This piece explains the pattern and strategic logic of sanctions-evasion financial infrastructure, and the parallel institutional de-dollarization infrastructure some states are building, for readers who need to recognize and assess it (analysts, compliance teams, risk professionals) not to reproduce it. It names documented enforcement cases and cites public sanctions actions rather than describing operational sequences. Where the same network adapts after enforcement, we describe that adaptation as a documented fact pattern, not a method.

A single stablecoin processed $119.7 billion in transactions before the EU could designate it. Its predecessor got seized, rebuilt itself in months, and got seized again. Meanwhile, central banks are quietly building legitimate infrastructure that serves a similar goal through entirely legal means. This is what a real, mapped sanctions-evasion financial network looks like and why understanding the pattern matters more than any single case.

The Core Pattern, at the Level That Matters

Strip away the individual cases and the architecture sanctioned networks converge on is consistent, because it’s solving the same problem every time, move value across a border without it touching a Western-regulated bank that would freeze it or report it. Three structural layers recur across every documented case:

1. A commercial layer – trade invoices and shipping documents that don’t accurately describe what’s moving or where it’s really going, run through intermediary jurisdictions with weak beneficial-ownership disclosure.
2. A settlement layer – value moves via crypto, specifically stablecoins, instead of a wire that would clear through a correspondent bank subject to Western compliance screening.
3. A liquidity layer – regional OTC brokers convert the digital value back into usable local currency at the far end, where the counterparties who actually need to be paid operate.

The mechanics of any one layer it’s recognizing that this three-layer structure is the signature, and that enforcement actions consistently hit the settlement layer hardest, because it’s the one chokepoint where value has to touch something traceable (a stablecoin issuer, an exchange, a blockchain address) to actually function at scale.

The Case Study Every Analyst Should Know: Garantex, Grinex, A7A5

This single network illustrates the pattern-and-adaptation cycle better than any abstract description, and it’s fully documented in public sanctions actions.

The timeline:

• April 2022 – OFAC first designated Garantex, a Moscow/St. Petersburg-based exchange, under Executive Order 14024 for operating in Russia’s financial sector.
• 2024 – Blockchain intelligence firm TRM Labs found Garantex (alongside Iran’s Nobitex) accounted for more than 85% of all crypto inflows to sanctioned entities and jurisdictions globally that year.
• March 6, 2025 – A coordinated law-enforcement operation (U.S. Secret Service, DOJ, FBI, Europol, and national police forces in the Netherlands, Germany, Finland, and Estonia) seized Garantex’s domains and froze over $26 million in crypto.
• Within months – Garantex’s own staff had already built Grinex, a successor platform, and migrated customer funds and access to it, a transition reportedly prepped in advance of the takedown.
• August 14, 2025 – OFAC and the UK’s OFSI re-designated the network: Grinex itself, three former Garantex executives, and six associated companies across Russia and Kyrgyzstan.
• October 2025 – The EU’s 19th sanctions package added a transaction ban on A7A5, a ruble-backed stablecoin launched in Kyrgyzstan in January 2025 that had become the liquidity bridge connecting Garantex’s frozen assets to Grinex’s new operations. Chainalysis found A7A5 had processed $93.3 billion in under a year, by the time of the EU’s 20th sanctions package in mid-2026, that figure had risen to $119.7 billion.
• April 2026 – Grinex itself halted operations following what researchers describe as a possible false-flag cyberattack, amid sustained multilateral pressure.
• Mid-2026 – The EU designated TengriCoin (Meer.kg), a Kyrgyzstani exchange handling significant A7A5 trading volume explicitly extending sanctions reach to third-country platforms regardless of incorporation, a notable expansion of jurisdictional scope.

This case shows the enforcement-adaptation cycle isn’t hypothetical it’s measured in months, not years, and the network’s resilience comes specifically from having redundant settlement infrastructure (a new exchange, a new stablecoin, a new jurisdiction) ready before the old one is hit, not from any single technique being unbreakable.

A Second, Independent Case: The Shamkhani-Baransky Network

Separately documented reporting (Frontline Atlas, corroborated by OFAC designations) traces a network moving both Iranian and Russian oil through overlapping structures, the same individual designated under Iran sanctions was linked to Indian shipping firms simultaneously carrying Russian crude to China. Promsvyazbank’s A7 platform running on the same Tron-based USDT rails as the Shamkhani network was found to have operated a tanker with prior ties to an IRGC-linked network before that vessel moved into a different sanctioned fleet.

The takeaway here is different from the Garantex case, it demonstrates that these networks aren’t organized strictly by sanctioning target (Russia-focused, Iran-focused) but increasingly share physical assets (vessels), financial rails (the same stablecoin infrastructure), and personnel across what look, from the outside, like separate evasion operations. For a compliance team, that means a red flag tied to one sanctioned jurisdiction can be a legitimate signal for exposure to an entirely different one.

The Enforcement Side: Which Is the More Instructive Half

Operation Economic Fury, the U.S. Treasury’s campaign against Iranian sanctions evasion launched alongside the February 2026 U.S. military campaign, illustrates how enforcement now targets the settlement layer directly rather than chasing individual shipments. In one 2026 action, OFAC blacklisted two wallet addresses holding $344 million in USDT, and Tether itself froze the funds in coordination with the U.S. government, rather than the funds requiring seizure through a foreign exchange or bank. Separately, researchers at Elliptic documented that Iran’s central bank had accumulated at least $500 million in USDT specifically to work around the country’s banking isolation and prop up the rial.

Stablecoin issuers (Tether, Circle) increasingly cooperate directly with U.S. and EU enforcement to freeze designated wallets meaning the “instant, untraceable” reputation of crypto-based evasion is less accurate than the public narrative suggests. The actual vulnerability isn’t blockchain transparency (transaction history is public by design) it’s the off-ramp: the moment digital value needs to become spendable local currency, it has to pass through some institution or human intermediary that can be pressured, sanctioned, or infiltrated. Every major enforcement success in this space Garantex, Grinex, A7A5, the Iran wallet freezes has hit exactly that seam.

Why This Keeps Happening: The Strategic Logic, Not the Mechanics

The reason this infrastructure keeps regenerating after enforcement action isn’t superior technology it’s economics. Building redundant shell structures and backup settlement rails is cheap relative to the trade volumes at stake (oil, dual-use electronics), so networks can treat a takedown as a cost of doing business rather than a terminal event, exactly as the Garantex to Grinex transition in 2025 demonstrated. This is a genuinely different equilibrium than pre-2022 sanctions enforcement, where a single bank designation could meaningfully choke off a target’s access to the dollar system. What’s contested among analysts is whether multilateral, faster-cycling enforcement (the EU’s expanding reach to third-country platforms like TengriCoin regardless of incorporation) can eventually outpace the rebuild cycle, or whether it’s a structurally permanent cat-and-mouse dynamic. Reasonable compliance and sanctions professionals land differently on that question.

The State-Level Layer: mBridge and Institutional De-Dollarization

Everything above describes networks built to evade detection. There’s a separate, much more public layer worth distinguishing clearly: central banks themselves building legitimate settlement infrastructure that happens to serve the same underlying goal reducing dependence on Western-cleared dollar transactions.

mBridge is the clearest example, a wholesale Central Bank Digital Currency (CBDC) platform where participating central banks test cross-border settlement directly in local digital currencies, bypassing both the dollar as an intermediary and traditional correspondent clearinghouses. This isn’t shadow infrastructure it’s publicly documented, BIS-linked experimentation, distinct in kind from the Garantex-style networks described above.

The strategic logic behind this build-out, as described by analysts tracking the trend, isn’t a plan for a sudden dollar collapse it’s closer to insurance-building. In the past, if Brazil wanted to pay Russia or India, the transaction often cleared through a U.S. correspondent bank using dollars, even with no U.S. party involved simply because dollar-clearing was the default global rail. Payment-system interlinking and wholesale CBDC platforms let participating countries settle directly in local currencies (yuan, rupee, real) instead, removing that dependency for the transactions that use these rails.

A recurring argument among analysts is that the last several years of aggressive sanctions and asset-freeze actions functioned as the actual catalyst here. Countries that previously had little interest in de-dollarization concluded they needed a “spare tire”, redundant settlement infrastructure that can’t be frozen by a unilateral Western policy shift, regardless of whether they ever expect to need it. This is one reading of the trend, not a confirmed motive for every participating central bank, several of which frame their mBridge involvement in more limited, technical terms (payment efficiency, FX cost reduction) rather than explicitly geopolitical ones.

Institutionally, this sits alongside a broader push, continued formalization of alternative messaging networks, and the New Development Bank (NDB) the BRICS-founded multilateral lender actively funding infrastructure projects denominated in local currencies rather than dollars.

These legitimate, state-sanctioned rails and the shadow networks described earlier aren’t fully separate systems. Local-currency settlement agreements and decentralized crypto corridors increasingly blend at the edges, and that blending is precisely what makes secondary-sanctions enforcement and illicit-flow tracing a moving target, a transaction routed through a legitimate bilateral currency arrangement can be genuinely hard to distinguish, at the compliance-screening level, from one deliberately structured to avoid detection.

The dollar still commands the large majority of global foreign exchange reserves and the deepest, most liquid capital markets in the world infrastructure that doesn’t get replicated quickly regardless of how much institutional momentum mBridge and similar platforms gain.

However, the division of economic paths facilitated by the BRICS bloc is already here. What if stress or a collapse of the US economy triggers an even deeper rift and a desire for a new economic order?

What’s realistic to say is that the foundation for a genuine long-term erosion of dollar dependence is being actively built, growing incrementally rather than dramatically. The more defensible framing isn’t a sudden “death of the dollar” scenario, but a gradual fragmentation of global finance into a dollar-centric zone alongside a growing, multi-currency parallel settlement zone at least for the foreseeable future.

The useful unit isn’t “how do they do it” as a procedure it’s the recurring signature: intermediary-jurisdiction shell structures, stablecoin settlement replacing correspondent banking, and OTC off-ramping, with the settlement layer being both the network’s greatest strength (speed, reach) and its single most exploitable weakness (it’s the one place value has to touch traceable, freezable infrastructure). The Garantex-Grinex-A7A5 case alone three years, three enforcement waves, $119.7 billion processed is the clearest public teaching case for understanding both halves of that dynamic, how fast these networks rebuild, and exactly where enforcement keeps successfully hitting them.

This ecosystem represents the cutting edge of modern geopolitical finance where blockchain transparency collides head-on with state-sponsored sanctions evasion, and the outcome of that collision, case by case, is still being written in real time.

This analysis reflects public sanctions designations from OFAC, the EU, and OFSI, and reporting from Chainalysis, Elliptic, TRM Labs, Frontline Atlas, and Steptoe LLP, current as of mid-2026. It is not legal or compliance advice.