Grinex, a Kyrgyzstan-incorporated cryptocurrency trade sanctioned by the U.Ok. and the U.S. final 12 months, stated it is suspending operations after it blamed Western intelligence companies for a $13.74 million hack.
The trade stated it fell sufferer to what it described as a large-scale cyber assault that bore hallmarks of international intelligence company involvement. This assault led to the theft of over 1 billion rubles in consumer funds.
“Digital forensic proof and the character of the assault level to an unprecedented degree of assets and technological sophistication – capabilities sometimes out there solely to the companies of hostile states,” the corporate stated in a press release posted on its web site. “Preliminary findings counsel the assault was coordinated with the precise goal of inflicting direct injury upon Russia’s monetary sovereignty.”
A spokesperson for the corporate went on to state that the trade’s infrastructure had been below assault for the reason that starting of its operations, and that the most recent growth represents a brand new degree of escalation aimed toward destabilising the home monetary sector.
Grinex is believed to be a rebrand of Garantex, a cryptocurrency trade that was sanctioned by the U.S. Treasury Division in April 2022 for laundering funds linked to ransomware and darknet markets like Conti and Hydra. The Treasury renewed sanctions in opposition to Garantex in August 2025 for processing greater than $100 million in illicit transactions and enabling cash laundering.
In response to the Treasury and particulars shared by blockchain intelligence corporations Elliptic and TRM Labs, Garantex is alleged to have moved its buyer base to Grinex in response to the sanctions and remained operational through the use of a ruble-backed stablecoin known as A7A5.
In a report revealed earlier this February, Elliptic additionally disclosed that Rapira, a Georgia-incorporated trade with an workplace in Moscow, has engaged in direct cryptoasset transactions to and from Grinex totaling greater than $72 million, highlighting how exchanges with ties to Russia proceed to allow sanctions evasion.
The British blockchain analytics agency stated the Grinex asset theft occurred on April 15, 2026, at round 12:00 UTC, and that the stolen funds had been subsequently despatched to additional accounts on the TRON or Ethereum blockchains. “This USDT was then transformed to a different asset, both TRX or ETH. By doing so, the thief prevented the chance of the stolen USDT being frozen by Tether,” it added.
TRM Labs has recognized about 70 addresses related to the incident, noting that TokenSpot, a Kyrgyzstan-based trade that doubtless operates as a entrance for Grinex, was concurrently impacted.
On the identical day Grinex suffered the breach, TokenSpot posted on its Telegram channel that the platform can be quickly unavailable resulting from technical upkeep. On April 16, it introduced that full operations had resumed. The attacker is estimated to have stolen lower than $5,000 from TokenSpot. The funds had been routed by two TokenSpot addresses to the identical consolidation handle utilized by the Grinex-linked wallets.
Chainalysis, in its personal breakdown of the incident, stated the stablecoin funds had been rapidly swapped for a non-freezable token and that this “frantic swapping” from stablecoins to extra decentralized tokens is a tactic adopted by dangerous actors to launder their illicit proceeds earlier than the belongings could be frozen.
“Given the trade’s closely sanctioned standing, its restricted ecosystem, and the on-chain use of Garantex’s most popular obfuscation methods, it’s price contemplating if this incident may very well be a false flag assault,” it stated. “Whether or not this occasion represents a professional exploit by cybercriminals or an orchestrated false flag operation by Russia-linked insiders, the disruption of Grinex offers a big blow to the infrastructure supporting Russian sanctions evasion.”
