In a detailed analysis released on February 21, 2026, blockchain analytics firm Elliptic has shed new light on how several cryptocurrency platforms with deep ties to Russia continue to facilitate the circumvention of Western sanctions. These services enable Russian entities to convert rubles into digital assets, move funds across borders without relying on regulated banks, and reconvert them into local currencies abroad—effectively creating alternative financial pipelines that bypass traditional oversight.
The research report underscores a persistent challenge: despite mounting regulatory pressure and targeted sanctions, many of these platforms operate with nominal offshore registrations while maintaining strong operational links inside Russia.
Elliptic’s on-chain monitoring reveals billions in transaction volumes flowing through these channels, often involving already-sanctioned entities and sophisticated techniques to obscure origins.
One prominent example is Bitpapa, a peer-to-peer exchange registered in the United Arab Emirates but heavily oriented toward Russian users. Sanctioned by the U.S. Treasury’s Office of Foreign Assets Control in March 2024 for aiding evasion, the platform still processes significant flows.
Elliptic’s data shows that roughly 9.7% of Bitpapa’s outgoing cryptocurrency is directed toward other OFAC-listed targets, including 5% routed specifically to the notorious sanctioned exchange Garantex.
The firm employs frequent wallet address rotation, a tactic that complicates real-time monitoring and conceals the Russian provenance of funds from downstream recipients.
Another service under scrutiny is ABCeX, which offers both order-book and peer-to-peer trading of rubles for crypto.
Operating from an office in Moscow’s Federation Tower—formerly occupied by Garantex—the platform has handled at least $11 billion in cryptoassets.
Substantial portions have flowed directly to Garantex and Aifory Pro, with wallet obfuscation strategies designed to break observable links between users and the service itself.Exmo presents a particularly deceptive case.
Following Russia’s 2022 invasion of Ukraine, the exchange publicly announced it had divested its Russian operations, splitting into Exmo.com (international) and Exmo.me (regional).
However, Elliptic’s blockchain tracing demonstrates no genuine separation: both entities share identical custodial wallet infrastructure, pooling deposits and issuing withdrawals from the same addresses.
This commingling has enabled more than $19.5 million in direct transactions with sanctioned platforms including Garantex, Grinex, and Chatex.
Rapira, incorporated in Georgia yet running a Moscow office, has similarly funneled over $72 million in crypto to and from the sanctioned Grinex.
Its premises were reportedly raided by authorities investigating suspected capital flight to Dubai, highlighting the blurred lines between legitimate business and evasion.
Aifory Pro adds another layer, specializing in cash-to-crypto conversions across Moscow, Dubai, and Turkey while positioning itself as a “Foreign Economic Activity Payment Agent” for Russia-China trade.
The service has sent nearly $2 million to the Iranian exchange Abantether and promotes virtual payment cards and Apple Pay functionality funded by USDT balances—tools explicitly marketed to help Russians access blocked international services such as Airbnb and ChatGPT.
Elliptic’s findings illustrate a broader ecosystem where unsanctioned or only recently sanctioned platforms sustain high-volume Russia-centric activity through technical obfuscation, shared infrastructure, and strategic geographic setups.
As global regulators intensify enforcement, the report serves as a timely reminder that sanctions evasion in crypto remains dynamic and adaptive. Continued vigilance, enhanced blockchain analytics, and coordinated international action will be essential to close these loopholes and limit the flow of funds supporting sanctioned activities.