Sanctioned crypto exchange Garantex might have lost $26 million in frozen Tether, but another $15 million in crypto is still moving, or at least quietly sitting.
Weeks after the United States led a high-profile freeze of $26 million in Tether (USDT) assets tied to sanctioned Russian crypto exchange Garantex, a new investigation suggests the enforcement may have only scratched the surface.
A report from blockchain analytics firm Global Ledger, found that more than $15 million in additional reserves remain untouched across Ethereum, Bitcoin, and BNB Chain networks. These assets appear to be active, and in some cases, already on the move.
While the official Tether freeze targeted Garantex’s USDT holdings, the exchange reportedly has exposure well beyond that. As Global Ledger wrote in the report shared with crypto.news, the exchange also handled Bitcoin (BTC), Ethereum (ETH), and a range of other tokens ERC-20, BEP-20, and even a ruble-pegged stablecoin called A7A5.
The sanctions freeze, coordinated with Germany and Finland, took place over three days in early March. On March 6, Garantex publicly acknowledged the enforcement action. That same day, an Ethereum wallet linked to Garantex suddenly came back online, the report points out.
It had been quiet for months. Now, it was aggregating 3,265 ETH or roughly $8.6 million. Then the laundering began.
Between May 22 and June 4, more than $2.25 million worth of ETH was gradually routed through Tornado Cash, an Ethereum-based mixing protocol. Global Ledger says the wallet sent 844.99 ETH to the mixer in batches, making it harder to trace. The firm flagged these as part of what it calls “coordinated liquidity outflows.”
Calculated decision
The activity didn’t stop there. On May 30, for example, 206 ETH — about $280,000 — was mixed through Tornado Cash. Just days later, on June 4, another 30 ETH was sent through. As of that date, the wallet still held over 2,334 ETH, or roughly $6.1 million.
“These patterns strongly suggest an intentional money laundering effort to obscure links to Garantex. The activity is ongoing, with real-time alerts continuing to track fresh outflows from this same reserve.”
Global Ledger
The situation with Bitcoin was strikingly similar. In early March, Global Ledger identified an aggregation of 19.39 BTC, again from dormant addresses. Over the next few weeks, that number grew to 30.04 BTC, worth about $3.17 million. Some of that Bitcoin didn’t stay on the same chain for long. In early May, 2.2 BTC was bridged to the TRON (TRX) network and partially sent to Grinex, a suspected successor to Garantex.
According to Global Ledger CEO Lex Fisun, the move to TRON likely reflects a calculated decision to take advantage of the network’s speed and low cost. “TRON is cheap, liquid, and fast,” Fisun told crypto.news. “If your end goal is to swap BTC into stablecoins, bridging straight into the chain that already dominates those flows is the path of least resistance.”
“Transfers [on TRON] cost less than what you’d pay on Bitcoin or Ethereum. Even non-subsidised tokens still cost fractions of a cent, and for USDT, moving value is literally free, with recent gas-free upgrades.”
Lex Fisun
Whether or not Grinex is acting as the successor to the sanctioned exchange remains to be confirmed, but Global Ledger doesn’t appear to have much doubt. The firm noted that all of Garantex’s assets were immediately withdrawn after the March freeze and sent directly to Grinex-linked wallets.
No big red button
The BNB Chain also played a quiet but curious role. Unlike Ethereum or TRON, BNB Chain doesn’t support Tether. That means Tether has no power to freeze assets there. As it turns out, funds on BNB Chain stopped moving the same day Garantex announced its suspension: March 6. But there were no burns, no swaps, and no withdrawals. As of June, Global Ledger estimates the BNB-based reserves at around $4 million, still unspent.
Fisun noted that this creates a strategic blind spot for sanctions enforcement. “There’s no ‘big red button,’ so enforcement on BNB Chain relies on off-chain actors,” he said, pointing out that in practice, freezing assets on BNB Chain is slower and more uncertain. “It took nearly two years with the PopcornSwap scam,” Fisun emphasized.
The Global Ledger CEO also added that while BNB Chain is more opaque, its limited share of dollar-pegged stablecoins makes it less critical overall.
“[…] only about $5 billion in USDT circulates on BNB Chain versus $73.8 billion on TRON. Also, using BNB Chain requires an extra wrapping/bridging step that traders and bad actors would rather skip when TRON already offers deeper books and zero fees.”
Lex Fisun
All told, the analytics firm estimates that at least $15 million in Garantex-linked crypto remains outside U.S. enforcement reach. And that figure doesn’t include any new tokens or potential stealth wallets that haven’t been traced yet.
It’s not just about the numbers. The bigger concern might be what these patterns represent: a loophole in multi-chain enforcement. While token-level freezes — like the one imposed on Tether — can be effective on paper, they’re far less useful when entities move assets between chains, or into stablecoins not issued by U.S.-based companies.
As Global Ledger says, Garantex’s “on-chain manoeuvring underscores the growing challenge of enforcing asset freezes.
When asked about USDC exposure, Fisun said Global Ledger had tracked assets that moved just before the freeze. “The blocked Garantex wallets still hold 73,283 USDC,” he said, adding that on March 4, more than 290,000 USDC went from “blocked Ethereum wallets to one of the top 10 exchanges’ deposit addresses.”
He added that smaller holdings might have flown under the radar, noting that the likely reason the addresses weren’t frozen was the relatively small balances involved, and that it may have simply come down to the numbers.
