Firm related to sanctioned crypto exchange Garantex is a partner of Moscow gang leader and has links to Kremlin-controlled Rosneft

A firm with multiple connections to sanctioned virtual currency exchange Garantex co-owns a debt-collection business with a convicted gang leader and has ties to Rosneft, the Kremlin-tied oil firm, a new probe shows.

The investigation, by Eesti Ekspress and the International Consortium of Investigative Journalists, reveals that within weeks of one of the exchange’s three founding shareholders dying under suspicious circumstances, another was replaced in corporate records by a shareholder  linked to Rosneft, the Kremlin-controlled oil company.

Based on court and corporate records and a review of transactions on the Garantex exchange, the investigation also finds that Garantex, already sanctioned by the U.S. for moving money for criminals and later associated with a terror group close to Hamas, was used by other designated terror groups, including Hezbollah, as well as drug gangs in Ukraine and other criminal actors.

The revelation that a Garantex affiliate has Russian government and criminal ties raises the concern that the Kremlin is tolerating the still-thriving exchange or even using it for its own ends, analysts said. The findings are likely to add fuel to calls for others in the global crypto-industry to stop doing business with Garantex.

Richard Sanders, a U.S.-based digital forensics analyst who has worked for Ukrainian law enforcement and intelligence agencies on multiple cryptocurrency investigations involving Garantex, said that the Russian government has an interest in allowing Garantex to stay in business.

“The intelligence value that can be obtained by the Russian government far outweighs their desire to prosecute criminals that by and large profit off of what the government considers to be unfriendly nations,” Sanders said, pointing to Garantex’s links to cybercrime and online drugs sales also detailed by the U.S. Treasury sanctions designation. “Garantex has dark[net] markets and ransomware groups as top clients.”

In a statement to ICIJ, Garantex declined to comment on its corporate structure or its affiliate’s Russian government and criminal ties.

Garantex said it seeks to prevent the use of the exchange for illicit activities and actively cooperated with European and U.S. authorities until the U.S. imposed sanctions on the exchange in April 2022. It says it still cooperates with other international law enforcement agencies.

“Not only do we stay away from facilitating criminal financial activities, but we also do our best to help prevent them, particularly by trying to initiate a revival of cross-border cooperation aimed at investigating and preventing illicit transactions,” the statement said.

Originally registered in Estonia as Garantex Europe, Garantex was founded in 2019 by Stanislav Drugalev, a Russian tech specialist, and Sergey Mendeleev, who was a local politician in Moscow. They rented offices at one of Moscow’s top business locations, the Federation Tower skyscrapers. Garantex Europe was co-owned by Aleksandr Ntifo-Siao, the company’s commercial director.

Business boomed as crypto took the world by storm and regulators were still adapting to the new trading technology, allowing Garantex and other exchanges to operate without much supervision. Garantex found a niche as a way to convert rubles into other currencies, which became more difficult amid sanctions on Russian banks and Moscow’s own capital controls after the invasion of Ukraine, and to use cryptocurrencies to make foreign transfers. Customers deposit rubles in cash at Garantex’s offices to receive the equivalent value in a cryptocurrency, which then is exchanged with a traditional currency from a network of other cryptocurrency exchanges or from Garantex’s own agents. With cryptocurrencies, the transactions themselves are visible on a public ledger, known as a blockchain, but the parties’ identities are shielded.

New Garantex shareholders

In September 2020, Russian authorities raided Drugalev’s Moscow apartment in a bid to force his cooperation with an investigation into criminal gangs’ use of the exchange. Drugalev agreed to cooperate and then moved to Dubai, in the United Arab Emirates, according to a Wall Street Journal report in October 2023. In early February 2021, Drugalev was killed when his car drove off a bridge at a Dubai road junction.

Drugalev’s wife, Oksana Drugaleva, suspected foul play. A few weeks after his death, she told the Russian Telegram channel Mash that Drugalev had been “a careful man” and unlikely to drive off a bridge by accident. “I am convinced it was a criminal death,” she said.

Reached by ICIJ last month, Drugaleva was less forthcoming, saying ICIJ’s questions were  “boring” and old news. “It seems like everyone is discussing the Pechenegs now,” she joked, referring to a 9th-century Central Asian tribe. “My husband’s death happened about that long ago!” She concluded: “Look, I’m now vacationing in Crimea, by the sea. I invite you to come and discuss everything.”

In its statement, Garantex declined to comment about the death of one of its founders. “Questions regarding the circumstances of Mr. Drugalev’s death should be addressed to UAE law enforcement. Comments and suggestions offered by any third party are nothing more than speculations, for which those offering them bear no liability,” Garantex said.

At the time of Drugalev’s death, Estonia’s corporate registry listed three main shareholders for Garantex: Drugalev, Mendeleev, and Ntifo-Siao.

But corporate records filed for the company show that weeks after Drugalev’s death, the co-founder Mendeleev disappeared from shareholder lists and was replaced by a previously unknown Russian, Irina Chernyavskaya. Mendeleev declined to answer detailed questions from ICIJ about Garantex and its operations.

Chernyavskaya, public records show, is the life partner of Pavel Karavatsky, a Russian business executive who has longstanding ties to companies controlled by the Kremlin. According to a power of attorney document from February 2021 in the Estonian business registry, Chernyavskaya was registered in the same central Moscow apartment as Karavatsky. Chernyavskaya has posted several photos of her child and Karavatsky together on Instagram, one of them with the headline “fathers and sons” (Отцы и дети), implying a family connection among the three.

Karavatsky had sat on the board of directors of Peresvet Bank in 2017, when it was bought by Rosneft, the powerful Russian state oil company. Western observers say Rosneft’s leadership has close ties to the FSB, the state security service successor to the KGB. Karavatsky sat on the Peresvet Bank board at a time when a former FSB general, Oleg Feoktisov, was hired as adviser to the bank’s president, Eesti Ekspress has found. According to an investigation by Dossier Center, a London-based investigative unit funded by Russian dissident Mikhail Khodorkovsky and often cited in the media because of its network of government sources, Karavatsky and Feoktistov are close associates.

In addition to Karavatsky’s connection to Garantex through his life partner, Eesti Ekspress and ICIJ have also learned that Karavatsky himself is a part-owner of a Russian firm called Fintech Corporation LLC, which operates Garantex Academy, an educational program created by Garantex to provide courses to novice crypto investors, according to its website.

Karavatsky co-owns Fintech with Ntifo-Siao, who was a shareholder of Garantex’s Estonian parent company until April 2022.

According to Russian corporate records, Fintech also owns 50% of a debt collection agency called Academy of Conflicts, alongside convicted gang leader Alexander Tsarapkin, who in 2016 received a seven-year sentence in a penal colony for extortion schemes.

According to court records in Tsarapkin’s case, one incident involved a Moscow businessman who in 2013 found himself in a dire situation when he owed money to an associate and was brutally beaten by three gangsters near his home. A week later, a stranger attacked the businessman’s wife, stabbing her with an awl and a syringe and threatening further violence against her and her children, according to media coverage and court documents consulted by Eesti Ekspress.

According to the Russian case file citing her testimony, the assailant threatened “to burn her face with acid, blow her up so that her limbs would be torn off, stab her again with an infected needle, and find and deal with the children.”

The attacker told her that the syringe contained the blood of a person with AIDS, according to Russian news reports at the time. Days later, her car was set on fire. A month later, a group of thugs assaulted her husband again, breaking his nose and knocking out teeth, according to the court records.

The gang responsible for this violence operated under the guise of a debt collection company named Authority, led by Tsarapkin. “Tsarapkin […] assigned himself the role of organizer of the criminal group,” the case file says. Other members of the gang included a former employee of the GRU, the Russian military intelligence agency.

Upon release, Tsarapkin resumed his debt collection and what Russian corporate records call “problem-solving” activities with the new firm, Academy of Conflicts. On its website, Tsarapkin is shown wearing boxing gloves, boasting to potential clients: “You will no longer have to negotiate conflicts and participate in situations that immerse you in an uncomfortable environment.”

It is not clear why Fintech, which presents itself as a cryptocurrency educational firm, would own a debt collection agency.

ICIJ has learned that Ntifo-Siao co-owns a music publishing and studio business with Tsarapkin, while Tsarapkin and Fintech also jointly owned a law firm called Anatomy of Law until March 2022.

Neither Ntifo-Siao, Karavatsky nor Tsarapkin replied to requests for comment. On Feb. 5, Ntifo-Siao changed his name to Alexander Joseluisovich Mira Serda, according to Russian public records.

George Voloshin, a financial crime analyst at the Association of Certified Anti-Money Laundering Specialists, an industry body that trains anti-money laundering professionals, said in an interview with ICIJ that given that Garantex has been sanctioned as a conduit for illegal drug sales and other illegal activity, the association with a convicted felon was to be expected.

“Garantex operates like a hawala network, with informal connections that fly under the radar,” he said, referring to a person-to-person money transfer system that shuns traditional financial institutions and avoids regulation.

Fintech’s ties to the Russian underworld and Rosneft go even deeper. Eesti Ekspress and ICIJ have learned that Fintech, operator of the Garantex Academy, shared a name and contact information with a unit of the oil company.

Rosneft bought a company called Targin in 2016, according to media reports, and three years later, someone created a second company, named Targin Logistics LLC, according to the Russian corporate registry. Records don’t say whether the two entities were related, but after Targin Logistics changed its name to Fintech Corporation in 2020, Karavatsky took over as CEO. For a time, the new Fintech Corporation continued to use the Rosneft’s logistics unit’s contact phone number and email, including Rosneft’s internet domain, “RN,”  according to Russian public records reviewed by Eesti Ekspress.

Rosneft’s chief executive, Igor Sechin, is an influential oligarch who is widely reported to have close ties to the FSB, the Russian security service. Sechin and Rosneft have been sanctioned by more than a dozen Ukraine allies, including the EU and U.K. after the 2022 invasion.

Garantex declined to comment on any associations of Fintech and its principals. “We refrain from commenting on people’s private lives and on our company’s corporate structure,” it said.

‘Unscrupulous means’

In December 2021, Estonian authorities launched an inspection of the offices Garantex Europe had claimed as its headquarters and eventually forced the company to relinquish its license in February 2022, citing money laundering concerns. Garantex Europe entered liquidation. Contacted by Eesti Ekspress, the company’s liquidator Raul Pint said he was appointed by Russian lawyers acting for Garantex’s former shareholders, Ntifo-Siao and Chernyavskaya, the life partner of Karavatsky. Garantex continues to claim a connection on its website to Garantex Europe in Estonia despite this not being the case, according to the liquidator. Pint emphasized that the previous owners have no access to the Estonian company and he has not communicated directly with them.

The following April, the U.S. Treasury Department’s Office of Foreign Assets Control sanctioned Garantex along with Hydra, a so-called darknet market, a network of websites where users pay for illegal goods and services using cryptocurrencies. OFAC said more than $100 million of transactions on the Garantex virtual currency exchange had been associated with “illicit actors” and darknet markets, including the Russian ransomware gang Conti and Hydra. Estonian authorities supplied Treasury with information that led to the sanctions, OFAC said.

“Treasury is committed to taking action against actors that, like Hydra and Garantex, willfully disregard anti-money laundering and countering the financing of terrorism (AML/CFT) obligations and allow their systems to be abused by illicit actors,” the agency said in a press release. “Wanton disregard for regulations and compliance by persons that run virtual currency exchanges will be rigorously investigated, and where appropriate, perpetrators will be held accountable.”

At the time of the sanctions, OFAC said Garantex was continuing “to provide services to customers through unscrupulous means.”

Indeed, Garantex’s Russian operation and Fintech are still active. According to Russian news reports, Fintech leases office space on the 14th floor of Federation Tower East in Moscow, the same floor where Garantex operates. Fintech has also advertised job vacancies at Garantex on Russian websites listing a Federation Tower East address. Tsarapkin’s Academy of Conflicts webpage also lists a Federation Tower address, but without specifying which floor it’s on.

Fintech is shown as the owner of the Garantex app on Russian mobile app stores, while Fintech co-owners Karavatsky and Ntifo-Siao are also the co-owners of the Garantex registered trademark in the United States, open source records show.

According to estimates provided to ICIJ and Eesti Ekspress by Global Ledger, a Ukrainian-founded crypto-analytics company based in Switzerland, Garantex has processed at least $2 billion worth of bitcoin with international crypto exchanges from the date the company was sanctioned in April 2022 until early January. During the same period, Garantex has sent $238 million worth of bitcoin and received $107 million’s worth to and from wallets controlled by darknet market operators that enable sales of drugs and illegal goods.

Among the most active counterparties, the Global Ledger analysis further shows, were Russian darknet markets known as Black Sprut, OMG!OMG!, Kraken and Mega, which have actively used Garantex to support their activities. They took over Hydra’s market share in Russian online drug sales after the latter had been taken down by authorities. According to Global Ledger, a Telegram channel owner calling itself Ghost of Novorossiya, which conducts pro-Russian fundraising campaigns for the war in Ukraine, has sent $2.8 million worth of cryptocurrency via Garantex to wallets that have been cited by Israel for terrorist financing.

What’s more, Global Ledger told ICIJ that its data analysis showed that as much as $15 million in cryptocurrencies have passed through Garantex to wallets alleged by Israel to belong to Hezbollah and Quds Force. The Quds Force is a special operations unit of Iran’s Islamic Revolutionary Guard Corps. Both Hezbollah and IRGC have been designated by the U.S. as terror groups.  According to the Wall Street Journal report last October, Garantex users funneled cash to the Palestinian Islamic Jihad, a group widely reported to have joined Hamas in the attacks on Israel that month.

Ukrainian authorities told ICIJ that a Ukrainian-Russian drug trafficking group known as Khimprom (no relation to the Russian chemicals corporation PJSC Khimprom) continues to use Garantex as well as multiple darknet markets to sell cheap and highly addictive lab-made stimulants in the country.

The substance Khimprom specializes in is known on Ukrainian streets as “flakka” or the “zombie drug,” and while being cheap and easy to manufacture, has severe side-effects, such as depression and suicidal behavior. According to a report about Khimprom’s flakka business published last year by the nonprofit Global Initiative Against Transnational Organized Crime, the drug was being sold to Russian occupying troops, while Ukrainian and Russian intelligence agencies were blaming each other for its presence.

Garantex said it has no involvement with terrorist-designated groups and said any such allegations are based on flawed analyses of data from crypto exchanges and other so-called virtual assets service providers. “We believe this is a false accusation based on a misguided analysis of cryptocurrency flows between VASPs based in Gulf countries, who have become a new global financial hub that attracts investments from people all over the world, including Russians,” the statement said.

Garantex said it takes “all necessary measures to prevent and block illicit transactions” in accordance with international anti-money laundering guidelines. It said it believes that “assessments done by Western analysts are flawed and incorrect, “citing a lack of unified standards” for flagging and analyzing suspicious transactions.  “Repeated testing and peer reviews have shown that the existing flagging practices are unreliable, as they tend to exaggerate the number of unwanted transactions, throwing in transactions made by perfectly law-abiding market participants,” Garantex said, adding that it has “a zero-tolerance policy with regard to transactions involving darknet markets.”

Yevhenii Panchenko, head of the Cyber Police Department of Ukraine, told ICIJ that after sanctions were imposed on Garantex, the exchange ceased cooperating with Ukrainian crypto companies and its overall transaction volume shrank to about a third of its pre-sanctions peak. Nonetheless, he said Garantex still sees millions of dollars’ worth of transactions a month.

Martin Laine is a reporter with Eesti Ekspress in Estonia.