Sanctioned crypto exchange Grinex said it has suspended trading after losing more than 1 billion Russian rubles (about $13.7 million) in an attack that it says shows signs of involvement by foreign intelligence agencies. The exchange, registered in Kyrgyzstan but linked to Russia’s crypto ecosystem and accused of facilitating sanctions evasion, reported the funds were taken from 54 addresses and said the digital footprint and nature of the attack indicate an “unprecedented level of resources and technology available only to entities of hostile states.”
“Due to the attack, the Grinex exchange has been forced to suspend operations. All available information has been transferred to law enforcement agencies. A criminal complaint has been filed at the location of the infrastructure,” the company said.
Grinex has been widely viewed as the successor to the sanctioned Garantex exchange; both have been accused by U.S. authorities of assisting Russia and others in evading sanctions and laundering funds for Russia-linked hackers. Elliptic founder Tom Robinson has accused Grinex of being the main platform for trading A7A5, a ruble-backed stablecoin linked to sanctions evasion. Grinex previously said it condemns illegal activity, including sanctions evasion and money laundering.
Blockchain intelligence firm TRM Labs said two wallets from TokenSpot, a Kyrgyzstan-based exchange with on-chain links to Grinex, sent around $5,000 to the same consolidation address used by the Grinex attacker. TokenSpot reported technical work and a brief outage on April 15 and said it resumed full operations the next day. TRM Labs also identified 16 additional addresses tied to the incident beyond those Grinex publicly disclosed. The consolidation address holding the stolen funds contains 45.9 million TRON (TRX), worth nearly $15 million.
Elliptic tracked roughly $15 million in USDT leaving Grinex accounts, with the funds then sent to accounts on the Tron or Ethereum blockchains. The firm said the USDT was converted to TRX or ETH to avoid the risk of the stolen USDT being frozen by Tether.
This is not the first time exchanges accused of aiding sanctions evasion have been targeted. Iran-based exchange Nobitex had $81 million drained in June 2025, with a pro-Israel hacker group claiming responsibility.
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently. Read our Editorial Policy https://cointelegraph.com/editorial-policy