Learn how Global Ledger’s database became one of the key data sources for Hacken’s Extractor platform, enabling clients to monitor risks in real time.
The European Union has added Payeer — a Vanuatu-registered but Russia-linked payments service provider — to its sanctions list, citing the company’s role in enabling Russian users to bypass EU restrictions and access crypto-based financial services. The designation takes effect on November 25.
Although nominally registered offshore, Payeer is widely regarded as a Russian entity. It has maintained operational ties with RuStore, the state-backed Android app marketplace launched in 2022 by VK and other major Russian IT firms under the oversight of the Ministry of Digital Development. Payeer has long provided financial infrastructure for Russia-based clients, including actors linked to previously sanctioned exchanges Grinex and Garantex.
Transaction flows processed by Payeer in 2025 on TRON
According to Global Ledger’s 2025 exposure assessment, Payeer processed a total of 264.6 million USDT across TRON-based transactions during the period (126.54 million USDT in source of funds and 138.08 million USDT in use of funds).
A notable share of these flows came directly from sanctioned or high-risk exchanges. Garantex alone accounted for approximately 1.65 million USDT in combined inbound and outbound volume — all processed before the shutdown of Garantex’s operations.
Beyond Garantex, Payeer processed an additional 1.27 million USDT in 2025 from other sanctioned entities — including inflows from Grinex, Huione Group, Freela.kg, SafeChange (NetEx24), Nobitex, A7A5, BitPapa, IRGC-linked wallets, Ramzinex and others.
Payeer’s risk distribution shows that high-risk entities accounted for 11.01% of all source of funds and 22.93% of all use of funds.
In absolute terms, this equates to:
- 13.94 million USDT in high-risk inbound flows
- 31.73 million USDT in high-risk outbound flows.
This confirms that almost 45.7 million USDT of Payeer’s 2025 transaction volume was linked to high-risk or sanctioned ecosystems.
Despite its sanctioned exposures, Payeer also exhibited significant interaction with top-tier centralized exchanges, including several ranked within the top 10 on CoinMarketCap by trading volume. These exchanges constituted:
- 21.64% of inbound flows, and
- 25.76% of outbound flows,
highlighting Payeer’s deep integration not only with high-risk actors but also with major global licensed platforms.
Payeer’s ETH-based transaction flows in 2025
On Ethereum, using the native ETH token, Payeer processed a total of 2,460.00 ETH between 1 January and 25 November 2025. This includes 1,567.2679 ETH in source of funds and 892.7375 ETH in use of funds, equivalent to approximately USD 7.12 million.
The largest single high-risk inflow on Ethereum originated from Cash-Bit / NiceChange, which accounted for 942.9228 ETH (≈ USD 2.73 million), representing 60.16% of all ETH inflows and 6.46% of the outflows (59 ETH or 171K USD). On the outbound side, the largest share of ETH went to a licensed centralized exchange ranked among the top three globally by transaction volume on CoinMarketCap, accounting for 306.6387 ETH (≈ USD 887,526.52), or 34.34% of all ETH outflows.
Flows in USDC on Ethereum
On the Ethereum blockchain, using the USDC token, Payeer processed a total of 3.16M USDC between 1 January and 25 November 2025.
This consists of:
- 1,757,957.215 USDC in Source of Funds
- 1,401,868.3506 USDC in Use of Funds
High-risk sources represented 2.78% of inbound flows and 4.13% of outbound flows (106,890 USDC), while medium-risk flows accounted for 49.49% of inbound and 44.91% of outbound volume. Low-risk activity represented 47.72% of inbound and 49.88% of outbound flows. Sanctioned and high-risk exposures on USDC include flows from Garantex, Bitpin, BitPapa, SafeChange (NetEx24), HitBTC/UnionChain, N.exchange, Cryptomus, and multiple reported hacks and scams, each recorded at low but measurable volumes.
At the same time, the largest share of USDC activity occurred with major licensed centralized exchanges. A top-five centralized exchange ranked by CoinmarketCap accounted for 288,822.9778 USDC (16.42% of inbound and 35.32% of outbound USDC), followed by CoinSpot and Kraken among the leading low- and medium-risk sources.
USDT flows on Ethereum
On Ethereum, Payeer processed a total of ≈25.73 million USDT between 1 January and 25 November 2025, consisting of 10,108,732.0413 USDT in Source of Funds and 15,622,803.5188 USDT in Use of Funds.
High-risk inflows accounted for 6.70% of all USDT entering Payeer on Ethereum (≈678,115.93 USDT), while high-risk outflows represented 25.42% of all USDT leaving the platform (≈3,986,860.39 USDT). In total, 4,664,975 USDT in high-risk transaction flows were processed on Ethereum blockchain.
Medium-risk flows formed the majority of activity — 84.33% of inbound and 42.67% of outbound volume, while low-risk flows accounted for 8.95% of inbound and 30.33% of outbound transfers.
High-risk exposure included transactions linked to cybercrime-associated addresses, reported scams, Garantex-connected services, Bitpin, BitPapa, SafeChange (NetEx24), HitBTC/UnionChain, N.exchange, and Cryptomus, among others.
At the same time, Payeer also exhibited significant activity with regulated centralized exchanges and other top-tier platforms appeared among the principal low- and medium-risk counterparties for both inbound and outbound flows.
Previously fined for violations in the EU
This is not the first enforcement action against Payeer.
In July 2024, Lithuania’s Financial Crime Investigation Service (FNTT) issued a record €9.29 million fine, stating that Payeer allowed customers — “mainly from Russia” — to move funds in Russian roubles to and from EU-sanctioned Russian banks, while also providing crypto wallets and custody services to Russian individuals and companies in violation of EU restrictions.
Russian sanction-linked flows reached top CEXs. Download the Global Ledger's investigation to find out how Russia moved illicit liquidity through the crypto ecosystem between 2022 and 2025 — including flows tied to crypto sanctions and broader Russian sanctions activity.
.png)
Token Recovery Investigations 190+ Hours Faster with Global Ledger
Learn how Token Recovery uses Global Ledger solutions to speed up investigations, what makes GL better than tops, and why the big picture isn’t always the best.