Elliptic Identifies Five Russia-Linked Crypto Exchanges Facilitating Sanctions Evasion Despite OFAC Designations

Blockchain analytics firm Elliptic has published a report on March 1, 2026, identifying five cryptocurrency exchanges with links to Russia that continue to process high-volume transactions for sanctioned entities, enabling users to move funds outside the reach of Western financial restrictions.

The report finds that only one of the five platforms, peer-to-peer exchange Bitpapa, is formally sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC), yet several others have processed hundreds of millions of dollars in transactions with restricted entities including the now-shuttered Garantex. The findings arrive as European officials consider a potential blanket ban on all cryptocurrency transactions involving Russia, amid concerns that enforcement actions against major platforms like Garantex have redirected rather than eliminated sanctions evasion activity.

According to Elliptic’s analysis, the identified exchanges—Bitpapa, ABCeX, Exmo, Rapira, and Aifory Pro—collectively provide Russian entities with multiple pathways to convert rubles to cryptocurrency, transfer funds cross-border outside traditional banking channels, and cash out through overseas brokers. The report estimates that ABCeX alone has processed at least $11 billion in crypto transactions from its Moscow office, with significant volumes flowing to already-sanctioned exchanges.

Sanctioned Platform Bitpapa Continues Transactions with Restricted Entities

OFAC designated Bitpapa, a UAE-registered peer-to-peer exchange primarily serving Russian users, in March 2024 for alleged sanctions evasion. Despite this formal sanction, Elliptic’s on-chain analysis estimates that approximately 9.7% of Bitpapa’s outgoing crypto flows were sent to sanctioned entities, including about 5% specifically to the Russia-linked exchange Garantex before its March 2025 domain seizure by U.S. law enforcement.

The report alleges that Bitpapa employs address rotation tactics designed to hinder transaction monitoring, frequently changing wallet addresses to evade blockchain surveillance systems. This operational pattern, according to Elliptic, demonstrates how even formally sanctioned platforms can continue facilitating restricted financial flows through technical evasion measures.

Unsanctioned Exchanges Operating From Moscow Infrastructure

ABCeX, the largest unsanctioned exchange profiled in the report, operates ruble-to-crypto trading services from Moscow’s Federation Tower—the same office location previously occupied by Garantex before U.S. authorities seized its domains in March 2025. Elliptic estimates the platform has processed at least $11 billion in cryptocurrency transactions, with significant fund flows directed to both Garantex and another profiled exchange, Aifory Pro.

The report notes that ABCeX’s operational continuity in the same physical infrastructure previously used by a sanctioned entity illustrates how enforcement actions against individual platforms can result in activity shifting to successor services rather than being eliminated entirely. Multiple analytics firms, including TRM Labs, have observed volume increases at ABCeX and other Russia-linked platforms following the Garantex shutdown.

Exmo’s Claimed Russian Exit Contradicted by On-Chain Evidence

Perhaps the most detailed findings in Elliptic’s report concern Exmo, an exchange that publicly stated it had exited the Russian market following the February 2022 invasion of Ukraine by selling its regional operations to a separate entity, Exmo.me. Blockchain analysis presented in the report shows that the Western-facing Exmo platform and its Russia-focused Exmo.me counterpart continue to share identical custodial wallet infrastructure, with deposits from both platforms pooled into shared hot wallets.

According to Elliptic, Exmo has conducted more than $19.5 million in direct transactions with sanctioned entities including Garantex, Grinex, and Chatex. This on-chain evidence suggests operational ties persist despite public statements of market exit, highlighting the challenge of verifying corporate separations in the absence of transparent infrastructure segregation.

Rapira and Aifory Pro Expand Sanctions Evasion Services

The report also profiles Rapira, an exchange incorporated in Georgia but maintaining a Moscow office, which Elliptic states has processed more than $72 million in direct transactions with sanctioned exchange Grinex. Russian authorities reportedly raided Rapira’s Moscow offices in late 2025 over suspected capital transfers to Dubai, indicating domestic law enforcement attention to the platform’s activities.

Aifory Pro, the fifth exchange identified, operates cash-to-crypto services across Moscow, Dubai, and Turkey. According to Elliptic, the company offers virtual payment cards funded with USDT (Tether) that explicitly enable Russian users to access Western services restricted by providers, including platforms such as Airbnb and ChatGPT. The report also traces nearly $2 million in cryptocurrency from Aifory Pro to Abantether, an Iranian exchange, demonstrating the platform’s role in broader sanctions evasion networks beyond Russia.

Regulatory Context and EU Policy Considerations

The Elliptic report’s publication coincides with European Union deliberations over a potential blanket ban on all cryptocurrency transactions involving Russia. EU officials have expressed concern that new platforms are emerging to replace previously targeted operators, creating a game of “whack-a-mole” in sanctions enforcement against crypto infrastructure.

The findings follow similar warnings from other blockchain analytics firms about surging illicit stablecoin use tied to Russia. TRM Labs reported last week that illicit entities received $141 billion in stablecoins in 2025, the highest in five years, with more than half of that volume linked to the ruble-pegged A7A5 token. Sanctions-related activity accounted for 86% of illicit crypto flows in TRM’s analysis, with bad actors primarily relying on stablecoin platforms for evasion.

Chainalysis reported in January 2026 that illicit crypto addresses received a record $154 billion in 2025, with Russia’s ruble-backed A7A5 stablecoin alone facilitating over $93.3 billion in transactions. A senior Russian official acknowledged last year that sanctions cannot fully block Russians from accessing cryptocurrency markets, even as the country prepares a comprehensive crypto regulatory framework expected in July 2026 that would establish licensed domestic trading platforms.

Enforcement Actions Redirect Rather Than Eliminate Activity

Elliptic’s analysis underscores a pattern identified across multiple blockchain analytics firms: the March 2025 takedown of Garantex dispersed Russian sanctions evasion infrastructure across a broader set of platforms rather than eliminating it. Transaction volumes increased on exchanges including ABCeX and Rapira following Garantex’s shutdown, suggesting that enforcement against individual platforms may temporarily disrupt but not permanently halt sanctions-evasion flows.

The report concludes that the network of Russia-linked exchanges illustrates how crypto infrastructure continues to support cross-border financial activity linked to sanctioned actors despite heightened regulatory scrutiny. The findings emphasize the challenge facing Western regulators seeking to sever Russia’s access to international financial systems through cryptocurrency restrictions.

Frequently Asked Questions

What did Elliptic’s report find about Russia-linked crypto exchanges?

Elliptic’s March 1, 2026 report identified five cryptocurrency exchanges with links to Russia—Bitpapa, ABCeX, Exmo, Rapira, and Aifory Pro—that continue facilitating sanctions evasion. Only Bitpapa is formally sanctioned by OFAC, yet others have processed billions in transactions with restricted entities. The report found that Exmo’s claimed exit from Russia after the 2022 invasion is contradicted by on-chain evidence showing shared infrastructure with its Russia-facing platform, and that exchanges employ tactics including address rotation to evade monitoring.

How are these exchanges enabling Russian users to bypass sanctions?

The identified platforms provide multiple pathways for sanctions evasion: they enable conversion of rubles to cryptocurrencies, facilitate cross-border fund transfers outside traditional banking channels, offer cash-out services through overseas brokers, and provide virtual payment cards funded with USDT that allow Russian users to access Western services restricted by providers. Some exchanges operate from physical locations previously used by sanctioned entities, and transaction volumes increased at certain platforms following the March 2025 shutdown of Garantex.

What regulatory actions are being considered in response?

European officials are considering a potential blanket ban on all cryptocurrency transactions involving Russia, aimed specifically at preventing copycat entities from emerging to replace sanctioned platforms. The EU has frozen approximately $250 billion of Russian assets, while the U.K. has frozen nearly $35 billion. Russia is simultaneously preparing a comprehensive crypto regulatory framework expected in July 2026 that would establish licensed domestic trading platforms, reflecting the country’s acknowledgment that sanctions cannot fully block Russians from cryptocurrency access.