Russia-linked Grinex exchange suspends operations after $15 million hack, blames ‘hostile states’

Grinex, a Kyrgyzstan-registered exchange with ties to Russia’s crypto market, halted withdrawals and trading on Thursday following what it described as a “large-scale cyberattack” targeting its wallet infrastructure.

Accessing the exchange’s website now displays a statement from Grinex claiming more than 1 billion rubles (nearly $13.1 million) had been stolen, framing the incident as a coordinated effort “with the aim of directly harming Russia’s financial sovereignty.”

The statement also alleges that the attack required “resources and technologies available exclusively” to “hostile state” actors and was aimed at restricting crypto flows out of the region.

Onchain flows

Blockchain analytics firm Elliptic said the suspected attacker drained approximately $15 million in USDT from wallets linked to Grinex, higher than the $13.1 million figure initially cited by the exchange.

That USDT was then routed through addresses on the Tron and Ethereum networks before being converted into TRX and ETH.

Elliptic said that this conversion was likely to reduce the risk of the stolen funds being frozen by Tether, which retains the ability to blacklist USDT linked to illicit activity.

Grinex’s disclosure also points to a similar flow of funds. A wallet identified by the exchange shows a remaining balance of roughly 45.9 million TRX worth over $15 million, suggesting most of the stolen assets were consolidated after the initial transfers.

Successor to Garantex

Grinex is seen by many as a successor to the sanctioned Garantex exchange, which was targeted by U.S. authorities last year for facilitating hundreds of millions of dollars in illicit flows tied to ransomware and darknet markets.

Days after Garantex’s shutdown, liquidity and users migrated to replacement platforms like Grinex.

Grinex and a handful of other platforms have since taken over as key venues for ruble-to-crypto trading, with Grinex in particular becoming a primary hub for the ruble-backed stablecoin A7A5, which Elliptic estimates has processed over $100 billion in transactions.