Image Credit: Unsplash
Grinex has suspended operations after a cyberattack drained about 1 billion rubles, or roughly $13.1 million to $15 million, from the Russia-linked exchange. On Thursday, the exchange said the theft hit its wallets while blockchain investigators tracking the incident put the on-chain outflow closer to $15 million.
The shutdown matters because Grinex is not just another small offshore venue. The Kyrgyzstan-based exchange has become an important crypto gateway for Russian users after Western pressure shut down its predecessor, Garantex. That gives the breach weight beyond the loss itself, especially because Grinex sits inside a sanctions-evasion network already under scrutiny from the US, the UK, and the EU.
The Exchange Cites Foreign Intelligence
In a statement posted to Telegram, Grinex said “foreign intelligence services” from unfriendly states were behind the attack and described it as an effort to damage Russia’s financial sovereignty. Grinex said it could not verify that claim, and outside blockchain analysts have not supported the attribution.
What investigators could confirm was the money trail. TRM Labs said the attacker converted stolen USDT on TRON into TRX through SunSwap. The proceeds were moved into a single address holding about 45.9 million TRX, worth roughly $15 million at the time of TRM’s analysis. Elliptic separately said the stolen funds moved out around 12:00 UTC on Wednesday through TRON and Ethereum (ETH) before being converted into other assets, a step that lowered the risk of a Tether freeze.
The Breach Hit a Sanctioned Garantex Successor
Grinex’s link to Russia is central to the story. OFAC said in August 2025 that Garantex employees created Grinex after US-led action disrupted Garantex in March 2025, moving customer deposits and services to the new venue so operations could continue. Treasury said Grinex helped customers regain access to frozen balances through A7A5, a ruble-backed digital asset tied to a broader sanctions-evasion network.
That leaves Grinex facing two problems at once. The exchange has lost millions in customer assets and halted trading, but the breach also exposes how fragile the crypto infrastructure can be that Russia has used to keep trade and capital moving outside the Western banking system. A wallet theft that shuts down the exchange undercuts the resilience the platform was built to provide.
Categories:
Fhumulani Lukoto
Cryptocurrency Journalist
Fhumulani Lukoto holds a Bachelors Degree in Journalism enabling her to become the writer she is today. Her passion for cryptocurrency and bitcoin started in 2021 when she began producing content in the space. A naturally inquisitive person, she dove head first into all things crypto to gain the huge wealth of knowledge she has today. Based out of Gauteng, South Africa, Fhumulani is a core member of the content team at Coin Insider.