Blockchain analytics firm Elliptic published findings alleging that a coordinated cluster of crypto exchanges processed roughly $10 billion to $11 billion in transactions that helped Russia bypass international sanctions. Elliptic’s central takeaway is that sanctions evasion can be engineered through everyday product features, not just through sophisticated laundering tactics.
The report matters for traders, treasuries, and compliance teams because it focuses on design choices that reduce friction for users while increasing opacity for monitors. Elliptic argues that peer-to-peer ruble rails, shared custodial wallets, and stablecoin-funded virtual cards can materially weaken screening effectiveness and complicate attribution.
How the network reduced friction and increased opacity
Elliptic described a pattern of interaction tactics that made activity harder to track at scale, including frequent wallet address rotation and co-mingled custodial wallets used across regional and global product lines. The report frames shared custody infrastructure as a key failure mode because it can simplify user flows while blurring transaction provenance for compliance systems.
It also highlighted peer-to-peer ruble on-ramps and consumer virtual payment cards funded by stablecoins as tools that preserve purchasing access outside the banking perimeter. In Elliptic’s framing, these rails lower onboarding friction while creating a monitoring blind spot where traditional bank-style controls are absent or diluted.
The five platforms Elliptic named
Elliptic identified five platforms and associated them with specific flows and product behaviors. The report described Bitpapa as a P2P marketplace routing rubles into crypto through rotating wallet addresses, with about 9.7% of its outgoing crypto sent to OFAC-sanctioned targets.
Elliptic described ABCeX as the largest unsanctioned exchange operating from Moscow and said it processed at least $11 billion in crypto transactions, noting it operated from the Federation Tower location previously associated with the seized exchange Garantex. The report presents the location and transaction scale as part of the signal set indicating continuity of sanctioned-market infrastructure.
Elliptic stated that Exmo had publicly claimed to exit the Russian market after 2022, yet on-chain links showed Exmo.com and Exmo.me sharing custodial infrastructure, and it flagged more than $19.5 million in direct transactions with sanctioned entities. The report frames shared backend custody as an indicator that market exit messaging can diverge from operational reality.
Elliptic described Rapira as registered in Georgia with a Moscow office, reporting that it facilitated ruble trading and transacted more than $72 million directly with Garantex, with late-2025 raids reported over suspected capital flight. The report ties ruble liquidity services to direct exposure with a sanctioned venue as the primary risk marker.
Elliptic said Aifory Pro offered cash-to-crypto services across Moscow, Dubai, and Türkiye and provided USDT-funded virtual cards to bypass foreign service restrictions, while sending nearly $2 million to the Iranian exchange Abantether. The report positions stablecoin-funded virtual cards as a practical bypass layer that converts crypto balances into spendable access.
Operational impact for legitimate market participants
From a product and operations angle, the report implies a harsher environment for compliant users because risk controls will tighten where co-mingling and P2P rails dominate. For treasuries and trading desks, that can mean more false positives, longer clearance times, and higher friction across on- and off-ramps as screening thresholds ratchet up.
For compliance teams, the implied response is deeper wallet clustering, stricter provenance validation, and higher reliance on contextual metadata during transaction approval and review. Those controls raise steps per operation and add latency, but they can reduce investigation time and improve auditability when sanctions-linked patterns are concentrated.
Elliptic’s view is that enforcement has displaced these flows rather than eliminated them, and it expects sanctions enforcement to intensify through 2026, with European policymakers reportedly considering broader restrictions on Russia-linked crypto activity. If that policy direction holds, platforms will need tighter segregation of custodial infrastructure and clearer permission transparency to reduce co-mingling risk and preserve compliant routing options.
