Russia-linked Grinex exchange halts operations after $13 million ‘state-backed’ hack

The exchange, formerly known as Garantex and based in Kyrgyzstan, has been sanctioned by the U.S., U.K. and EU for helping users bypass sanctions.

What to know:

• Grinex cryptocurrency exchange suspended operations after a cyber attack drained about 1 billion rubles ($13 million) from its systems, which the platform attributed to state-backed actors.
• The exchange, formerly known as Garantex and based in Kyrgyzstan, has been sanctioned by the U.S., U.K., and EU for helping users bypass sanctions.
• Users are unable to access their funds while the company investigates, with 54 affected wallet addresses containing mostly USDT on the Tron blockchain.

Grinex, a cryptocurrency exchange popular with sanctions-avoiding Russians, suspended operations after saying a cyber attack drained about 1 billion rubles ($13 million) from its systems.

The platform, based in Kyrgyzstan, disclosed the breach on its Telegram channel and a statement on its website. It said the attack showed a level of coordination and technical skill that points to state-backed actors from “unfriendly states.”

“The digital footprints and nature of the attack indicate an unprecedented level of resources and technology available exclusively to the structures of unfriendly states,” the Grinex statement reads. “According to preliminary data, the attack was coordinated with the goal of inflicting direct damage on Russia's financial sovereignty.”

Grinex itself was placed under sanctions by the U.S., U.K. and European Union last year. Officials in Washington D.C. have said the exchange, originally known as Garantex, helped users move funds around restrictions through a ruble-backed stablecoin known as A7A5.

The token allowed cross-border payments when Russia’s access to the Swift inter-bank messaging system was cut off over the country’s invasion of Ukraine. Shortly after being taken down, the platform resurfaced as Grinex.

The pause in trading leaves users unable to access funds while the company investigates. Access to its office in Moscow was also restricted.

Grinex has published a list of 54 affected wallet addresses and the drained amounts, most of which were in the form of USDT on the TRON blockchain.

More For You

The money will be used by Drift to recover user funds after more than $270 million in clients assets were exploited this month, and will relaunch the protocol as a USDT-based perpetuals DEX on Solana.

What to know:

• Tether proposes up to $127.5 million, and other partners propose up to $20 million, to back the recovery of user funds and the protocol's relaunch.
• Drift to use USDT as its core settlement layer, with incentives and liquidity support, replacing Circle's USDC.
• The revenue-linked structure of the funding aims to...

Bitcoin stalls below $76,000 as sell wall caps rally despite rising derivatives activity

29 minutes ago

The 4.5 signal: Why Glassnode’s RHODL ratio says the bitcoin bottom may be in

1 hour ago

Ethereum just had its busiest quarter ever, capping a three-year comeback

3 hours ago

This simple indicator has called every bottom since 2015. It hasn't triggered yet

3 hours ago

The U.S. government moves $606,000 in bitcoin linked to the 2016 Bitfinex hack to Coinbase

6 hours ago

XRP leads bitcoin and ether on weekly gains, but muted volume keeps breakout in check

6 hours ago

Bitcoin bulls target $125,000 as U.S.-Iran peace talks trigger risk-on mood

7 hours ago

U.S. CFTC's Selig says AI has helped make up for staffing cuts at key crypto watchdog

18 hours ago

Cardano's Charles Hoskinson says Bitcoin's quantum fix is a hard fork that can't save Satoshi's coins

18 hours ago

Bitcoin devs bet a quantum attacker will play nice with a ‘wait and react’ plan

Apr 16, 2026