Sanctioned Grinex Exchange Shuts Down After $14M Heist Linked to State-Level Actors

Grinex, a Russia-linked crypto exchange operating from Kyrgyzstan, has suspended all trading following a sophisticated attack that drained over 1 billion Russian rubles ($13.7 million) from the platform. The exchange claims the breach bears hallmarks of state-sponsored activity, citing the "unprecedented level of resources and technology available only to entities of hostile states."

The Attack Details

The attackers targeted 54 addresses on Grinex, extracting funds with precision that suggests professional-grade infrastructure. The exchange filed a criminal complaint and transferred evidence to law enforcement, but the damage was already done. What makes this breach particularly notable is the digital fingerprint—authorities believe the sophistication level points directly to foreign intelligence involvement rather than typical cybercriminals.

Blockchain intelligence firms uncovered even more troubling details. Elliptic tracked approximately $15 million in USDT leaving Grinex accounts, which the attackers then converted to TRX (Tron) or ETH (Ethereum) to sidestep Tether's freeze capabilities. TRM Labs identified 16 additional addresses connected to the incident beyond those publicly disclosed by Grinex. The consolidation address holding stolen funds contains 45.9 million TRON tokens—worth nearly $15 million alone.

A Broader Target?

Grinex wasn't operating in isolation. TRM Labs discovered that TokenSpot, another Kyrgyzstan-based exchange with on-chain connections to Grinex, sent approximately $5,000 to the same consolidation address used by the Grinex attacker. TokenSpot announced technical maintenance on April 15, followed by a "full operations resume" announcement the next day—timing that raises questions about whether it was also compromised.

Why Grinex Matters in Crypto Trading

Grinex's shutdown carries significance beyond a routine exchange hack. US authorities have accused the platform of being a critical node for sanctions evasion, helping Russia and other entities launder funds while trading ruble-backed stablecoins like A7A5. The exchange effectively inherited the role previously held by Garantex—another sanctioned platform shut down by regulatory pressure.

Elliptic founder Tom Robinson flagged Grinex as the primary trading venue for A7A5, reinforcing its importance in Russia's crypto ecosystem. Despite a spokesperson claiming the exchange "strongly condemns any form of illegal activity," the platform's regulatory status and operational patterns told a different story to market observers.

The Escalating Pattern

This incident follows a troubling trend. Iran-based exchange Nobitex suffered an $81 million drain in June 2025, with a pro-Israel hacker group claiming responsibility. When exchanges become infrastructure for sanctions circumvention, they apparently become targets—whether by state actors, ideologically-motivated hackers, or opportunistic criminals.

The fact that attackers converted stolen USDT to alternative assets demonstrates sophisticated understanding of blockchain intelligence and Tether's freeze mechanisms. This isn't amateur-hour crypto theft; it's calculated, methodical extraction by actors with technical depth.