 Group not only helped Russian companies circumvent regulations by purchasing parts and negotiating freight rates, but it was also used to support political projects in Moldova. Leaked documents and on-chain records show that Shor's funds flowed through stablecoins to a network of applications and organizations called "Taito," which was used to pay political activists and cover propaganda costs. In their sanctions, the United States and the European Union explicitly accused Shor of “using funding and disinformation networks to undermine democracy in Moldova,” and A7 and its encrypted channels are considered one of the key infrastructures for this activity. This does not mean we can simply conclude that "PSB + A7A5 = directly issuing USDT to voters in a certain region to buy votes"; the publicly available materials are not sufficient to draw such a detailed line. But what is certain is that the same financial framework is not only helping Russian companies buy goods and circumvent sanctions, but also providing a tool for distributing funds for political influence operations. When sovereign banks (PSBs), shadow payment groups (A7), and on-chain stablecoins (A7A5) are linked together, Money is no longer just an "economic variable," but a cross-border, programmable geopolitical weapon. Below SWIFT lies the US dollar; outside of SWIFT lies the shadow network. If you abstract all of this into a diagram, you will see a structure like this: Garantex: It aggregates Russian retail investors, gray market traders, black money, and some energy-related funds into a "Rube↔ stablecoin" black market clearing pool; Cryptex / PM2BTC and similar no-KYC exchange tools provide a front-end entry point for ransomware, fraudulent shops, and some sanctioned entities to "get on board and launder money." Exved + A7 / A7A5 + PSB: This extends the network from "civilian and black market" to "semi-official B2B payments" and "on-chain ruble sovereign projects"—breaking down what could only be calculated on the central bank's balance sheet into a token that can jump between Tron and Ethereum. In this network, USDT is the blood, PSB's ruble deposits are the skeleton, Garantex/Cryptex are the capillaries, and A7A5 is a newly grown heart valve—its existence is to keep this cycle beating outside of SWIFT. This is not a joke about sanctions, but a stress test of the limits of the global financial order. When a major power expelled from SWIFT begins to skillfully use stablecoins, shadow platforms, and its own "on-chain ruble" to conduct trade and political engineering, the question is no longer: "Can Russia be blocked?", but rather: "Will a financial sewer that can never be cleaned up grow outside of the US dollar and SWIFT?" The machine that's running inside the Moscow Federation Building is just the first section of this sewer system. References <1>https://home.treasury.gov/news/press-releases/jy0713 <2>https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-list-data-formats <3>https://www.icij.org/investigations/shadow-money/ <4> FinCEN – Advisory FIN-2023-A002 <5>https://tass.ru/ekonomika <6>OFAC Notice – September 26, 2024 <7>US Treasury Press Release – April 5, 2022 <8>Chainalysis Crypto Crime Report 2023 <9>https://cryptonews.com/news/russias-exved-launches-cross-border-payment-service-powered-by-tethers-usdt-stablecoin <10> https://en.wikipedia.org/wiki/Garantex?utm_source=chatgpt.com <11>https://www.chainalysis.com/blog/ofac-sanctions-russian-exchange-cryptex-uaps-fraud-shop-2024/? <12> https://zh.spaziocrypto.com/wen-ding-bi/e-luo-si-wen-ding-bi-a7a5-zai-4-ge-yue-nei-liu-dong-93-yi-mei-yuan/Author: Anita @anitahityou Three years after the West cut off Russia's connection to SWIFT, the Kremlin has not suffered a financial suffocation. On the contrary, a massive "shadow financial machine" is operating within the Federal Palace in Moscow. This machine no longer relies on JPMorgan Chase, nor is it afraid of a dollar freeze order. According to U.S. Treasury documents, blockchain analysis reports, and data from the ICIJ, this machine is roughly composed of three interlocking gears: Garantex (black market hub), Cryptex (hidden backup), and the Exved/A7 system (national-level B2B channel and "on-chain rubles"). Garantex the Phoenix – The Crossroads of Gangsters and Oil Capital Garantex is a name already highlighted in red on the U.S. Treasury Department's sanctions list; in Russia's grey trade and capital flight system, it is an indispensable "clearing house". 1. On the surface, it's an exchange; beneath, two hidden rivers flow. Public information shows that Garantex was established in Moscow in 2019, with its registered office located in the iconic Federal Building. It was co-founded by Stanislav Drugalev, Sergey Mendeleev, and others. In April 2022, it was sanctioned by the US OFAC for its associated transactions with the darknet market Hydra and the ransomware Conti. At least $100 million in transactions were directly identified as related to criminal activities. However, even after the sanctions, it remains "one of the main channels for Russian funds to enter and leave the world." When the ICIJ investigation zoomed in on the shareholding structure, the picture began to distort: A company deeply intertwined with Garantex is called Fintech Corporation—it is both the owner of the Garantex App and the operator of brands such as "Garantex Academy." Russian company registration records show that Fintech holds a 50% stake in a debt collection company called "Academy of Conflicts," while the other half is controlled by Alexander Tsarapkin, a "gang leader" convicted of extortion and previously sentenced to seven years in prison for extortion. Pavel Karavatsky, a key shareholder of Fintech, previously served on the board of directors of Peresvet Bank, which was later taken over by Rosneft (Russia's state-owned oil company); Fintech also initially used contact information and email domains associated with Rosneft's logistics subsidiary. Looking back from this cold, hard chain of company registration documents, we see state-owned oil capital, violent debt collection companies, and sanctioned cryptocurrency exchanges. This does not mean that "Rosneft is manipulating Garantex," but it is enough to show that Garantex's ability to continue handling billions of dollars of stablecoin liquidity despite being attacked from three sides by OFAC, Tether, and the EU is not simply due to "technology and entrepreneurial spirit." It is a central gear embedded in a larger national network of gray capital. Cryptex – Plan B lurking on Garantex's flank When Garantex becomes a case study under the regulatory spotlight, the strategy of "doing only Garantex and nothing else" becomes too dangerous for black and gray market funds. The market will naturally develop backup lines, and Cryptex is a prime example. 1. The "hidden redemption machine" named by OFAC Cryptex is ostensibly a "Russian cryptocurrency exchange platform" that supports instant exchange of fiat currency and virtual assets. However, on September 26, 2024, the U.S. Treasury Department's OFAC added it and its operator, Sergey Sergeevich Ivanov, to its sanctions list, accusing it of providing money laundering and settlement services for "fraud shops, ransomware organizations, darknet markets, and other criminal activities." Chainalysis's on-chain analysis revealed that Cryptex has processed approximately $5.88 billion in cryptocurrency transactions since 2018, a significant portion of which originated from "high-risk and even obviously illegal" source addresses. Another platform associated with Ivanov, PM2BTC, was identified by FinCEN as a "primary money laundering concern," with nearly half of its business related to criminal activities. If Garantex is more of a "ruble-stablecoin clearing pool both inside and outside Russia," then Cryptex/PM2BTC is positioned as a "lighter, more anonymous money laundering gateway." 2. What cannot be killed is not a single platform, but an entire structure. Structurally, Cryptex plays the role of a typical "flank substitute": when Garantex's on-chain addresses are blacklisted in batches, many dark web shops, fraud gangs, and ransomware operators will switch their settlement channels to KYC-free exchangers like Cryptex or PM2BTC; and when Cryptex itself is sanctioned, a new "Cryptex 2.0" will appear under a different name. This is a "decentralized evasion" model: (1) Regulation eliminates the name, but the market grows the model itself. (2) In this network, Garantex is a heavyweight host; (3) Cryptex and PM2BTC are front-end nodes that are specifically responsible for "receiving dirty money, washing it, and then throwing it into Garantex or other channels". Exved, A7A5, and PSB – the prototypes of sovereign-level “shadow banking” If Garantex is the black market and Cryptex is the gray market, then the Exved + A7 / A7A5 + PSB combination is closer to a country's on-chain laboratory project. It's not meant to evade a bill, but to rewrite the concept of "how Russia pays its foreign counterparts." 1. Exved: A USDT B2B channel disguised as a compliance platform In December 2023, a "digital settlement exchange" called Exved was quietly launched in Moscow. The official positioning is very simple: Provide cross-border digital payment services for Russian legal entities (companies). b. Supports external settlement using Tether's USDT. Almost all public reports emphasize three points: Exved is specifically aimed at export and import companies, not retail investors; it provides companies with an interface that may display "US dollars, USDT or non-resident rubles (offshore rubles)" on the front end, while the back end completes the final settlement through offshore accounts and partner institutions; the project is technically supported by the InDeFi Smart Bank team and has been approved by the Central Bank of Russia and the Federal Financial Monitoring Service (Rosfinmonitoring). From a regulatory perspective, Exved is an innovative pilot program with KYC (Know Your Customer) functionality. Structurally, it is more like a "compliance shell + stablecoin channel" built for enterprises after traditional banks were sanctioned and locked down. It doesn't directly issue any new currency; instead, it incorporates the existing USDT under a state-recognized B2B guise. 2. A7 and A7A5: The True Debut of the Ruble-Based "Shadow Stablecoin" If Exved is still at the level of "borrowing USDT for cross-border settlement", then A7 / A7A5 is the next step - putting the ruble itself on the blockchain. Elliptic's "A7 Leak" report breaks down this system very clearly: A7 is a group company that specializes in providing cross-border payment and sanctions circumvention services to Russian companies. 51% of the shares are held by Moldovan oligarch Ilan Shor—who was convicted in the 2014 Moldovan banking scandal and sanctioned by the United States for helping Russia disrupt the Moldovan elections; Another major shareholder is Promsvyazbank (PSB), the Russian state-owned defense bank. A7A5 is a ruble-based stablecoin developed by A7. The issuer is Old Vector LLC, registered in Kyrgyzstan; Each A7A5 coin is said to be backed 1:1 by ruble deposits held in the PSB account; As of mid-2025, there were approximately 41.6 billion A7A5 coins in circulation, with a total transaction value of approximately US$68 billion; Reuters, citing data from Elliptic and TRM Labs, reported that A7A5's cumulative transaction volume has exceeded $40 billion, with daily peak transaction volume exceeding $1 billion, and its market capitalization has surged from $170 million to $521 million in two weeks. More importantly, it is not a substitute for USDT, but rather a "two-tier structure": According to internal chat logs disclosed by Elliptic, A7 employees discussed using at least $1 billion to $2 billion in USDT to create market capitalization for A7A5 on various exchanges—first using USDT to create liquidity, and then exchanging the tokens for A7A5 to make it look "like a deep stablecoin market." In July 2025, the official A7 Telegram channel announced that it would inject $100 million worth of USDT liquidity into the A7A5 DEX to meet market demand for "A7A5 ↔ USDT best price". With this combination of measures, A7A5's role becomes very clear: it is an "on-chain ruble liability" attached to the PSB balance sheet, using USDT as a credit engine to avoid the risk of Tether freezing assets. For Russian companies, this means that even if they are kicked out of SWIFT and their bank accounts struggle to make cross-border payments, they can still: Rubles → Deposit into PSB → A7A5 → Settle payment on-chain → Exchange back to local fiat currency or USDT. From the outside, it is a technological product; from a geopolitical perspective, it is more like a "ruble-based shadow central bank pipeline" built outside the SWIFT system. In Elliptic's "A7 leak" report, one passage stands out: The A7 Group not only helped Russian companies circumvent regulations by purchasing parts and negotiating freight rates, but it was also used to support political projects in Moldova. Leaked documents and on-chain records show that Shor's funds flowed through stablecoins to a network of applications and organizations called "Taito," which was used to pay political activists and cover propaganda costs. In their sanctions, the United States and the European Union explicitly accused Shor of “using funding and disinformation networks to undermine democracy in Moldova,” and A7 and its encrypted channels are considered one of the key infrastructures for this activity. This does not mean we can simply conclude that "PSB + A7A5 = directly issuing USDT to voters in a certain region to buy votes"; the publicly available materials are not sufficient to draw such a detailed line. But what is certain is that the same financial framework is not only helping Russian companies buy goods and circumvent sanctions, but also providing a tool for distributing funds for political influence operations. When sovereign banks (PSBs), shadow payment groups (A7), and on-chain stablecoins (A7A5) are linked together, Money is no longer just an "economic variable," but a cross-border, programmable geopolitical weapon. Below SWIFT lies the US dollar; outside of SWIFT lies the shadow network. If you abstract all of this into a diagram, you will see a structure like this: Garantex: It aggregates Russian retail investors, gray market traders, black money, and some energy-related funds into a "Rube↔ stablecoin" black market clearing pool; Cryptex / PM2BTC and similar no-KYC exchange tools provide a front-end entry point for ransomware, fraudulent shops, and some sanctioned entities to "get on board and launder money." Exved + A7 / A7A5 + PSB: This extends the network from "civilian and black market" to "semi-official B2B payments" and "on-chain ruble sovereign projects"—breaking down what could only be calculated on the central bank's balance sheet into a token that can jump between Tron and Ethereum. In this network, USDT is the blood, PSB's ruble deposits are the skeleton, Garantex/Cryptex are the capillaries, and A7A5 is a newly grown heart valve—its existence is to keep this cycle beating outside of SWIFT. This is not a joke about sanctions, but a stress test of the limits of the global financial order. When a major power expelled from SWIFT begins to skillfully use stablecoins, shadow platforms, and its own "on-chain ruble" to conduct trade and political engineering, the question is no longer: "Can Russia be blocked?", but rather: "Will a financial sewer that can never be cleaned up grow outside of the US dollar and SWIFT?" The machine that's running inside the Moscow Federation Building is just the first section of this sewer system. References <1>https://home.treasury.gov/news/press-releases/jy0713 <2>https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-list-data-formats <3>https://www.icij.org/investigations/shadow-money/ <4> FinCEN – Advisory FIN-2023-A002 <5>https://tass.ru/ekonomika <6>OFAC Notice – September 26, 2024 <7>US Treasury Press Release – April 5, 2022 <8>Chainalysis Crypto Crime Report 2023 <9>https://cryptonews.com/news/russias-exved-launches-cross-border-payment-service-powered-by-tethers-usdt-stablecoin <10> https://en.wikipedia.org/wiki/Garantex?utm_source=chatgpt.com <11>https://www.chainalysis.com/blog/ofac-sanctions-russian-exchange-cryptex-uaps-fraud-shop-2024/? <12> https://zh.spaziocrypto.com/wen-ding-bi/e-luo-si-wen-ding-bi-a7a5-zai-4-ge-yue-nei-liu-dong-93-yi-mei-yuan/