The ABCeX File

On May 26, 2026, the United Kingdom sanctioned ABCeX — formally designated through its parent company, Nueva Cryptologia S.A.S. de C.V., an El Salvador-registered entity — as part of the first-ever application of Regulation 17A to cryptocurrency exchanges under the UK's Russia sanctions regime. Eighteen entities and four individuals were designated. ABCeX's co-founder Sergey Mendeleev, already on the U.S. OFAC list since August 2025, was designated by the UK in the same package.

The exchange had processed over $11 billion in cryptocurrency since its founding in late 2023. It operated from at least three floors of Federation Tower East in Moscow — the same skyscraper that housed Suex, Chatex, Garantex, and Grinex before each was sanctioned. Elliptic had called it "the largest unsanctioned exchange" in the Russian sanctions-evasion ecosystem. It was already rebranding.

Its successor, AEXBit, was not included in the UK designation. As of May 2026, it remained accessible.

The Exchange

ABCeX is not a typical cryptocurrency exchange. It is a hybrid: part digital trading platform, part physical cash-conversion network, part sanctions-evasion service.

The digital side offers order-book trading in Bitcoin, Ethereum, Tron, and USDT, with trading pairs against the Russian ruble. Fees are low — 0.07 percent for makers, 0.09 percent for takers. A peer-to-peer marketplace operates with zero fees. Futures trading offers ten-times leverage. There is an API for corporate clients. The mobile app is available on Google Play.

But the physical side is what makes ABCeX distinctive and dangerous. The exchange operates as many as 53 offices across Russia — physical locations where customers walk in, hand over cash, and receive cryptocurrency, or vice versa. These are not bank branches. They are conversion points where the formal financial system meets the informal one — where rubles become USDT without the oversight that a bank transfer would entail. OFAC's designations of prior Federation Tower exchanges cited ransomware proceeds and darknet market funds flowing through similar conversion infrastructure.

ForkLog, the Russian-language crypto news outlet, profiled ABCeX's physical network in early 2025: offices in dozens of Russian cities, each staffed with operators who handle cash-to-crypto conversion on the spot. The service model is deliberately analog at its edges. A customer in Novosibirsk or Rostov-on-Don walks into an unmarked office, hands over rubles, and receives USDT to a Tron wallet. No banking relationship required. No KYC beyond what the operator decides to enforce. The physical network is ABCeX's competitive advantage over purely digital exchanges — it reaches customers who cannot or will not use the formal banking system.

In Federation Tower East, ABCeX occupies floor 3 — described by Rucriminal.info as the "back office of black payments and the ABCeX crypto exchange" — and floor 28, where multiple exchangers operate in a single office suite. The exchange also uses the 52nd floor, where equipment was seized during the December 2024 raids. A Yandex Maps listing for the Federation Tower location shows it as open 24 hours a day, 7 days a week. The exchange lists itself publicly on a Russian mapping service, at the address of Moscow's most conspicuous skyscraper, around the clock.

Additional services include "ruble code" transfers — a mechanism that converts ruble deposits into alphanumeric codes redeemable for cryptocurrency, bypassing direct bank-to-exchange transactions — and a corporate API for business clients who need programmatic access to high-volume conversion. The infrastructure is built for scale, for speed, and for the specific needs of clients who have reasons to avoid the regulated financial system.

The Operators

The man alleged to control ABCeX is Shukhrat Rasulov, an Uzbek-born businessman identified by Rucriminal.info as the primary owner of the "black payment systems and crypto exchanger business" behind the exchange. According to Rucriminal, Rasulov operates through Yuri Kvashonkin, who serves as the official CEO of LAKOST LLC, the legal entity connected to the operation on the third floor. Rucriminal describes Kvashonkin as Rasulov's "right-hand associate and nominee" — the public face of a business whose alleged beneficial owner prefers invisibility. Neither Rasulov nor Kvashonkin has been charged or sanctioned; Rucriminal's characterization has not been independently verified by CrimsonVector.

Rasulov's profile, as reported by Russian investigative outlets, extends beyond cryptocurrency. He is described as a sponsor of the Moscow Kabbalah Center and a figure in the city's business-entertainment nexus. Rucriminal's December 2024 expose placed him at the center of a network that spans from crypto exchange operations through illegal online casino payment processing to connections with organized crime figures.

But ABCeX does not exist in isolation. It is part of a larger architecture. Sergey Mendeleev, the co-founder of Garantex who was sanctioned by OFAC in August 2025, is identified by TRM Labs as having "historic ties" to ABCeX. TI Russia documented Mendeleev operating under the Telegram handle "Lomonosov" — a science-themed alias matching his surname — managing customer support and operational coordination across multiple exchange projects in the Garantex successor ecosystem. The relationship between Rasulov (alleged beneficial owner) and Mendeleev (network architect) appears to represent different layers: Rasulov provides the capital and physical infrastructure; Mendeleev provides the technical platform and customer ecosystem.

A subsidiary or connected operation called Aifory Pro operates in parallel. Rucriminal describes it as an "ABCeX subsidiary functioning as a money laundering service." Elliptic treats it as separate but connected. Russian press reporting from 2025 identifies at least five additional payment entities under Rasulov's umbrella — Antarex, E4A, EUFORIA, EXNODE, and Onlyfinance — suggesting ABCeX is one node in a much larger network.

ABCeX occupies a building with a history. On the 14th floor of the same tower, Fintech Corporation — co-owned by sanctioned Garantex executive Pavel Karavatsky — operates in a 50-50 partnership with Alexander Tsarapkin, a convicted Moscow gang leader who received a seven-year sentence in 2016 for violent extortion schemes. An ICIJ investigation documented that Tsarapkin's criminal group attacked debtors and their families, including an incident in which a businessman's wife was stabbed and threatened with acid. Their joint entity, Academy of Conflicts, lists a Federation Tower address. One of Garantex's three co-founders, Stanislav Drugalev, died in Dubai in February 2021 after his car drove off a bridge — his wife told Russian media she was "convinced it was a criminal death." Weeks later, Mendeleev was removed from Garantex's shareholder list and replaced by Karavatsky's life partner. Federation Tower's crypto ecosystem does not merely evade sanctions. It operates in proximity to violence.

The Blockchain Evidence

Three independent blockchain analytics firms have documented ABCeX's role in the Russian sanctions-evasion ecosystem. Their findings converge.

Elliptic (February 2026) identified ABCeX as the largest unsanctioned exchange in the ecosystem, with over $11 billion in processed cryptocurrency. Elliptic documented direct transaction flows to sanctioned and high-risk entities, including Garantex, and identified a wallet obfuscation strategy designed to break the chain of traceability. ABCeX was named alongside Bitpapa, Exmo, Rapira, and Aifory Pro as one of five key platforms enabling Russian sanctions evasion.

TRM Labs identified ABCeX as Garantex's third-largest on-chain counterparty prior to the March 2025 takedown, and documented a "notable rise in Garantex-linked funds flowing to ABCeX" after the seizure — meaning ABCeX absorbed Garantex's displaced transaction volume. Most critically, TRM Labs discovered co-spending by addresses attributed to both AEXBit and ABCeX, indicating common control between the exchange and its rebrand. TRM called this pattern "The Imitation Game."

Transparency International Russia, working with ICIJ and iStories, provided the most granular evidence. Their undercover investigation documented specific USDT flows: Arvix.pro (ABCeX's Georgian-registered alias) sent 60,000 USDT to an intermediary wallet in November 2024, which then forwarded 1,040,090 USDT to a target wallet. The same intermediary processed $2.66 million from Garantex Europe on the same date — demonstrating that ABCeX and Garantex shared financial infrastructure at the wallet level.

The total documented flows between ABCeX and the sanctioned ecosystem: approximately 818,000 USDT sent to Garantex and 204,000 received; approximately 1.19 million USDT sent to Grinex and 627,000 received. Over two million USDT in direct, traceable transactions with sanctioned exchanges — and this represents only the flows visible to researchers, not the full volume.

The Raids

Russian law enforcement has raided ABCeX twice. The exchange survived both.

On March 29, 2024, one week after the Crocus City Hall terrorist attack — the deadliest attack on Russian soil in two decades, which killed at least 149 people — law enforcement searched ABCeX's offices as part of the broader Crocus financing investigation. RBC reported the searches that day. Russia's Rosfinmonitoring subsequently stated that "financing of the terrorist attack passed through numerous financial organizations using various tools, including cryptocurrency." By March 2025, the Investigative Committee reported completing its investigation with 27 defendants. No public reporting indicates that ABCeX was charged as a result.

Nine months later, on December 9, 2024, a joint operation by the FSB, the Ministry of Internal Affairs, and the Investigative Committee raided ABCeX across multiple locations, including the 52nd floor of Federation Tower. Equipment was seized. Criminal investigators recovered evidence of payment processing for illegal online casino operators — specifically 1win and 1xBet, two gambling platforms that operate outside Russian regulatory frameworks. Criminal cases were opened under Article 172 of the Russian Criminal Code (illegal banking operations) and Article 186 (counterfeiting and circulation of counterfeit monetary instruments or securities). Russian outlet TheIns.ru reported over $10 million seized across three weeks of raids. Rucriminal.info reported the daily money laundering volume at $10 million.

ABCeX resumed operations the following day. As of May 2026, no public charges have been filed against ABCeX's operators in connection with either the Crocus investigation or the December 2024 raids.

The resilience is itself evidence. An exchange that survives FSB raids and continues operating from the same building is not merely evading enforcement. It is operating within an environment that permits its continued existence — whether through corruption, institutional indifference, or a calculation that the exchange serves interests that extend beyond law enforcement's mandate.

Russian media coverage of the raids, reported by RBC, BFM, and RTVI, focused primarily on the illegal casino angle — the 1win and 1xBet payments — rather than the sanctions-evasion infrastructure. The Crocus connection received less coverage. The framing matters: an exchange busted for casino payments is a financial crime story. An exchange connected to terrorist financing and international sanctions evasion is a national security story. The Russian media largely told the first version.

Sledstvie.info, the Russian investigative outlet, published a series of five or more articles on ABCeX beginning in January 2025 — the most sustained Russian-language reporting on the exchange. Their coverage mapped the physical infrastructure, the personnel, and the financial flows in detail that Western analytics firms had not yet reached. Much of the source material for this investigation originates with Sledstvie.info and Rucriminal.info's reporting.

The Rebrand

In July 2025, a new cryptocurrency exchange called AEXBit appeared online. Its user interface was identical to ABCeX's. It offered the same limited selection of cryptocurrencies. It was promoted through the same Telegram channels. Its wallet addresses shared spending patterns with ABCeX wallets — the co-spending evidence that TRM Labs cited as indicating common control.

The pattern is not new. Garantex became Grinex. Grinex became a "hacked" shell. ABCeX is becoming AEXBit. Each iteration learns from the last. The rebranding cycle is accelerating: where Garantex operated for three years before sanctions, and Grinex for five months, ABCeX launched AEXBit while the original brand was still fully operational. The two run concurrently — a parallel deployment that ensures continuity of service even if one brand is designated.

Arvix LLC, registered in Tbilisi, Georgia in 2023, appears in the AEXBit infrastructure. TI Russia identifies Arvix as an alias or associated platform for ABCeX. The Georgian registration adds a third jurisdiction — Russia, Georgia, and the rebrand's domain infrastructure — creating the kind of cross-border complexity that slows enforcement action.

The serial rebranding strategy is now the defining feature of Federation Tower's crypto ecosystem: Suex to Chatex to Garantex to Grinex to ABCeX to AEXBit. Six brands, one continuous operation, one address.

The Designation — And Its Gaps

On May 26, 2026, the UK became the first Western government to sanction ABCeX. The designation was part of an eighteen-entity package — headlined by HTX (formerly Huobi), a global exchange suspected of channeling $1.5 billion to Russia, along with Exmo, Bitpapa, and the Kremlin-backed A7 payments network. It was historic: the first time Regulation 17A of the UK's Russia sanctions regime had been applied to cryptocurrency exchanges, requiring UK financial institutions to freeze funds and trace transactions across entire payment chains.

TRM Labs documented $355 million in bilateral exposure between ABCeX and sanctioned entities since 2023 — $133.4 million with Garantex, $175.2 million with Aifory Pro, $38.1 million with Rapira. Ninety-six percent of Aifory Pro's incoming funds originated from sanctioned sources. These figures dwarf the direct on-chain flows documented earlier in this investigation and confirm that ABCeX was not a peripheral participant in the sanctions-evasion ecosystem — it was load-bearing infrastructure.

The UK also designated Aifory LLC — the ABCeX subsidiary that Rucriminal described as "a money laundering service" and Elliptic treated as a connected but separate operation. Aifory's independent designation resolves a sourcing ambiguity: the UK government independently confirmed the operational relationship. Rapira Group LLC ($543 million in exposure) and Arvix LLC (the Georgian entity in AEXBit's infrastructure) were also designated. Sergey Mendeleev, already OFAC-sanctioned in August 2025, was designated by the UK in the same package.

Three gaps remain.

Gap 1: OFAC. The United States has not designated ABCeX. OFAC designated Bitpapa in March 2024 — a smaller exchange with less documented evidence — under Executive Order 14024. ABCeX meets the same criteria by every available metric. The evidentiary record is now reinforced by the UK's action, which provides an allied-government endorsement of the intelligence. The U.S. silence is harder to explain than it was a week ago.

Gap 2: AEXBit. The UK designated ABCeX through its parent company, Nueva Cryptologia S.A.S. de C.V., listing "ABCEX, ABCEX Exchange, ABCEX.io" as aliases. AEXBit is not listed as an alias or a separate entity. TRM Labs' co-spending analysis indicates common control — the same wallets service both brands. But the successor exchange that this investigation identified in v3 of this article, before the sanctions were announced, escaped the very sanctions package that targeted its predecessor. The rebranding strategy works as designed: the designation hits the old name while the new name, as of May 2026, remained accessible.

Gap 3: Paysol. The payment agent that bridges the successor ecosystem to the Russian banking system was not part of the UK package. Paysol LLC, run by Sergey Kunitsa, serves as the domestic payment agent for Exved. Paysol's wallets have directly interacted with sanctioned Garantex addresses. Kunitsa operates construction businesses in California and owns property in Florida. Neither Paysol nor Kunitsa is designated by any government. The full evidence is published separately in "The Kunitsa Dossier."

The deeper question is whether any designation changes anything. OFAC designated Garantex in April 2022. It continued operating for three more years. Its domains were seized in March 2025. Grinex appeared four days later. The successor was pre-registered. Now the UK has designated ABCeX. AEXBit was already running before the ink dried — promoted through the same Telegram channels, on the same wallets, from the same building.

The sanctions regime kills the brand. It does not kill the business. The address does not change.

This article is sourced to UK FCDO Russia sanctions designations (May 26, 2026), Elliptic's February 2026 report on Russian sanctions evasion, Elliptic's May 2026 designation analysis, TRM Labs' "The Imitation Game" analysis and May 2026 designation analysis, Chainalysis May 2026 sanctions report, Transparency International Russia / ICIJ / iStories' "Crypto Laundromat" investigation (September 2025), Rucriminal.info reporting (December 2024), Sledstvie.info reporting (January 2025), RBC and TheIns.ru raid coverage (2024), ForkLog reporting, the OFAC SDN list, and blockchain analytics data.

"The ABCeX File" is part of "The Address," a CrimsonVector investigation into Federation Tower Moscow.