Cryptocurrency Exchange Profiles

More than $14.8 billion in cryptocurrency received since August 2022, overwhelmingly USDT (Chainalysis data via ICIJ). No OFAC, EU, UK or FinCEN designation as of June 2026. Physical cash payout network authenticated by an ICIJ undercover test. Structural off-ramp for extortion proceeds; no exchange-specific ransomware attribution published.

$96B+ lifetime volume. $26M+ frozen. Disrupted March 2025 by DOJ, Germany, Finland. Successor Grinex reconstituted within days, processed tens of billions before April 2026 hack. 3 operators sanctioned, 1 arrested in India.

$5.88B+ lifetime volume. $51.2M+ ransomware-derived inflows; $720M+ to fraud shops, mixers and Garantex. Ivanov ("Taleon") cluster: UAPS, PinPays, PM2BTC, Cryptex. Sanctioned and seized Sept 26, 2024 (OFAC, FinCEN 311, DOJ, Dutch FIOD; EUR 7M seized). Operators indicted, at large in Russia.

10,333 BTC (~$389.7M) processed since 2021; about 80% of traced illicit exposure is ransomware (20+ groups incl. BlackCat, Qilin, LockBit). Mixer-as-a-service run through 6,000+ KYC money-mule accounts. Dismantled June 10, 2026 across 11 countries: ~25 domains and 30+ servers seized, 2 admins arrested in Batumi, Georgia. No sanctions.

UK-sanctioned 26 May 2026. Credibly tied to the Mendeleev cluster (single strong government source; the named operator denies founding it). Assessed Russia-based controllers operating under a tolerated safe harbor.

Sanctioned across three regimes (OFAC 25 Mar 2024; UK 26 May 2026). UAE-registered shell running Russia-focused P2P crypto; controllers assessed in Russia or the UAE. No named-individual attribution.

UK and Ukraine sanctioned 26 May 2026 (RUS3602); still active. CEO Sergei Zhdanov holds 75%+ of EXMO Exchange Limited (UK Companies House) after a 2022 stake transfer from a Russian-citizen co-founder.

UK-sanctioned 26 May 2026 (RUS3605); now liquidating. Georgian-registered via British-national nominee Ilyas Ahaev; assessed Moscow-run by proxy per Georgia's Finance Ministry.

The origin node of the Russian low-KYC exchange model. $9B+ processed 2011 to 2017; cashed out 95% of tracked ransomware payments; laundered the Mt. Gox theft. Seized July 2017 (NJ servers); $110M FinCEN penalty. Direct successor WEX relaunched in 52 days on the same customer base, then collapsed in 2018 amid an alleged $450M FSB expropriation. Operator wallets still moved ~$694M in Oct 2025.

Interactive link analysis of the Russia/CIS sanctions-evasion cluster that absorbed Garantex flows after the March 2025 takedown: Grinex, Exved, InDeFi / A7 successors and the UK-designated five-pack. Every edge is sourced.