How Garantex Processes Payouts Despite Sanctions

Key Highlights:

Even after U.S. and EU sanctions, Garantex continues processing customer payouts in BTC and ETH.

Following Garantex’s public announcement on July 30, 2025, the Global Ledger research team conducted a new investigation into Garantex payouts to identify the wallets, fund flows, and mechanisms behind them. The findings show that sanctions have not stopped the activity — instead, Garantex has adapted its payout infrastructure.

Chain of events: how the payout scheme works

1. Identification of new payout wallets

After Garantex announced the start of BTC and ETH payouts, Global Ledger traced new wallets linked to Garantex and reconstructed their role in the payout process.

In total, the investigation team has traced:

• Over 3200 ETH (~$9.6 million at the time of investigation).
• More than 260 BTC (~$24+ million) used to support customer payouts and reserves.

2. Activation of reserves after the seizure

On the day Garantex’s servers were seized (06.03.2025), one Ethereum wallet accumulated 3,256 ETH in a single day. Shortly after, 99.91% of these funds were transferred to the Tornado Cash mixer.

On Bitcoin, previously dormant reserves began to consolidate in March 2025, indicating preparation for payouts rather than isolated movements.

3. Cross-chain obfuscation of Ethereum payouts

Ethereum payouts rely heavily on cross-chain bridges and intermediary wallets. Funds were moved through:

• Across protocol bridge
• Relay.link bridge
• Unit’s wallet (Global Ledger identified a single aggregation wallet linked to Garantex holding 3,206.15 ETH; 99.1% of the funds originated from Unit’s wallet.)

Assets were transferred between Ethereum, Optimism, and Arbitrum, using wallets created solely to obscure the transaction trail before funds reached payout wallets.
The image below shows how the scheme operated — from the moment of seizure to the identified payout wallet: 

4. Aggregation before distribution

Rather than paying users directly from reserves, Garantex used aggregation wallets that consolidated funds before distribution.

Only 0.01% (46.15 ETH) has been paid out so far, while the majority of ETH remains in reserve. Additional transfers to CEXs and cross-chain protocols suggest preparation for further payout phases.

5. Bitcoin payouts linked to major CEXs

Bitcoin payouts appear more centralised. Our research team has identified:

• Two primary BTC payout wallets, both linked to an aggregation wallet that received 198.90 BTC.
• Additional payout and HODL wallets containing an additional 70.34 BTC.
• Several source wallets showing direct exposure to one of the largest CEXs, with transaction “change” consistently routed to CEX deposit addresses.

What this means for CEX compliance officers

These payout mechanisms create multiple compliance and exposure risks for centralized exchanges: 

Conclusion

The Garantex payout case illustrates a broader reality: sanctions alone do not stop activity. Instead, sanctioned actors adapt by restructuring fund flows through aggregation wallets, mixers, and cross-chain infrastructure — often reaching compliant platforms indirectly.

For CEX compliance teams, the key risk lies not in obvious exposure, but in hidden connections: payout aggregation wallets, cross-chain hops, and counterparties that appear low-risk in isolation.

Global Ledger enables early detection of exposure before it becomes a blind spot with KYB and KYT solutions — combining entity exposure and risk reports, real-time transaction monitoring with AI-powered alerts, and fund flow visualization.