Grinex, a sanctioned crypto alternate serving Russian companies and particular person customers, stated it was hit by a large-scale cyberattack that resulted within the theft of funds price greater than 1 billion rubles from its customers’ wallets.
The alternate described the incident as a focused operation and claimed there have been indications of involvement by international intelligence businesses. It stated the technical footprint and scale of the assault recommended the usage of superior sources usually obtainable to state-backed actors.
Following the breach, Grinex suspended its operations.
Laundering Route Uncovered
In its official replace, the alternate revealed that each one related info has been handed over to legislation enforcement authorities. A legal criticism has additionally been filed on the location of its infrastructure. Grinex said the assault led to complete damages estimated at round 13.74 million USDT.
Blockchain analytics agency TRM Labs reported round 70 addresses related to the hack, which is about 16 greater than what Grinex publicly disclosed. In response to the findings, all stolen property had been swapped into TRX by means of SunSwap and later pooled right into a single TRON deal with.
The report additionally says TokenSpot, which TRM discovered to be a possible entrance linked to Garantex, was affected across the identical time. Two of its wallets despatched funds to the identical consolidation deal with utilized by Grinex-linked wallets. Each platforms reportedly went offline on 15 April, which signifies that they could have been focused by the identical attacker.
Grinex was arrange in Kyrgyzstan in December 2024, simply weeks earlier than a coordinated legislation enforcement operation in March 2025 that took down Garantex, a crypto alternate beforehand flagged for high-risk exercise. Quickly after Garantex was shut down, Telegram channels related to it started directing customers towards Grinex and offered it as a substitute platform with related options. These channels additionally inspired former prospects emigrate in an effort to regain entry to frozen funds.
This led the US Treasury’s OFAC to impose sanctions on Grinex, together with people linked to Garantex and the issuer of the A7A5 token, Previous Vector, that very same 12 months. Earlier than its closure, Garantex had processed over $100 billion in transactions whereas beneath sanctions since 2022.
The report additionally make clear the usage of A7A5, a ruble-pegged stablecoin issued by Previous Vector. In response to the findings, Garantex wallets started transferring funds into A7A5 in early 2025, earlier than enforcement motion started. After the shutdown, former customers had been issued A7A5 credit on Grinex equal to their frozen balances, permitting them to proceed transactions by means of the brand new system.
Russia-Linked Illicit Exercise
An earlier report by the platform discovered that illicit crypto inflows jumped in 2025, with about $158 billion flowing into suspicious wallets. The rise was primarily linked to Russia-related exercise and improved monitoring strategies. Regardless of the rise, illicit transactions nonetheless made up solely round 1.2% of complete on-chain quantity.
A7A5 was the biggest contributor, which introduced in about $72 billion in incoming worth. One other $39 billion was linked to the A7 pockets cluster. Most of this exercise was tied to Garantex, Grinex, and A7.
The put up Garantex Successor Grinex Collapses Days After Coordinated Pockets Exploit appeared first on CryptoPotato.