Is Russia using the Kyrgyzstan encryption exchange to evade sanctions? The annual trading volume has surged to 4.2 billion USD, raising many questions.

A recent report from UK blockchain intelligence firm TRM Labs reveals that Russian entities are using a network of crypto asset exchanges registered in Kyrgyzstan to evade international sanctions, procuring dual-use goods for the Ukraine war. The investigation found that these exchanges exhibit a significant number of shell company characteristics (reusing the same Address/founders/contact information) and are linked to on-chain activities associated with the sanctioned Russian exchange Garantex. The report highlights that since the outbreak of the Russia-Ukraine war in 2022, crypto asset trading volume in Kyrgyzstan has surged from $59 million to $4.2 billion in the first seven months of 2025, with nearly 100% related to activities connected to Russia. This article deeply analyzes the sanctions evasion operational model, on-chain evidence, and global regulatory response recommendations.

New Path for Sanction Evasion: Kyrgyzstan Becomes a Channel for Russian Crypto Funds The latest report shows that Russian entities are using Kyrgyzstan's digital asset ecosystem to evade international sanctions in order to procure dual-use materials for their ongoing war in Ukraine.

According to a blog post study published by the UK blockchain intelligence company TRM Labs on July 21, the exchange registered in Kyrgyzstan "has repeatedly assisted transactions related to sanctioned Russian entities." The report points out that "many of these virtual asset service providers (VASP) exhibit characteristics of shell companies – including the reuse of the same residential addresses, founders, and contact information across multiple entities."

On-chain fingerprint exposure: Highly associated with Garantex, suspected to be a shell exchange rebirth The report also found that several exchanges in Kyrgyzstan exhibited on-chain behavior patterns similar to Garantex. Garantex is a Russian digital asset exchange that has become an international target for action due to its assistance in financing terrorism and violating sanctions, and its operations have been disrupted. The report states: "The high-risk exchange Grinex - likely the successor to Garantex after its rebranding - is also registered in Kyrgyzstan. On-chain analysis indicates that Grinex and other exchanges located in Kyrgyzstan may have played a role in the fund transfers after the shutdown of Garantex, highlighting the growing importance of Kyrgyzstan as a financial activity conduit following sanctions on Russia."

TRM Labs has observed an increasing number of cases where actors linked to Russia are using Kyrgyzstan-registered exchanges to evade international sanctions and transfer funds. The report states that some of these exchanges "exhibit behavior patterns similar to the sanctioned Russian exchange Garantex and appear to have served as channels for fund transfers following enforcement actions against Garantex in 2025." According to the report, this pattern has also been found in several other entities.

The Path of Breaking Through Sanctions in Russia Since the outbreak of the Russia-Ukraine conflict in February 2022, Russia has been subjected to large-scale and unprecedented international sanctions, making it the most sanctioned country in the world. Faced with a struggling economy (some believe it is on the brink of collapse) and severe restrictions such as being excluded from the Society for Worldwide Interbank Financial Telecommunication (SWIFT) international financial messaging system, Russia is increasingly turning to the digital asset sector in search of a breathing space. For a country that is heavily sanctioned, the ability to exchange and transfer funds instantly through an anonymous (or pseudonymous), decentralized, peer-to-peer network that is not controlled by any hostile nation is obviously appealing. However, the ability to trace funds on the blockchain and the increasing legitimization of the digital asset space make the road to international monetary freedom more difficult. Many mainstream exchanges and crypto companies, such as Blockchain.com, Crypto.com, LocalBitcoins, etc., believe it is necessary to comply with international sanctions against Russia, including the EU's mandatory ban on providing all digital asset wallets, accounts, or custodial services to Russian entities and accounts.

The Controversial Explosion of the Kyrgyz Crypto Industry The TRM report indicates that since Russia's invasion of Ukraine, its economic ties with Kyrgyzstan have significantly deepened. After the invasion, Russia-related activities have almost dominated Kyrgyzstan's entire digital asset industry, which "barely existed" before February 2022.

In January 2022, Kyrgyzstan passed legislation supporting digital currencies, recognizing digital assets as property and establishing a registration system for Virtual Asset Service Providers (VASP). Since then, this former Soviet Central Asian republic has rapidly emerged as a Crypto Assets hub. According to TRM Labs data, "By October 2024, Kyrgyzstan has issued 126 VASP licenses, driving a sharp increase in digital asset activities. The trading volume of licensed VASPs soared from $59 million in 2022 to $4.2 billion in just the first 7 months of 2024."

Shell Networks and War Funds: Off-chain Evidence Emerges If there were no "suspicious" on-chain and off-chain overlaps between VASPs registered in Kyrgyzstan and Russian entities, this booming industry would not be a problem. These overlaps include: using the same registered address in private residences, phone numbers and email addresses associated with freight companies or other VASPs, named founders linked to multiple other providers, lack of identifiable business or digital currency background, and/or no available user sign up process.

In addition to the examples of Garantex and Grinex, the report also points to the Kyrgyz exchange Envoys Vision Digital Exchange (EVDE). This exchange registered a digital currency wallet Address associated with the "Rusich Group." The Rusich Group is a Russian paramilitary organization that was sanctioned by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) in 2022 for its involvement in the war in Ukraine. TRM Labs stated: "In addition to on-chain associations, the exchange also shows several off-chain connections with a cross-border logistics company and a Chinese financial institution, indicating a broader support infrastructure that warrants further scrutiny."

How to Plug Vulnerabilities? The Report Offers Key Recommendations In response to the apparent sanctions loophole found regarding Russia, TRM Labs has proposed several actionable measures.

• If Kyrgyzstan is being exploited rather than complicit: The report suggests implementing stronger ownership requirements, such as mandating that company leaders be physically present or reside locally, which would create higher barriers for foreign bad actors. Similarly, increasing the transparency of funding sources would reduce Kyrgyzstan's appeal as a destination for shell entities.
• If Kyrgyzstan is an equal partner in assisting Russia to evade sanctions: "Governments and law enforcement agencies seeking to counter Russia's sanctions evasion measures need to urgently engage in direct contact with Kyrgyz authorities regarding compliance issues."

The report suggests that if proactive intervention measures are not taken, the model implemented by Russia in Kyrgyzstan could easily be replicated elsewhere: "If left unchecked, Russia may replicate the same strategies in neighboring jurisdictions—further undermining the global sanctions system and allowing funds to continue flowing, fueling aggressive actions, procurement of materials, and destabilization."

Conclusion: The report by TRM Labs has exposed the covert network through which Russia utilizes Central Asia as a crypto hub to evade international sanctions, revealing the critical role of Kyrgyzstan in the financial chain of the Russia-Ukraine war. The bizarre surge in transaction volume from 59 million to 4.2 billion, the shell characteristics of the exchange clusters, and the deep on-chain connections with Garantex/Grinex all point to systematic and organized sanction evasion operations. This not only exposes the loopholes in the existing sanction system but also poses a severe challenge to global financial security. The dual-track proposal of "strengthening entity control" and "cross-border compliance pressure" put forth in the report provides direction for plugging the loopholes. Whether the international community can effectively coordinate actions to prevent crypto assets from becoming a blood supply channel for war machines will be a key test of the resilience of the global financial governance system.