A new report has indicated that Russian actors are using Kyrgyzstan’s digital asset ecosystem to evade international sanctions and purchase dual-use goods for its ongoing war in Ukraine.
According to research from U.K.-based blockchain intelligence firm TRM Labs, published in a July 21 blog post, Kyrgyzstan-registered exchanges have “repeatedly facilitated transactions linked to sanctioned Russian entities.”
It noted that “many of these virtual asset service providers (VASPs) show indicators of being shell companies — including the reuse of identical residential addresses, founders, and contact information across multiple entities.”
The report also found that several of these Kyrgyz exchanges exhibited similar on-chain heuristics to Garantex, a Russian digital asset exchange that was the subject of an international operation to disrupt its operations due to facilitating terrorist financing and sanctions violations.
“The high-risk exchange Grinex—likely a rebranded successor to Garantex—was also registered in Kyrgyzstan,” said the report. “On-chain analysis suggests that Grinex and other Kyrgyz-based exchanges may have played a role in moving funds after the takedown, underscoring Kyrgyzstan’s growing importance as a conduit for post-sanctions Russian financial activity.”
TRM Labs observed increasing instances of Russia-linked actors exploiting Kyrgyz-registered exchanges to circumvent international sanctions and move funds. Some of these exchanges, said the report, “display behavioral heuristics similar to the sanctioned Russian exchange Garantex and appear to have served as conduits for funds following law enforcement action against Garantex in 2025.”
This pattern was found in several other entities as well, according to the report.
Russia’s route out of its sanctions hole
Russia has been the subject of massive and unprecedented international sanctions since its illegal invasion of Ukraine in February 2022, making it the most sanctioned nation on Earth.
With an ailing economy—some suggesting it is on the brink of collapse—and in the face of such severe restrictions as being shut out from the international financial messaging system, Society for Worldwide Interbank Financial Telecommunication (SWIFT), Russia has increasingly turned to the digital asset space for a reprieve.
The appeal to a heavily sanctioned nation of being able to exchange and transfer funds instantaneously via an anonymous (or pseudonymous) and decentralized peer-to-peer network, not controlled by any antagonistic nation, is obvious.
However, the ability to track and trace funds on the blockchain and the increasing legitimization of the digital asset space have made this route to international monetary freedom more difficult.
Many popular exchanges and crypto-companies, such as Blockchain.com, Crypto.com, and LocalBitcoins, and Kraken, have felt the need to comply with international sanctions against Russia, including European Union-mandated bans on all digital asset wallets, accounts, or custody services to Russian entities and accounts.
Suspiciously booming Kyrgyzstan industry
The TRM report noted that, since Russia invaded Ukraine, its economic ties with Kyrgyzstan have deepened significantly. While Russia-linked activity accounted for almost all of Kyrgyzstan’s digital asset industry after the invasion, before February 2022, it was “virtually nonexistent.”
In January 2022, Kyrgyzstan passed digital currency-friendly legislation which, amongst other measures, recognized digital assets as property and established a registration regime for virtual asset service providers (VASP). Since then, the Central Asian Republic, formerly part of the USSR, has rapidly emerged as a crypto hub.
According to TRM Labs, “by October 2024, Kyrgyzstan had issued 126 VASP licenses, fueling a sharp rise in digital asset activity. Transaction volume by licensed VASPs surged from USD 59 million in 2022 to USD 4.2 billion in just the first seven months of 2024.”
This booming industry would not be a problem, were it not for the fact that VASPs registered in Kyrgyzstan shared “suspicious” on- and off-chain overlap with Russian entities, including identical registration addresses at private residences, phone numbers and emails tied to freight companies or other VASPs, named founders linked to multiple other providers, no discernible background in business or digital currency, and/or no functional user registration processes.
As well as the example of Garantex and Grinex, the report pointed to the Kyrgyz exchange Envoys Vision Digital Exchange (EVDE), which registered a digital currency wallet address tied to the Rusich Group, a Russian paramilitary organization sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) in 2022 for its involvement in the war in Ukraine.
“Beyond its on-chain exposure, the exchange also shows several off-chain links to cross-border logistics firms and a Chinese financial institution, suggesting a wider support infrastructure that warrants further scrutiny,” said TRM Labs.
Plugging the hole?
In terms of what can be done about this sanction loophole that Russia appears to have found, TRM Labs recommended several measures.
If Kyrgyzstan is being exploited rather than complicit, the report suggested implementing stronger ownership requirements, such as mandating the physical presence or local residency of company principals, which would raise barriers for foreign bad actors. Similarly, increasing transparency around funding sources would reduce the appeal of Kyrgyzstan as a destination for shell entities.”
However, if Kyrgyzstan is an equal partner in facilitating Russia’s sanctions evasion, “governments and law enforcement agencies seeking to counter Russia’s sanctions evasion toolkit need to urgently engage directly with Kyrgyz authorities on compliance.”
Without proactive intervention, argued the report, the model Russia has implemented in Kyrgyzstan can be easily exported: “If left unchecked, Russia could replicate these same playbooks in neighboring jurisdictions — further weakening the global sanctions regime and enabling the continued flow of funds to fuel aggression, procurement, and destabilization.”
Watch | Tech of Tomorrow: Diving into the impact of tech in shaping the future
title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen=””>