Grinex Halts Trading After $13M Hack Blamed on Western Intel

Grinex, a Russian cryptocurrency exchange, halted trading after reporting a hack that removed more than 1 billion rubles (about $13 million). The company reported it detected the incident on Thursday and paused all exchange activity while it works with law enforcement to open a criminal case.

The exchange posted on its Telegram channel that the attack targeted its infrastructure and the assets of Russian businesses and individuals. Its statement described a “large-scale cyberattack with signs of the involvement of foreign special services” and said the incident was intended to harm Russia’s financial sovereignty.

Blockchain intelligence firm Elliptic identified roughly $15 million in USDT leaving Grinex after the exploit. Some of those funds were converted to ether on the Ethereum blockchain and to TRX on the Tron blockchain, according to Elliptic.

Elliptic linked Grinex to the earlier exchange Garantex, saying Grinex uses the “same fingerprint” as Garantex. Garantex was seized last year by the U.S. Secret Service amid allegations of ties to sanctioned Russian banks and criminal groups.

Grinex serves as a primary venue for trading the ruble-backed stablecoin A7A5. Elliptic has described the token as created as part of a sanctions-evasion effort and said A7A5 has handled transfers totaling more than $100 billion. The exchange also reported prior attempts to limit cryptocurrency withdrawals outside the Commonwealth of Independent States, including placement on sanctions lists, marked wallets and blocked transactions.

The U.S. Secret Service declined to comment on ongoing investigations. Grinex has not identified a specific perpetrator in its public statement and provided no external evidence. The exchange said it will continue to cooperate with authorities while it investigates the theft and works to restore operations.