A new report from blockchain analytics firm Elliptic, published on February 21, 2026, has identified five cryptocurrency exchanges allegedly forming a "shadow network" to facilitate sanctions evasion for Russian entities. The network emerged following the disruption of the sanctioned exchange Garantex by international law enforcement in early 2025.
The report details how these platforms enable cross-border payments outside traditional banking channels, allowing users to move funds with limited oversight. Stablecoins, particularly the ruble-backed A7A5 and USDT (Tether), play a central role in this activity, allowing funds to be moved without relying on global banking infrastructure.
The five named exchanges are:
• ABCeX: Described as the largest in the network, having processed at least $11 billion in cryptocurrency. It reportedly operates from Moscow's Federation Tower, a location previously associated with Garantex.
• Exmo: Cited for maintaining operational links to its Russian-facing platform Exmo.me, despite earlier claims of exiting the Russian market. On-chain analysis shows shared custodial wallet infrastructure and approximately $19.5 million in transactions with sanctioned entities like Garantex and Chatex.
• Rapira: Registered in Georgia but maintains a Moscow office. It has allegedly processed over $72 million in transactions with another scrutinized exchange, Grinex.
• Bitpapa: A UAE-registered peer-to-peer exchange primarily targeting Russian users. It was added to the U.S. OFAC sanctions list in March 2024 but remains active, frequently rotating wallet addresses to reduce traceability. Elliptic estimates 9.7% of funds leaving Bitpapa reached sanctioned destinations directly.
• Aifory Pro: A cash-to-crypto service operating in Moscow, Dubai, and Turkey, bridging physical currency and digital assets.
The report emphasizes that most of these exchanges have not yet been formally sanctioned, allowing operations to continue. Elliptic anticipates increased enforcement actions in 2026 as regulators evaluate the effectiveness of existing crypto-related sanctions frameworks. The findings have heightened regulatory concerns globally, with the European Union considering wider limits on Russia-linked crypto activity. The report underscores the ongoing challenge for compliance and the evolution of transaction monitoring technologies in the face of rapidly adapting evasion tactics.
