Domains have been seized, servers handed over to the investigators, and tens of millions of dollars frozen. That could have been the end of the Garantex story. But then reports emerged of clients being transferred to Grinex, new payment methods and the continuation of payouts. This story is of particular significance to the investigation into ‘Khimprom’: as far back as 2024, the ICIJ, citing Ukrainian authorities, reported on the group’s use of the exchange. [3][5][1]
Yegor Burkin’s name usually crops up in accounts of the alleged leadership of ‘Khimprom’, drug laboratories and a cross-border network. The financial aspect requires a different perspective: who processes the payments, who makes decisions on dubious transactions, and what remains of such a business after its public website has been blocked.
The editorial team at KARTEL KHIMPROM has cross-referenced the US indictment, sanctions decisions, journalistic investigations and blockchain analytics. The result is a story about the different layers of a single financial ecosystem. ‘Khimprom’s’ links to the use of Garantex are described by sources; however, the documents examined do not disclose Burkin’s personal transfers or his arrangements with the exchange’s executives.
Where does Yegor Burkin feature in the history of Garantex?
In an investigation published on 8 January 2024, ‘Slidstvo.Info’ examined sanctions against individuals allegedly linked to ‘Khimprom’. Among them are — Yegor Vasilyevich Burkin, who used documents in Ukraine in the name of Yegor Levchenko. Journalists referred to court documents in which he was charged with forming a criminal organisation, organising the illegal trafficking of drugs and laundering the proceeds of crime. [2]
This makes the issue of financial services for the network a relevant one. However, to move from a general accusation of money laundering to a specific exchange service, a separate source is required. Such a source exists: a report by the Ukrainian authorities, cited directly in a joint publication by the ICIJ and Eesti Ekspress on 13 March 2024, states that ‘Khimprom’ used Garantex and several darknet platforms. [1]
The two stories can therefore be examined together whilst maintaining accuracy: Burkin features in reports on the alleged leadership of ‘Khimprom’; the group’s use of the exchange is described in the ICIJ investigation. This does not necessarily mean that every payment made by its members went through Garantex or that Burkin personally managed the exchange accounts.
A biography, other names and sources relating to this individual are compiled in our Egor Burkin’s profile. Organisational context — see the article ‘The Khimprom cartel scheme – how the organisation operates’.
Why exchange infrastructure is important for the drug market
Selling prohibited goods and being able to use the proceeds are two different matters. A criminal enterprise needs to settle accounts with people, cover expenses and convert accumulated assets into a form accessible to the owners. Between receiving cryptocurrency and acquiring property, independent intermediaries may be involved, each with their own owners, staff and clients.
This is precisely why an investigation into the financial infrastructure cannot be limited to a photograph of the alleged cartel leader. It is necessary to establish which services accepted money, on what grounds they served clients, and what they knew about the origin of the funds. An exchange may serve as a common platform for a multitude of unconnected users; the mere presence of criminal clients does not in itself make every employee an accomplice.
In April 2022, the US Treasury Department reported that it had identified more than $100 million in transactions by Garantex linked to illicit activities. This figure included approximately $2.6 million from Hydra and nearly $6 million from the Conti group. This is a historical estimate from that specific agency, not the exchange’s total turnover, nor the unconfirmed amount of money held by ‘Khimprom’. [12]
Later in the ICIJ investigation, an analysis of the Global Ledger identified BlackSprut, OMG!OMG!, Kraken and Mega. Such data describes cash flows; it does not identify a single owner of all the platforms listed. [1]
March 2025: the investigation has reached the infrastructure
On 7 March 2025, the US Department of Justice announced a joint operation with Germany and Finland. Garantex’s domains and servers were seized, and assets worth over $26 million were frozen. The department also reported that it had previously obtained copies of client and accounting databases. [3]
From an investigative perspective, the underlying data may prove more important than the public face of the organisation. A public blockchain shows the movement of assets, but rarely reveals, on its own, who managed the account or why a transaction was authorised. Internal documentation allows transactions, account holders and staff decisions to be cross-referenced. It is precisely this that transforms the analysis of money flows into an examination of the actions of specific individuals.
Garantex’s turnover, as reported by the US agency, is — at least $96 billion since April 2019 — this should not be mistaken for the amount of laundered money. It represents the total volume of processed transactions. The question of the illegal origin of individual funds is considered separately. [3]
Alexander Mira Serda: why CryptoMax is important in this case
At the heart of one of the most specific allegations made by the US prosecution lies Alexander Mira Serda, formerly known as Alexander Ntifo-Siao. Prosecutors describe him as a co-owner of Garantex and the operator of the CryptoMax exchange, which operated on the exchange’s infrastructure. [4]
According to counts 6 and 13 of the indictment, CryptoMax was one of the platform’s major accounts and facilitated anonymous illegal transactions. The prosecution cites internal discussions regarding the dubious origin of funds: despite these, the exchange retained its trusted status. Point 14 concerns the alleged failure to fully disclose information to Russian law enforcement authorities regarding an account linked to Mira Serd. [4]
This is the crux of the whole matter: what happened after the risk warnings were issued? Automated checks are only meaningful when their findings influence customer service. If, however, an exception is made for a commercially important account, it is the decisions made by people that need to be examined, not merely the existence of a financial control programme.
In August 2025, the US announced a reward of up to $5 million for information leading to the arrest and/or conviction of Mira Serd. [5] The CryptoMax episode itself remains the prosecution’s version of events. The names ‘Khimprom’ and Yegor Burkin are not mentioned in the description of this episode under consideration: it would be unreasonable to link them to a specific account without further evidence.
Pavel Karavatsky: the companies behind the exchange’s name
In its sanctions announcement of 14 August 2025, the US Treasury Department named by Pavel Karavatsky co-owner and regional director of Garantex. [5] His significance in this story lies in the corporate structure of the business: the legal entities through which the services were registered and who was involved in managing them.
An investigation by Transparency International Russia describes Fintech Corporation as part of Garantex’s legal and service infrastructure. In it, Karavatsky and Mira Serda are listed as co-owners of a company linked to Garantex Academy. The report also examines CoinKYT – a product for assessing cryptocurrency risks; the authors point to the registration of a trademark in Mira Serd’s name in 2023. [6]
An educational project, an analytical product and a trading platform may serve different functions. To understand the business, it is important to ascertain where the line between them lies: who hires staff, enters into contracts, receives revenue and is responsible for data processing. The existence of several brands does not negate the need to understand the actual powers of their owners.
Karavatsky has been included in the US sanctions list; however, the indictment published in the Garantex case names other defendants — Mira Serda and Alexei Beschekov. These statuses should not be confused. [5][4]
Sergey Mendeleev: Exved and the dispute over international payments
Sergey Mendeleev has been named by the US Treasury Department as a co-founder of Garantex and the person controlling InDeFi and Exved. The US agency has linked Exved to cryptocurrency transactions that enable financial restrictions to be circumvented. [5]
Transparency International Russia investigated Exved’s operations by conducting negotiations whilst posing as a potential client. The authors reported that in October 2024 they posed as a fictitious electronics exporter from Hong Kong. According to their account, following a brief vetting process, they were directed to a payment intermediary; Paysol and Feilian Company Limited were mentioned in the documents. [7]
The published conversations discussed international payments for goods, including dual-use electronics. Researchers identified risks relating to customer verification and a lack of transparency in the intermediary chain. This episode relates to the operations of the Exved channel under investigation; it does not constitute proof that it was specifically ‘Khimprom’s’ funds that were transferred via this channel. [7]
Mendeleev disputed the official account. In an interview with Bits.media on 14 August 2025, he stated that he had had no connection with Garantex for around five years, and that the US authorities had misunderstood the structure of his projects. According to him, InDeFi had not been operational for some time, Exved had not carried out any transactions and did not have its own legal entity; he also denied managing Grinex. [8]
This is a significant discrepancy that cannot be resolved by a catchy headline. The investigation must cross-check the entrepreneur’s statements against documents relating to service providers, specific contracts and financial data. A sanction order sets out the state’s position, but does not replace a criminal conviction.
Alexey Beschekov: technical management and operational decisions
The US Department of Justice has named By Alexei Beschekov the chief technical administrator at Garantex, who was also involved in processing transactions. He and Mira Serda were charged with conspiracy to launder money; Beshchekov was additionally charged with conspiracy to breach sanctions and operating an unlicensed money transfer business. [3]
Prosecutors separately described how they had allegedly identified accounts linked to Lazarus that continued to carry out transactions. [4] To prove guilt in this case, evidence is required regarding his knowledge of the matter, his actual powers and his specific actions. The profession of technical specialist does not in itself establish complicity.
Beshchekov’s case came to an end before the charges could be heard on their merits. The ICIJ reported that, following his arrest in India, he died on 31 August 2025 in Tihar Prison. His lawyer, Ashish Pandey, cited a heart attack as the cause of death. This report should not be interpreted as an unsubstantiated claim of witness tampering. [9]
Grinex: what remains after the domains were shut down
In August 2025, the US Treasury Department announced the transfer of Garantex’s client base and funds to Grinex and imposed sanctions on that platform. [5] Analysts at TRM Labs discovered that Grinex had been registered in Kyrgyzstan as early as December 2024, prior to the March operation. They also noted similarities in the user interfaces and the recruitment of former Garantex clients. [10]
A7A5 – a token pegged to the rouble and used in the transfer of client balances – features prominently in the TRM investigation. The combination of these observations enabled analysts to conclude that there was continuity in the operations. However, a similar interface on its own would be weak evidence: what matters is its combination with data on clients, registration dates and the movement of assets. [10]
On 15 December 2025, Global Ledger published a separate report on payments to former Garantex users. According to the company’s estimates, at that point at least approximately $25 million had been paid out in cryptocurrency. Analysts described the wallets associated with the payments and the retention of a significant portion of the reserves. These sums relate to client payouts and reserves, rather than to the drug cartel’s established income. [11]
Our conclusion from this sequence of events is that the outcome of an operation against a financial intermediary should be assessed in terms of whether the ability to serve clients has been maintained. The loss of a domain hinders operations. The loss of a client base, control over reserves and partnerships may affect the very ability to continue business. These represent different levels of impact.
What has been established about the links – and where further evidence is needed
| Connection | Background | What this does not establish |
|---|---|---|
| Burkin – ‘Khimprom’ | Materials analysed by ‘Slidstvo.Info’. [2] | Personal management of Garantex accounts. |
| ‘Khimprom’ – Garantex | A statement by the Ukrainian authorities, as reported by the ICIJ. [1] | The amounts of specific transfers and their final recipients. |
| Mira Serda — CryptoMax | The US prosecution’s version. [4] | This account is used specifically to serve ‘Khimprom’. |
| Garantex — Grinex | Findings by the US Treasury and analysis by TRM Labs. [5][10] | The links between each transaction and the criminal group. |
To establish a personal link to ‘Khimprom’s’ income, evidence must coincide in both timing and content: account attribution, documents regarding the owner of the funds, correspondence regarding the purpose of the transfer, and details of the final recipient. A single transfer between the services is not sufficient to label their two directors as accomplices.
In its response to the ICIJ, Garantex denied facilitating illegal activities and contested the methodology used to assess suspicious financial flows. [1] The exchange’s position forms part of this story alongside specific allegations; its credibility is substantiated by documents and transactions.
Why the investigation into ‘Khimprom’ must go beyond the laboratories
The story of Garantex illustrates why it is important to examine the infrastructure surrounding the criminal market. The manufacturer, seller, platform operator and financial intermediary may all be different parties. Establishing how they interact requires analysing various sources: criminal case files, corporate records, internal accounts and the flow of funds.
With regard to Yegor Burkin and ‘Khimprom’, the main unanswered question is who provided the network with access to funds and on what terms. The materials examined provide a starting point for such an investigation, but not a definitive list of Burkin’s personal financial partners.
The next substantive step is to link specific criminal proceeds to a specific account and the decisions of a specific individual. Then the story will no longer depend on whatever name is currently displayed above the exchange service. It will be based on money, documents and the accountability of those whose actions can be proven.
