A major cyber attack has forced the Russia-linked cryptocurrency exchange Grinex to suspend all trading and withdrawal services. The exchange, registered in Kyrgyzstan, announced the halt on Thursday following what it described as a "large-scale cyberattack" targeting its wallet infrastructure.
The exchange claims the attack resulted in the theft of approximately 1 billion Russian rubles, valued at roughly $13 million to $15 million. In an official statement, Grinex framed the incident as a coordinated assault by "foreign intelligence services" or "hostile state" actors, alleging the "digital footprints" and sophistication of the hack pointed to resources and technology available only to such entities. The statement further claimed the operation was designed "with the aim of directly harming Russia's financial sovereignty" and restricting cryptocurrency flows out of the region.
Blockchain intelligence firm Elliptic provided on-chain analysis, confirming the suspected attacker drained approximately $15 million in USDT (Tether) from wallets linked to Grinex. The stolen USDT was then routed through addresses on the Tron and Ethereum networks before being converted into TRX (Tron) and ETH (Ethereum). Elliptic noted this conversion was likely an attempt to reduce the risk of the stolen stablecoins being frozen by Tether, which retains the ability to blacklist USDT linked to illicit activity.
Elliptic also detailed Grinex's connections to the broader Russian crypto ecosystem. The firm described Grinex as one of the largest venues for exchanging Russian rubles into crypto assets and identified it as a primary platform for trading A7A5, a ruble-backed stablecoin created as part of Russian sanctions-evasion efforts. Elliptic estimates A7A5 has processed over $100 billion in transactions.
Furthermore, Elliptic connected Grinex's rise to the sanctioned Russian exchange Garantex. Grinex is seen as a likely successor to Garantex, which was targeted by the U.S. Treasury's Office of Foreign Assets Control (OFAC) for laundering "hundreds of millions of dollars" tied to ransomware, darknet markets, and state-sponsored hackers. After Garantex was shut down, much of its liquidity and user base migrated to Grinex, with Elliptic suggesting the platforms share common ownership and management.
