Russia-linked cryptocurrency services and sanctions evasion: what is confirmed in the official study
A UK-based blockchain analytics company (London), specializing in tracking crypto transactions and identifying risks related to money laundering, fraud, and sanctions evasion, has published a study examining crypto platforms that maintain operational or financial ties with Russia. The report states that significant transaction volumes linked to the Russian market continue to flow through such services, despite existing international restrictions.
It is noted that cryptocurrency exchanges and services connected to Russia continue to provide routes for sanctions circumvention. These platforms create transactional channels that enable Russian entities to conduct cross-border payments outside the traditional banking infrastructure and without the involvement of conventional financial intermediaries.
The described scheme предполагает, that fiat funds — particularly rubles — are converted into cryptoassets through such services. The cryptocurrency is then transferred abroad directly via blockchain without passing through the banking system. Subsequently, the received assets can be exchanged into local currency overseas through foreign crypto brokers or exchanges.
Despite increasing regulatory pressure, some of these platforms — including services formally registered outside Russia — continue to process substantial volumes of crypto transactions linked to sanctioned entities. It is emphasized that many of the listed platforms themselves have not yet been officially added to sanctions lists.
Bitpapa
Bitpapa is a P2P (peer-to-peer) cryptocurrency exchange with corporate registration in the United Arab Emirates. However, its primary user base consists of users from Russia. The platform allows rubles to be exchanged for a range of cryptoassets.
In March 2024, the service was added to the sanctions list of the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) for supporting the circumvention of Russia-related sanctions.
As evidence of the platform’s involvement in such schemes, a high level of interaction with other sanctioned entities is cited. Approximately 9.7% of outgoing crypto funds are directed to OFAC-sanctioned targets. Of this amount, about 5% of transfers are sent specifically to the sanctioned exchange Garantex.
Additionally, blockchain data analysis shows that the service applies a strategy of continuous wallet address rotation. This involves regularly changing the addresses in use in order to make it more difficult for transaction monitoring systems to identify the platform as a counterparty. Such a technique complicates the tracing of fund origins and helps conceal their Russian source from downstream services receiving the funds.
ABCeX
ABCeX provides both order-book trading and P2P operations in the “ruble-to-cryptoasset” direction. The platform operates an office in Moscow’s Federation Tower — a building previously used by the sanctioned exchange Garantex.
It is reported that the service employs a wallet obfuscation strategy aimed at preventing direct attribution of cryptocurrency transactions to the platform.
According to the study, ABCeX has processed at least $11 billion in cryptoassets. A substantial portion of the funds was directed to the sanctioned Garantex, as well as to Aifory Pro, which is discussed below.
The publication also provides data on direct transaction flows between ABCeX and sanctioned or high-risk entities associated with the Russian market.
Exmo (Exmo.com and Exmo.me)
The study examines a case where claimed geographic and operational separation is not supported by blockchain data. Following the events of 2022, Exmo publicly announced its exit from the Russian market and the sale of its regional business to Exmo.me.
However, transaction analysis shows that Exmo.com and Exmo.me continue to share the same custodial wallet infrastructure. Cryptoassets deposited into either platform are pooled into identical hot wallet addresses. Similarly, withdrawals from both platforms are executed from the same addresses.
This indicates the absence of actual operational separation between the entities. Funds entering through the Russian-facing platform may be co-mingled with funds associated with the Western segment of the business.
It is reported that the total volume of direct transactions with sanctioned entities exceeded $19.5 million. Named counterparties include Garantex, Grinex, and Chatex. The publication also presents diagrams of direct wallet interactions between Exmo and sanctioned or high-risk entities with a Russian nexus.
Rapira
Rapira is described as a cryptocurrency exchange incorporated in Georgia, with an office in Moscow, facilitating ruble-based trading.
It is stated that the platform engaged in direct cryptoasset transactions “to and from” the sanctioned exchange Grinex. The total volume of such operations exceeded $72 million.
It is also noted that Rapira’s Moscow offices were reportedly raided as part of an investigation into suspected capital flight to Dubai. The publication provides data on direct interactions between Rapira wallets and sanctioned or high-risk Russia-linked entities.
Aifory Pro
Aifory Pro specializes in “cash-to-cryptoasset” services in Moscow, Dubai, and Türkiye. The platform also positions itself as a “Foreign Economic Activity Payment Agent” facilitating international trade settlements, for example between Russia and China.
It is explicitly stated that the service facilitates the bypassing of restrictions on access to foreign services by offering virtual payment cards and Apple Pay-enabled cards. These tools use a customer’s USDT balance to pay for foreign services such as Airbnb and ChatGPT, which would otherwise be restricted for users in Russia.
An additional high-risk factor cited is the platform’s direct financial links to the Iranian cryptocurrency exchange Abantether. It is reported that nearly $2 million in cryptoassets were transferred to this exchange.
Overall conclusion and potential future developments
The described structure demonstrates that sanctions imposed on individual cryptocurrency services have not led to a complete cessation of related flows. Instead, activity has been redistributed among platforms, some of which are formally registered outside Russia or have not yet been included in sanctions lists.
The core model remains unchanged: rubles are converted into cryptoassets, funds are transferred via blockchain without involving traditional banking infrastructure, and subsequently exchanged into fiat currency in other jurisdictions through foreign exchanges or brokers.
The current dynamics may lead to several possible developments:
- expansion of sanctions lists to include additional crypto services;
- stricter compliance requirements imposed by international crypto exchanges and payment operators;
- increased use of blockchain analytics to identify links between addresses and platforms;
- a rise in asset freezes and account blocks affecting users interacting with high-risk services;
- a shift toward more complex transaction masking schemes, including multi-layer routing and intermediary wallets.
Overall, the trend points not to the disappearance of such mechanisms but to their evolution. Strengthened regulatory oversight and the development of analytical tools are likely to be accompanied by further adaptation of the infrastructure and the search for new transaction routes. For users and companies, this implies growing legal and operational risks when dealing with platforms that demonstrate exposure to sanctioned entities.
