A Growing Concern: How the Country’s Crypto-Friendly Framework Enables Illicit Financial Flows

Russia has been leveraging Kyrgyzstan’s rapidly growing crypto ecosystem to evade international sanctions and procure dual-use goods for its war in Ukraine, according to a recent report by TRM Labs. The country’s crypto-friendly framework, established in 2022, has created a hub for illicit financial flows, with Russian actors exploiting the system to circumvent sanctions and move funds.

Since Russia’s invasion of Ukraine in 2022, its economic ties with Kyrgyzstan have deepened significantly. Bilateral trade reached $3.5 billion in 2024, while Russian investment in Kyrgyzstan jumped 23% in early 2024 to nearly $200 million. The country’s rapid emergence as a crypto hub has also made it an attractive destination for Russian actors seeking to evade sanctions.

TRM Labs has identified a growing pattern of Russian actors exploiting Kyrgyz-registered exchanges to circumvent international sanctions and move funds. Some of these exchanges display behavioral heuristics similar to the sanctioned Russian exchange Garantex and appear to have served as conduits for funds following law enforcement action against Garantex in 2025.

One of the key exchanges identified by TRM Labs is Envoys Vision Digital Exchange (EVDE), which has been linked to a Russian paramilitary organization sanctioned by the US Treasury’s Office of Foreign Assets Control (OFAC) in 2022. EVDE describes itself as a “platform for traders and investors that includes stock, currency, commodity, and cryptocurrency markets.”

The exchange also shows several off-chain links to cross-border logistics firms and a Chinese financial institution, suggesting a wider support infrastructure that warrants further scrutiny. TRM Labs has also identified a distinctive transaction pattern associated with wallet addresses used by Garantex, which was disrupted by law enforcement in March 2025.

Following Garantex’s takedown, several Kyrgyz-registered entities began exhibiting the same behavioral heuristics, including Grinex, which facilitated the movement of funds from Garantex by enabling withdrawals via Russian stablecoin A7A5. Users with balances exceeding $50,000 were able to extract funds through Grinex using A7A5 shortly after Garantex’s takedown.

The report highlights the need for stronger ownership requirements, such as mandating the physical presence or local residency of company principals, to raise barriers for foreign bad actors. Increased transparency around funding sources, such as requiring disclosure of ultimate fund originators or restricting financing to Kyrgyz residents, would also reduce the appeal of Kyrgyzstan as a destination for shell entities.

Without proactive intervention, the model Russia has implemented in Kyrgyzstan can be easily exported, posing broader risks to global sanctions enforcement efforts. Kazakhstan and Uzbekistan have already begun to adopt similar crypto-friendly frameworks, and if left unchecked, Russia could replicate these same playbooks in neighboring jurisdictions.

The report concludes that Kyrgyzstan has meaningful tools to raise the cost of abuse, including stronger ownership requirements, increased transparency around funding sources, and enhanced scrutiny of VASP registrations. However, without proactive intervention, the country’s crypto ecosystem will continue to be exploited by illicit actors, fueling aggression, procurement, and destabilization.