US, European law enforcement seize Russian crypto exchange Garantex and indict 2 administrators

Avatar

Russian cryptocurrency exchange Garantex was taken down in an apparent seizure by U.S. and European law enforcement Thursday, shortly after the company said $28 million had been frozen by another cryptocurrency firm.

“The domain for Garantex has been seized by the United States Secret Service pursuant to a seizure warrant obtained by the United States Attorney’s Office for the Eastern District of Virginia under the authority of 18 U.S.C §§ 981 and 982,” a notice on the exchange’s website says. The image includes insignias of the FBI, Justice Department, the Secret Service, Europol and several European law enforcement agencies. 

“This action has been taken in coordination with the U.S. Department of Justice’s Criminal Division, the Federal Bureau of Investigation, Europol, the Dutch National Police, the German Federal Criminal Police Office, the Frankfurt General Prosecutor’s Office, the Finnish National Bureau of Investigation, and the Estonian National Criminal Police.”

The FBI declined to comment on the notice and the Justice Department did not respond to a request for comment. Europol confirmed to Recorded Future News that it “provided forensic support for this operation.”

Last week, the European Union announced sanctions on Garantex, writing that the platform was used to circumvent sanctions and had ties to Russian banks that had also been sanctioned. 

Garantex was sanctioned by the Treasury Department in 2022 due to its prominent role in the Russian ransomware ecosystem. U.S. officials said at the time that cybercriminals use the platform to effectively cash out illicitly-gained cryptocurrency and investigators traced over $100 million in transactions that were associated with illicit actors and darknet markets, including nearly $6 million from Russian ransomware gang Conti. 

On Thursday, Garantex posted a message on Telegram claiming more than 2.5 billion rubles — or about $28 million — had been frozen by stablecoin operator Tether. Tether controls the widely-used USDT coin, which is pegged to the U.S. dollar. 

“Dear users! We have bad news. Tether has entered the war against the Russian crypto market and blocked our wallets worth more than 2.5 billion rubles,” Garantex told its users. 

“We are temporarily suspending all services, including cryptocurrency withdrawals, while our entire team solves this problem. We are fighting and will not give up! Please note that all USDT in Russian wallets is now under threat. As always, we are the first, but not the last.”

Garantex was founded in 2019 and has become one of the largest cryptocurrency exchanges in Russia, gaining further prominence after Russia’s invasion of Ukraine in 2022. 

The platform allowed people to circumvent sanctions on Russian banks by bringing rubles to the company’s offices in Moscow and St. Petersburg and getting cryptocurrency in return, which can then be exchanged for other fiat currencies. 

U.S. and European law enforcement agencies have repeatedly accused the platform of being used by cybercriminals, gangs and designated terrorist groups.

Editor’s note: This article was updated on March 7 with comment from Europol. 

CybercrimeGovernmentNewsTechnology
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Home appliance company Presto says cyberattack causing delivery delays

Next Post

Malicious use of Cobalt Strike down 80% after crackdown, Fortra says

Related Posts

Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet

Threat actors have been observed actively exploiting security flaws in GeoVision end-of-life (EoL) Internet of Things (IoT) devices to corral them into a Mirai botnet for conducting distributed denial-of-service (DDoS) attacks. The activity, first observed by the Akamai Security Intelligence and Response Team (SIRT) in early April 2025, involves the exploitation of two operating system command
Avatar
Read More

Your SaaS Data Isn’t Safe: Why Traditional DLP Solutions Fail in the Browser Era

Traditional data leakage prevention (DLP) tools aren't keeping pace with the realities of how modern businesses use SaaS applications. Companies today rely heavily on SaaS platforms like Google Workspace, Salesforce, Slack, and generative AI tools, significantly altering the way sensitive information is handled. In these environments, data rarely appears as traditional files or crosses networks
Avatar
Read More