Grinex Halts Trading After $13.7M Theft; State Hackers Suspected
Russia-linked crypto exchange Grinex halted trading after about $13.7 million was stolen; blockchain analysts report signs pointing to state-backed hackers.
Grinex suspended trading after attackers withdrew roughly 1 billion Russian rubles (about $13.7 million) from 54 exchange addresses. The platform said it has forwarded information to law enforcement and filed a criminal complaint at the site of its infrastructure.
Registered in Kyrgyzstan and linked to Russia’s crypto network, Grinex described the attack as showing an “unprecedented level of resources and technology available only to entities of hostile states.” The exchange took its trading system offline while investigators examine the breach.
Blockchain tracing firms tracked the stolen funds as USDT left Grinex wallets and was converted into TRON (TRX) and Ethereum (ETH). Elliptic traced about $15 million in USDT leaving Grinex accounts before conversion. The funds were moved into a single consolidation address that now holds 45.9 million TRX, roughly $15 million at current prices. Analysts note converting stablecoins into other tokens can reduce the chance of those funds being frozen.
TRM Labs identified 16 additional addresses linked to the incident beyond the 54 Grinex disclosed. The firm also found on-chain connections between Grinex and TokenSpot, another Kyrgyzstan-based exchange: two TokenSpot wallets sent about $5,000 to the same consolidation address. TokenSpot reported a brief outage on April 15 and said it resumed full operations the next day.
U.S. authorities have accused Grinex and predecessor platforms of helping entities evade sanctions and laundering proceeds for Russia-linked hackers. Grinex has been viewed as a successor to the sanctioned Garantex exchange and has been associated with trading A7A5, a ruble-backed stablecoin cited in sanctions-evasion investigations.
A Grinex spokesperson previously told reporters the platform condemns illegal activity, including sanctions evasion and money laundering. In its public notice about the incident, Grinex said it shared all available information with investigators.
Law enforcement and blockchain intelligence firms continue to follow the flows of the stolen funds across the Tron and Ethereum networks. Grinex did not provide a timetable for when trading would resume. In June 2025, Iran-based exchange Nobitex reported an $81 million theft that a hacking group claimed responsibility for.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
