Cybersecurity — 2026-04-17

Sanctioned Russia-linked Grinex crypto exchange halts after $13M theft blamed on foreign services

Grinex, the Kyrgyzstan-registered crypto exchange designated by US Treasury in August 2025 as a Garantex successor used for sanctions evasion, suspended trading after a cyberattack drained roughly $13M worth of user funds. The exchange claimed the attack bore "signs of involvement by foreign intelligence services" and pointed to "structures of hostile states." Elliptic and TRM Labs tracked the stolen funds, swapped into TRX and consolidated into a single Tron wallet holding ~45.9M TRX, with Kyrgyzstan-based TokenSpot also affected in the same operation.

Analysis
Corroborated by Elliptic and TRM Labs, the consolidated ~45.9M TRX position and simultaneous TokenSpot exposure identify an operator-level intrusion by an actor with knowledge of shared infrastructure, updating the picture from Grinex's self-reported theft to independent forensic confirmation. Grinex's "foreign intelligence" framing almost certainly functions as domestic propaganda cover and liability pre-positioning for customer funds that will not be reimbursed. The two-hit sequence of OFAC designation in August 2025 followed by operational disruption validates that sanctions architecture can impose chronic friction without direct takedown, and a successor exchange in the same Kyrgyz or Kazakh jurisdiction very likely launches within 30 days.

4 sources