Garantex.org, Garantex.io & Garantex.academy Investigation: The Cryptocurrency Exchange Seizure Explained
Case Type: Cryptocurrency Exchange / Money Laundering Allegations / Sanctions / Digital Forensics
Case ID: CASE-2026-015
Investigation Status: Law-Enforcement Action
Published: August 2026
Investigated By: [Your Firm Name]
Executive Summary
Garantex.org, Garantex.io and Garantex.academy were three domains associated with the Garantex cryptocurrency operation that became the subject of a major international law-enforcement action.
On March 6, 2025, U.S. authorities seized the three domains as part of an international operation targeting the cryptocurrency exchange. The U.S. Department of Justice announced the action on March 7, 2025, stating that the operation disrupted what prosecutors described as a multibillion-dollar cryptocurrency money-laundering service.
The DOJ stated that Garantex processed at least $96 billion in cryptocurrency transactions since April 2019.
According to prosecutors, the exchange allegedly processed hundreds of millions of dollars in criminal proceeds associated with activities including ransomware, hacking, terrorism and drug trafficking. These statements are allegations contained in the government’s case and should not be presented as a final criminal judgment.
The Garantex investigation is particularly significant because it involves much more than a suspicious website.
The case includes:
- Multiple domains.
- Cryptocurrency wallets.
- International servers.
- Customer databases.
- Accounting databases.
- U.S. sanctions.
- Criminal charges.
- Blockchain transactions.
- International law-enforcement cooperation.
The result is one of the more significant examples of a cryptocurrency investigation involving both website infrastructure and blockchain evidence.
1. The Three Garantex Domains
The three domains identified in the March 2025 law-enforcement action were:
Garantex.org
This became the primary public-facing Garantex domain after the operation moved away from Garantex.io.
Garantex.io
This was the earlier Garantex domain and was specifically identified by the U.S. Treasury in its 2022 sanctions designation.
Garantex.academy
This domain was associated with Garantex’s educational and instructional infrastructure.
The DOJ specifically named all three domains in its seizure announcement.
That makes it important to investigate the three websites as a connected digital ecosystem rather than as unrelated domains.
2. Garantex.io
Garantex.io was the earlier primary website associated with the cryptocurrency exchange.
The U.S. Treasury’s Office of Foreign Assets Control designated Garantex Europe OÜ on April 5, 2022.
OFAC’s designation specifically identified:
Website: garantex.io
and listed cryptocurrency addresses associated with the entity.
This means the Garantex investigation did not begin with the 2025 seizure.
The exchange had already been subject to U.S. sanctions several years earlier.
3. Garantex.org
Following the earlier operation of Garantex.io, the Garantex infrastructure later used:
garantex.org
OFAC’s updated sanctions information identifies Garantex Europe OÜ under the alternate name GARANTEX and lists both:
garantex.io
and
garantex.org
as websites associated with the designated entity.
This is important because it provides official evidence connecting the two domains at the sanctions-record level.
The 2025 DOJ action subsequently identified Garantex.org as one of the domains seized by U.S. authorities.
4. Garantex.academy
The third domain,
garantex.academy
was also identified by the DOJ as part of the Garantex infrastructure seized in March 2025.
The domain is significant because it demonstrates that the operation’s online presence extended beyond the exchange itself.
Digital investigations should therefore examine associated educational, promotional and support websites whenever they are connected to a cryptocurrency platform.
Such sites can contain valuable evidence, including:
- Trading instructions.
- Platform explanations.
- Contact information.
- User-registration information.
- Links to exchange infrastructure.
- Marketing material.
- Historical operator information.
5. March 2025 Law-Enforcement Seizure
On March 6, 2025, U.S. authorities executed a seizure order against the three Garantex domains.
The DOJ announced the action on March 7.
The operation was international and involved cooperation between U.S. and European authorities.
Visitors to the seized domains were redirected to a law-enforcement seizure notice.
This is a critical distinction from an ordinary website becoming unavailable.
A website disappearing can happen for many reasons.
A law-enforcement seizure is fundamentally different.
It means authorities obtained legal authority to take control of the specified digital infrastructure.
6. The $96 Billion Transaction Figure
The DOJ stated that Garantex processed at least:
$96 billion in cryptocurrency transactions
since April 2019.
This number should be explained carefully.
It represents reported transaction volume.
It does not mean that:
$96 billion was stolen from customers.
Cryptocurrency transaction volume can include deposits, withdrawals, transfers between users and other movements of digital assets.
Nevertheless, the figure illustrates the enormous scale attributed to the Garantex operation by U.S. prosecutors.
7. U.S. Sanctions Began in 2022
The Garantex case predates the 2025 domain seizure.
On April 5, 2022, OFAC designated Garantex Europe OÜ.
The Treasury described Garantex as a Russia-based virtual-currency exchange and identified its role in facilitating transactions involving illicit activity.
OFAC’s designation included specific cryptocurrency addresses associated with Garantex.
Those addresses provide an important starting point for blockchain investigators.
8. Updated OFAC Information
OFAC subsequently updated its sanctions information.
The current OFAC material identifies Garantex Europe OÜ as:
GARANTEX EUROPE OU
and also identifies the organization as:
GARANTEX
The record includes:
garantex.io
and
garantex.org
as websites associated with the entity.
The updated information also identifies additional cryptocurrency addresses associated with Garantex, including addresses on Ethereum and TRON.
This provides investigators with multiple blockchain starting points.
9. Cryptocurrency Wallet Evidence
Cryptocurrency transactions are one of the most important forensic components of the Garantex case.
Official sanctions records identify specific cryptocurrency addresses.
Investigators can use those addresses to examine:
- Incoming transactions.
- Outgoing transactions.
- Wallet relationships.
- Transaction timing.
- Exchange deposits.
- Exchange withdrawals.
- Cross-chain activity.
- Repeated counterparties.
A blockchain investigation can potentially reconstruct the movement of cryptocurrency across thousands of transactions.
However, investigators must distinguish between:
Where cryptocurrency moved
and:
Who controlled the wallet.
Blockchain evidence can establish transaction activity, while additional evidence may be required to establish real-world ownership or control.
10. Server Evidence
The Garantex case is particularly important for digital forensics because the DOJ stated that authorities obtained copies of Garantex servers.
The DOJ said the servers contained:
- Customer databases.
- Accounting databases.
German and Finnish authorities also seized servers associated with the operation.
This type of evidence can be considerably more valuable than simply examining a public website.
A server image may potentially contain:
- Customer records.
- Transaction records.
- Administrative accounts.
- Internal communications.
- Login records.
- Wallet information.
- Accounting information.
- IP addresses.
- Customer-support records.
The existence of these records creates opportunities for investigators to reconstruct how the platform operated internally.
11. The Criminal Case
The DOJ announced charges against two alleged administrators.
The government identified:
Aleksej Besciokov
and
Aleksandr Mira Serda
in connection with the Garantex operation.
According to prosecutors, Besciokov served as the primary technical administrator.
Mira Serda was described as a co-founder and chief commercial officer.
The defendants face allegations relating to money laundering and other offenses described in the federal case.
These remain allegations unless and until established in court.
12. Alleged Money Laundering
According to the DOJ, Garantex allegedly processed hundreds of millions of dollars in criminal proceeds.
The government’s announcement references criminal proceeds associated with:
- Ransomware.
- Hacking.
- Terrorism.
- Drug trafficking.
- Other criminal activity.
This is one of the reasons the Garantex case became a major international cryptocurrency-enforcement action.
Again, these statements should be attributed to U.S. prosecutors rather than presented as an independently established criminal judgment.
13. Alleged Sanctions Evasion
The government’s case also alleged that Garantex continued operating after its 2022 designation.
Prosecutors alleged that aspects of the operation were changed in an effort to make transactions more difficult for U.S. cryptocurrency businesses to identify and block.
The alleged techniques included movement between cryptocurrency wallet addresses and changes to the exchange’s operational structure.
From a forensic perspective, this makes historical blockchain analysis especially important.
Investigators should examine whether known Garantex addresses were replaced, whether funds moved through intermediary wallets and whether transaction patterns changed following the sanctions designation.
14. Why the Three Domains Matter
The three domains illustrate how cryptocurrency operations can maintain multiple layers of online infrastructure.
Garantex.io
Earlier exchange infrastructure
Garantex.org
Later exchange infrastructure
Garantex.academy
Associated educational infrastructure
Investigators should therefore avoid looking at a single domain in isolation.
A complete investigation should map:
Domain
↓
Hosting
↓
Servers
↓
Operators
↓
Customer accounts
↓
Wallets
↓
Blockchain transactions
↓
Financial counterparties
This creates a much clearer picture of the operation.
15. Evidence Classification
VERIFIED
- U.S. authorities seized Garantex.org, Garantex.io and Garantex.academy in March 2025.
- The DOJ publicly announced the international disruption.
- OFAC designated Garantex Europe OÜ in April 2022.
- OFAC identified Garantex.io in its 2022 designation.
- Later OFAC records identify both Garantex.io and Garantex.org.
- Official sanctions records identify cryptocurrency addresses associated with Garantex.
- The DOJ stated that authorities obtained copies of Garantex servers.
- The DOJ stated that the servers contained customer and accounting databases.
- The DOJ reported that Garantex processed at least $96 billion in cryptocurrency transactions since April 2019.
ALLEGATIONS BY U.S. PROSECUTORS
- Garantex facilitated money laundering.
- Criminal proceeds were processed through the exchange.
- The operation facilitated transactions involving criminal activity.
- Operators allegedly attempted to evade U.S. sanctions.
- The exchange allegedly operated as an unlicensed money-transmitting business.
These allegations should be attributed to the DOJ and federal indictment.
16. What Investigators Should Preserve
Anyone who previously used Garantex should preserve all available evidence.
Important records include:
- Garantex account statements.
- Deposit records.
- Withdrawal records.
- Cryptocurrency addresses.
- Transaction hashes.
- Emails.
- Customer-support conversations.
- Screenshots.
- Identity-verification records.
- Archived pages.
- Bank records.
- Cryptocurrency exchange records.
Original records should be preserved whenever possible.
Do not provide anyone with:
Passwords
Private keys
Seed phrases
or
Two-factor authentication codes.
17. Blockchain Investigation
A professional blockchain investigation should begin with the cryptocurrency addresses identified by OFAC.
The process can then expand outward:
Known Garantex address
↓
Transaction history
↓
Intermediate wallet
↓
Exchange
↓
Potential off-ramp
Investigators can then identify:
- Transaction dates.
- Transaction amounts.
- Counterparties.
- Wallet clusters.
- Exchange interactions.
- Cross-chain transfers.
- Repeated transaction patterns.
The purpose is to reconstruct the financial network rather than simply identify individual transactions.
18. Website and Domain Investigation
Historical domain analysis should examine all three domains.
Garantex.org
Review:
- Historical DNS.
- Hosting.
- Website archives.
- SSL certificates.
- Contact information.
Garantex.io
Review:
- Historical infrastructure.
- Domain changes.
- Hosting history.
- Previous website content.
- Cryptocurrency addresses.
Garantex.academy
Review:
- Educational content.
- Links to exchange infrastructure.
- Registration systems.
- Contact information.
- Historical operators.
The objective is to determine how the domains interacted and whether they shared infrastructure.
19. Why This Is a Major Digital-Forensics Case
Garantex demonstrates how modern financial investigations can span several evidence layers.
A single website may provide limited information.
A full forensic investigation can combine:
Domain records
Server evidence
Blockchain analysis
Customer databases
Accounting records
Regulatory records
Law-enforcement documents
This combination is significantly more powerful than relying on online reviews or automated scam scores.
20. Current Investigative Assessment
Garantex.org, Garantex.io and Garantex.academy should be treated as part of the same Garantex investigative case.
The connection is supported by official government records.
The DOJ explicitly identified all three domains in its March 2025 seizure announcement.
OFAC’s sanctions records separately identify Garantex Europe OÜ and associate both Garantex.io and Garantex.org with the designated entity.
The case therefore goes far beyond a conventional website-reputation investigation.
It involves:
International law enforcement
U.S. sanctions
Cryptocurrency tracing
Server seizures
Customer databases
Accounting records
Multiple domains
Criminal allegations
The most important forensic opportunity is the combination of the server evidence and blockchain evidence.
Blockchain records can show where cryptocurrency moved.
Server evidence may reveal how the platform recorded those transactions internally.
Together, those sources can potentially provide a far more detailed reconstruction of the operation.
21. Warning to Former Users
If you previously held cryptocurrency on Garantex or transferred funds through one of the three domains, preserve your records.
Do not delete:
- Emails.
- Account statements.
- Transaction histories.
- Wallet addresses.
- Transaction hashes.
- Screenshots.
- Customer-support conversations.
Also be cautious of cryptocurrency-recovery services that contact you unexpectedly.
Someone claiming to have recovered your Garantex funds does not automatically mean the claim is legitimate.
Never surrender a cryptocurrency seed phrase or private key to a supposed investigator, recovery company or support agent.
Official Sources
U.S. Department of Justice
The DOJ’s March 7, 2025 announcement documents the seizure of Garantex.org, Garantex.io and Garantex.academy, the international operation and the criminal case.
U.S. Treasury — OFAC
OFAC’s April 5, 2022 designation identifies Garantex Europe OÜ, Garantex.io and cryptocurrency addresses associated with the entity.
Updated OFAC Sanctions Record
OFAC’s updated record identifies GARANTEX and associates both garantex.io and garantex.org with the designated entity, together with additional cryptocurrency addresses.
Investigation Notice
This report is based primarily on official U.S. government records from the Department of Justice and Department of the Treasury.
The seizure of Garantex.org, Garantex.io and Garantex.academy is an established law-enforcement action.
The OFAC designation of Garantex Europe OÜ is an established sanctions action.
Statements concerning criminal conduct by individual defendants or the Garantex operation are allegations made by U.S. authorities unless otherwise established by a final court judgment.
The reported $96 billion figure refers to cryptocurrency transaction volume described by the DOJ and should not be interpreted as $96 billion in customer losses.
The inclusion of a person, company, domain or cryptocurrency address in this report does not independently establish criminal liability.
CASE ID: CASE-2026-015
