Sanctioned crypto trade Grinex mentioned it has suspended buying and selling after dropping greater than 1 billion Russian rubles ($13.7 million) to an assault bearing indicators of involvement by international intelligence companies.
The trade, which is registered in Kyrgyzstan however has been linked to Russia’s crypto ecosystem and alleged sanctions evasion, mentioned on Thursday that the funds have been taken from 54 addresses and that the digital footprint and nature of the assault point out an “unprecedented degree of assets and expertise out there solely to entities of hostile states.”
“As a result of assault, the Grinex trade has been compelled to droop operations. All out there data has been transferred to regulation enforcement companies. A prison grievance has been filed on the location of the infrastructure,” it added.
Grinex had been broadly seen because the successor to the equally sanctioned Garantex trade. Each have been accused by US authorities of helping Russia and different entities in evading sanctions and laundering funds for Russia-linked hackers.
Elliptic founder Tom Robinson has accused it of being the first platform for buying and selling A7A5, a ruble-backed stablecoin linked to sanctions evasion.
A Grinex spokesperson instructed Cointelegraph final yr that it strongly condemns any type of criminal activity, together with sanctions evasion and cash laundering.
One other trade might need been hit by the identical attacker
Grinex could not have been the one trade focused. Blockchain intelligence firm TRM Labs mentioned on Thursday that two wallets from TokenSpot, a Kyrgyzstan-based trade with on-chain hyperlinks to Grinex, despatched round $5,000 to the identical consolidation handle utilized by the Grinex attacker.
TokenSpot’s Telegram channel introduced technical work and a quick platform outage on April 15, adopted the subsequent day by an announcement that it had resumed full operations.
On the identical time, TRM Labs mentioned it has recognized 16 further addresses linked to the incident along with these Grinex publicly disclosed. The consolidation handle the place all of the funds have been despatched incorporates 45.9 million TRON (TRX), price almost $15 million.
Hacker might need stolen $15 million in USDT
Blockchain analytics agency Elliptic mentioned it tracked about $15 million in USDt (USDT) leaving Grinex accounts. The funds have been then despatched to accounts on the Tron or Ethereum blockchains.
Associated: Ukraine arrests FBI-wanted cybercrime suspect, seizes $11M in belongings
“This USDT was then transformed to a different asset, both TRX or ETH. By doing so, the thief averted the danger of the stolen USDT being frozen by Tether,” the corporate mentioned.
This isn’t the primary time an trade accused of serving to entities evade US sanctions has been focused. Iran-based trade Nobitex had $81 million drained in June 2025, with a pro-Israel hacker group claiming duty.
Journal: Singapore isn’t a ‘crypto hub’ — it’s one thing higher: StraitsX CEO