Grinex, a Kyrgyzstan-registered exchange with ties to Russia’s crypto market, halted withdrawals and trading on Thursday following what it described as a "large-scale cyberattack" targeting its wallet infrastructure.
Accessing the exchange's website now displays a statement from Grinex claiming more than 1 billion rubles (nearly $13.1 million) had been stolen, framing the incident as a coordinated effort "with the aim of directly harming Russia's financial sovereignty."
The statement also alleges that the attack required "resources and technologies available exclusively" to "hostile state" actors and was aimed at restricting crypto flows out of the region.
Blockchain analytics firm Elliptic said the suspected attacker drained approximately $15 million in USDT from wallets linked to Grinex, higher than the $13.1 million figure initially cited by the exchange.
That USDT was then routed through addresses on the Tron and Ethereum networks before being converted into TRX and ETH.
Elliptic said that this conversion was likely to reduce the risk of the stolen funds being frozen by Tether, which retains the ability to blacklist USDT linked to illicit activity.
Grinex’s disclosure also points to a similar flow of funds. A wallet identified by the exchange shows a remaining balance of roughly 45.9 million TRX worth over $15 million, suggesting most of the stolen assets were consolidated after the initial transfers.
Grinex is seen by many as a successor to the sanctioned Garantex exchange, which was targeted by U.S. authorities last year for facilitating hundreds of millions of dollars in illicit flows tied to ransomware and darknet markets.
Days after Garantex’s shutdown, liquidity and users migrated to replacement platforms like Grinex.
Grinex and a handful of other platforms have since taken over as key venues for ruble-to-crypto trading, with Grinex in particular becoming a primary hub for the ruble-backed stablecoin A7A5, which Elliptic estimates has processed over $100 billion in transactions.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
