Grinex Hack Gets Uglier: $13M Gone, and the Story Keeps Unraveling

Just days after the initial reports, the Grinex cyber incident continues to ripple through the crypto ecosystem — highlighting the precarious position of sanctioned platforms that serve as lifelines for users in restricted jurisdictions. What began as a sudden operational halt has now been dissected by blockchain analytics firms, revealing a sophisticated $13 million drain that underscores ongoing vulnerabilities in the shadow crypto economy.

On April 16, Grinex,  that Kyrgyzstan-registered exchange but Russia-linked exchange, pulled the plug on everything. No trading, no deposits, no withdrawals. The reason? A massive cyberattack that, by their own admission, cleaned out over 1 billion rubles (around $13.7 million, give or take) from user wallets. Most of those users, unsurprisingly, were Russian.

On-chain data paints a slightly higher figure: blockchain intelligence firms Elliptic and TRM Labs tracked approximately $15 million in USDT drained from Grinex-linked addresses around 12:00 UTC on April 16.

https://twitter.com/trmlabs/status/2044891139912728804?ref_src=twsrc%5Etfw” target=”_blank” rel=”noopener

Grinex quickly published a list of the 54 compromised wallets and transferred all available logs to law enforcement agencies. According to detailed tracking:

• The stolen USDT (largely on the Tron blockchain/TRC-20) was rapidly routed through intermediary addresses on Tron and Ethereum.
• Funds were swapped — often via the SunSwap decentralized exchange — into TRX (Tron’s native token) and in some cases ETH. This conversion appears designed to sidestep potential freezing by Tether, which can blacklist illicit USDT.
• The assets were ultimately consolidated into a single identifiable Tron wallet: TH9kgjfrKeTNeyXtDKvxCXZ1dVKr7neKVa, which currently holds approximately 45.9 million TRX (valued at roughly $15 million at the time of consolidation).

TRM Labs went further, identifying around 70 addresses tied to the incident — 16 more than Grinex publicly disclosed — and flagged that a related Kyrgyzstan-based platform, TokenSpot (with deep on-chain ties to Grinex), was likely hit in the same coordinated operation. Two TokenSpot addresses funneled small test amounts to the same consolidation wallet before going offline.

Grinex is blaming the CIA (basically)

Grinex came out swinging in their official statement. They’re pointing fingers at “foreign intelligence services of unfriendly states” and “Western special services” — claiming the attack shows “an unprecedented level of resources and technology” that only a hostile government could pull off.

Their framing is that this wasn’t theft. It was an act of financial warfare aimed at choking Russia’s crypto-ruble pipeline outside the traditional banking system.

Here’s the problem: no independent evidence supports it. Elliptic, TRM Labs, Chainalysis — none of the serious analytics firms are endorsing the state-actor story. And some of what is visible on-chain looks an awful lot like regular old cybercrime. The quick pivot to non-freezable TRX, the consolidation into one wallet, the laundering structure — these are moves criminals make every day. Could be a nation-state. Could just as easily be an exit scam dressed up in patriotic language. The jury’s out.

About Grinex’s origin story

If the name Grinex doesn’t ring immediate alarm bells, here’s the short version: it’s basically Garantex wearing a new hat.

Garantex is the infamous Russian-linked exchange sanctioned by the U.S. Treasury in 2022 for facilitating ransomware, darknet markets, and sanctions evasion. After Garantex’s infrastructure was disrupted in early 2025, user funds, liquidity, and even the ruble-pegged A7A5 stablecoin migrated en masse to Grinex. The platform itself was hit with fresh U.S., U.K., and EU sanctions in August 2025 for continuing those activities.

Chainalysis and TRM Labs have repeatedly flagged Grinex (and its ecosystem) as a critical node in Russia’s parallel financial infrastructure, processing billions in flows tied to sanctions circumvention. This high-profile role makes it a persistent target — whether from external hackers, geopolitical adversaries, or internal pressures.

What this actually means for the rest of us

It’s easy to shrug this off as “sanctioned exchange gets hacked, who cares.” But there are real lessons that expose systemic risks for anyone using or relying on sanctioned or semi-sanctioned venues:

• User funds remain vulnerable even on centralized platforms operating in gray zones. “Not your keys, not your coins” has never been more relevant.
• Geopolitical crypto warfare is intensifying. Sanctioned entities become magnets for sophisticated attacks, and attribution battles (state actor vs. opportunist) complicate recovery.
• Laundering patterns persist: The rapid move to TRX and consolidation into one wallet provides investigators a clear trail — but also shows how quickly stolen funds can be obfuscated in 2026’s DeFi/CeFi landscape.
• Broader 2026 trend: This incident joins a wave of high-value exploits (including the recent Drift Protocol case), underscoring that security and compliance gaps remain exploitable amid rising institutional and regulatory scrutiny.

Where things stand right now

As of today, April 18, Grinex is still fully offline. No recovery timeline. No compensation plan. Nothing for users except a public statement and a wallet list.

The consolidation wallet hasn’t moved meaningfully yet, but analysts are watching it around the clock for any signs of the funds heading into mixers, bridges, or exchanges.

This story is developing. We’ll continue tracking wallet movements, any law enforcement updates, and potential user recovery efforts. In the meantime, the Grinex case serves as a cautionary tale: in the world of sanctioned crypto platforms, the risks are as persistent as the innovation. DYOR and prioritize self-custody where possible.

Also Read: Circle Launches USDC Bridge Amid Drift’s USDT Switch Post-$280M Hack