How to Check If Crypto You Received Came From a Sanctioned Exchange Like Garantex

TL;DR - Run the receiving address through the OFAC sanctions list and a multi-chain screener; if the funds trace back to Garantex, Grinex, or another sanctioned exchange, your wallet carries sanctions exposure that a service can freeze.

Garantex was one of the largest Russia-based crypto exchanges before law enforcement dismantled it. If you bought, sold, or received crypto through a peer-to-peer deal in the last few years, some of those coins may trace back to it. Most people only find out when an exchange freezes a deposit. This guide shows how to check your own wallet first.

Why does receiving crypto from Garantex matter?

The US Treasury's OFAC sanctioned Garantex in April 2022 for laundering funds from ransomware crews and darknet markets. In March 2025 the US Secret Service, working with German and Finnish authorities, seized its web domains and froze tens of millions of dollars in crypto. The Department of Justice later indicted two of its administrators. In August 2025 Treasury added the front entity Garantex Europe OU to the list to close a workaround.

Sanctions in the US work on strict liability. You do not need to know a counterparty was sanctioned to face penalties. If coins in your wallet trace back to a sanctioned exchange, a compliance team at your bank or exchange can treat the funds as blocked property and freeze them.

How do you check if your crypto came from Garantex or Grinex?

Start with the source you can cite, then widen the search:

1. Open the OFAC Sanctions Search portal and paste the full address. OFAC confirms in its own guidance (FAQ 594) that you can query a digital currency address directly against the SDN list.
2. Check the address on a block explorer such as Etherscan. Some explorers tag known sanctioned wallets, but the label covers only direct matches on a single chain.
3. Trace the funds back a few hops. The risk is rarely a direct transfer. It is usually an intermediary wallet that sat between you and the exchange.

Tracing across seven chains by hand is slow and easy to get wrong. You can screen the address with Plastron to trace sanctions, mixer, and stolen-funds exposure across Ethereum and six more EVM chains in one query.

One wrinkle: after Garantex was seized, its operators moved customer balances to a successor exchange called Grinex. Grinex suspended operations in April 2026 after a reported hack. Funds linked to either name carry the same exposure, so screen for both.

What happens if your wallet has sanctions exposure?

When an exchange screens an incoming deposit and finds a sanctioned counterparty in the transaction graph, the standard response is to freeze the deposit, open a review, and file a Suspicious Activity Report if required. Tether has frozen stablecoin balances tied to Garantex, reporting that it blocked roughly 28 million dollars across dozens of addresses. A freeze can last weeks. In the worst case, US persons face civil or criminal liability for transacting with a sanctioned entity.

Exposure comes in two shapes. Direct exposure is a transfer straight from the sanctioned exchange to your wallet. Indirect exposure runs through one or more intermediary wallets. Both can trigger a hold, though a direct transfer scores higher.

What should you do if you find Garantex exposure?

Act calmly and keep a paper trail:

• Do not move the funds in a panic. Layering them through more wallets looks like laundering and makes your position worse.
• Document how you received the crypto: the invoice, the trade, and the counterparty.
• If the funds sit at an exchange, contact its compliance team before depositing more and disclose the source.
• For a US person holding blocked property, OFAC guidance points to reporting it rather than quietly spending it.
• Get professional advice if the amount is large or the exposure is direct.

How do you avoid sanctioned-exchange exposure in the future?

Screen before you accept, not after. Check a counterparty address before a trade, an OTC deal, or a large incoming payment, and keep a record of clean counterparties. Treat any deposit from an unknown peer-to-peer seller as higher risk. The ruble-backed A7A5 token, which TRM Labs linked to the Garantex network, is a reminder that sanctioned operators rebrand and reissue assets to dodge detection - a static blacklist alone will miss them, so screen the full transaction graph instead.

FAQ

Is it illegal to receive crypto from Garantex?

For US persons, transacting with a sanctioned entity can carry civil or criminal liability under strict-liability sanctions rules, even without intent. Receiving funds unknowingly is lower risk than sending them, but you should still screen the address and document the source.

Garantex was shut down in 2025 - can its addresses still flag my wallet?

Yes. Sanctioned addresses stay on the OFAC list after a takedown, and successor entities such as Grinex inherit the same exposure. Historical transfers still appear in your wallet's transaction graph and remain screenable.

Does a sanctions check cover other blockchains?

A single block explorer shows one chain. A multi-chain screener checks the same wallet across Ethereum and other EVM networks in one pass, which matters because sanctioned actors move funds across chains to break the trail.

How many hops from a sanctioned exchange still count as exposure?

There is no fixed legal rule, but exchanges commonly flag exposure within roughly five hops. The closer and larger the transfer, the higher the risk score a compliance tool assigns it.