Grinex Hacked: Exchange Loses Around $15M and Halts Operations

Key Points

• Grinex, a sanctioned exchange believed to be a successor to Garantex and a major crypto financial channel tied to Russia, lost around $15 million in a cyberattack on April 16, 2026.
• Roughly 70 addresses were linked to the incident—about 16 more than Grinex publicly disclosed. All known stolen funds were converted into TRX via SunSwap and consolidated into a single TRON address.
• TokenSpot, believed to act as a front for Garantex, was also impacted. Two of its addresses sent funds to the same consolidation wallet used in the Grinex attack. Both were deactivated on April 15, suggesting a possible single attacker behind both incidents.

• The breach affected two exchanges that play a central role in a broader sanctions evasion network tied to Russia, which has processed hundreds of billions of dollars in transactions linked to state-aligned financial activity.

What Grinex and TokenSpot Said

Grinex published a list of 54 wallet addresses allegedly tied to the attacker and said it had shared the data with law enforcement. The company claimed the attack was carried out by “special services of unfriendly states,” framing it as part of a broader effort to undermine Russia’s financial sovereignty. These claims have not been independently verified.

TokenSpot’s Telegram channel reported “technical maintenance” and a brief outage on April 15, followed by a full recovery announcement the next day. Blockchain data later identified two TokenSpot addresses that sent funds to the same consolidation wallet used in the Grinex incident, linking the two events.

Why the Tron blockchain became infrastructure for the shadow crypto economy

“Pig butchering” scams rely on Tron thanks to near-zero fees and transaction speeds of about 3 seconds. This allows criminals to move stolen funds through dozens of wallets before the victim even realizes the money is gone

Читать дальше

What Blockchain Analysis Shows

Analysis identified around 70 addresses connected to the attack—significantly more than disclosed by Grinex. Most stolen assets were USDT on the TRON network.

The attacker converted the funds into TRX and consolidated them into a single wallet. At the time of writing, that address had received about 45.9 million TRX, equivalent to roughly $14.98 million.

Losses linked to TokenSpot were minimal—under $5,000—and were also sent to the same address.

Four Ethereum addresses were also tied to the incident. The purpose of those transactions remains under investigation.

Grinex: A Sanctioned Exchange with Russian Ties

Grinex was registered in Kyrgyzstan in December 2024, just weeks before an international law enforcement operation in March 2025 shut down Garantex—one of the highest-risk crypto exchanges globally.

Within days, Garantex-linked Telegram channels began promoting Grinex, offering “familiar functionality” and actively onboarding former users to recover frozen assets.

Which platforms help Russia evade sanctions: a complete list

We examine cryptocurrency platforms used for cross-border settlements that bypass sanctions. The report is based on blockchain analytics and reveals specific connections, transaction volumes, and operational infrastructure.

Читать дальше

On August 14, 2025, OFAC sanctioned Grinex along with key figures behind Garantex and token issuer Old Vector. The exchange was described as a continuation of Garantex’s sanctions evasion infrastructure.

Before its shutdown, Garantex processed over $100 billion in transactions, with 82% linked to sanctioned entities despite being under OFAC sanctions since April 2022.

How Garantex splits business and what does AEXbit have to do with it

Russian-sanctioned crypto exchange Garantex (Grinex) has split its financial flows using third-party platforms

Читать дальше

A key component of Grinex’s operations was A7A5, a ruble-backed stablecoin issued by Old Vector. Garantex wallets began shifting funds into A7A5 as early as January 2025, suggesting premeditated restructuring. Former users received A7A5-denominated credits tied to their frozen balances, which could be used on Grinex.

TokenSpot: A Regional Hub with Global Links

TokenSpot, also registered in Kyrgyzstan, processed over $4 billion in transactions between December 2023 and March 2026—far exceeding typical retail exchange volumes in the region.

Blockchain data suggests TokenSpot functions as a front for Garantex, based on overlapping transaction patterns and shared infrastructure.

Financial ties are direct: TokenSpot sent about $88 million to Garantex and Grinex, and received over $12 million back from Grinex. Its largest counterparty is A7, a sanctions evasion network forming the backbone of Russia’s parallel financial system. TokenSpot alone sent over $257.5 million to A7.

Its exposure goes beyond this ecosystem. Nearly $1 million was traced from an OFAC-sanctioned wallet linked to money laundering for the Houthis. That wallet is associated with Afghan businessmen based in Russia, reportedly involved in arms procurement and the trade of stolen Ukrainian grain.

Ruble-pegged stablecoin A7A5 under scrutiny: overview of the new EU sanctions package

EU authorities have expanded restrictive measures against the ruble-pegged stablecoin A7A5 and related infrastructure due to its use to circumvent anti-Russian sanctions

Читать дальше

TokenSpot has also been linked to payments tied to the InfoLider operation—a pro-Russian influence campaign in Moldova, where participants were reportedly paid to promote narratives and take part in anti-government protests.