Russian cryptocurrency exchange Grinex hacked for 1 billion rubles!
Officially announces indefinite suspension of operations, impacting Russia's financial hedging channels

Russian Cryptocurrency Exchange Hub Falls! According to on-chain data and official statements, the exchange Grinex, closely linked to Russia, was hit by a large-scale hacker attack last Wednesday (16th), resulting in losses of up to 1 billion rubles (about 15 million USD). As the successor to the sanctioned giant Garantex, Grinex’s collapse has caused a severe impact on Russia’s cross-border payments and ruble exchange channels.
(Background: Elliptic reveals 5 exchanges helping Russia evade sanctions: ABCeX alone handles $11 billion in transactions)
(Additional context: Russia, expelled from SWIFT, has been forced to build a crypto economy network)

Table of Contents

Toggle

• On-chain funds rapidly laundered, USDT becomes the main target
• Official statement: Accuses Western intelligence agencies of damaging “financial sovereignty”
• Garantex successor falls, impacting Russia’s hedging channels

Against the backdrop of intertwined geopolitical and cyber warfare, Russia’s crypto ecosystem suffers another heavy blow.

The cryptocurrency exchange Grinex, registered in Kyrgyzstan and with close ties to Russia, was subjected to a large-scale cyber attack around April 16th (Wednesday). It is reported that this attack resulted in approximately 1 billion rubles (about 13 to 15 million USD) being looted, after which the platform announced a full suspension of operations.

On-chain funds rapidly laundered, USDT becomes the main target

According to blockchain analysis, after the attack, a large amount of funds (mainly USDT) was quickly withdrawn from wallets associated with Grinex. The hackers used multi-layer routing through the Tron (TRON) and Ethereum networks, rapidly converting the funds into TRX and ETH to avoid potential freezing actions by issuers.

Currently, blockchain analysis firms like Elliptic and Chainalysis are involved in monitoring and attempting to trace the movement of these stolen millions of dollars.

Official statement: Accuses Western intelligence agencies of damaging “financial sovereignty”

Grinex later issued a statement on its official Telegram channel, elevating the attack to a “national security” level. The statement pointed out that the attack demonstrated a high level of technical skill and resources, with features characteristic of “hostile foreign intelligence agencies” (implying Western intelligence services).

The official claim is that the attack aimed to “damage Russia’s financial sovereignty,” and relevant information has been handed over to law enforcement agencies. As a result, Grinex announced the suspension of all trading, withdrawals, and operations, and has not announced a timeline for recovery, leaving many Russian users’ assets frozen and inaccessible.

Garantex successor falls, impacting Russia’s hedging channels

The fall of Grinex has attracted significant market attention due to its unique political positioning. Industry insiders generally believe that Grinex is the “successor” that took over the liquidity and user base after the closure of Garantex, an exchange under joint sanctions by the US, UK, and EU.

As a core hub for serving Russian users and providing ruble-cryptocurrency exchanges, Grinex handled a large volume of transactions in 2025 and was seen as an important tool for Russian companies and individuals to evade international sanctions and conduct cross-border capital flows. This “backdoor fire” not only caused heavy losses for users but also dealt a severe blow to Russia’s already limited crypto exchange channels.