Grinex Exchange Faces $14M Hack, Trading Suspended

By: crypto insight|2026/04/17 19:00:10
0
Share
copy

Key Takeaways:

  • Grinex, a Kyrgyzstan-registered crypto exchange linked to Russia, lost $13.7 million in an advanced cyberattack.
  • US authorities suspect Grinex of facilitating sanctions evasion and laundering activities for Russian hackers.
  • The hack involved draining funds from 54 addresses, raising security concerns over sophisticated state-supported cyber intrusions.
  • Blockchain analytics reveal potential connections between Grinex and another Kyrgyzstan-based exchange, TokenSpot.
  • Analysis suggests hackers smartly converted $15 million worth of USDT to evade asset freezing.

WEEX Crypto News, 2026-04-17 07:11:24

Grinex Halts Trading Post-Hack

The cryptocurrency world was jolted when Grinex, an exchange with ties to Russia, announced the suspension of its trading operations after a staggering $13.7 million hack. This incident represents a major breach within the crypto industry, given that Grinex has been under suspicion for aiding in sanctions evasion alongside conducting laundering for Russia-linked hacker networks. The origins of the attack hint at highly resource-equipped entities, potentially backed by adversarial nations.

Grinex has now provided law enforcement with all relevant details, and a criminal complaint has been filed at the exchange’s infrastructure location. Seen as a successor to the besieged Garantex platform, both exchanges have been under the spotlight for similar illicit activities. The founder of Elliptic, Tom Robinson, implicated Grinex as a paramount platform for trading the ruble-tied stablecoin A7A5, spotlighting its role in circumventing sanctions.

Possible Linkage to TokenSpot

Investigations imply Grinex might not stand as the sole victim. TRM Labs, a respected blockchain intelligence firm, suggests two wallets from TokenSpot, another Kyrgyzstan-based entity, transferred $5,000 to the address utilized by Grinex’s hacker. TokenSpot’s operational hiccup was noted on April 15, with a subsequent service restoration announcement the next day. Additionally, TRM Labs flagged 16 extra addresses connected to the breach, which collectively hold 45.9 million TRX, translating to nearly $15 million.

Detailing the Sophisticated USDT Theft

Not only was the hack bold in its execution, but it also showcased cunning with regards to fund management. Elliptic’s analysis pinpointed the movement of $15 million in USDT away from Grinex. These funds, redirected to Tron or Ethereum accounts, presented a challenge in potentially freezing the assets, hence illustrating a savvy understanding of the blockchain’s vulnerabilities. By transacting this USDT for TRX or ETH, the cybercriminals effectively circumvented the risk of asset freezing by Tether.

Recurring Threats in Sanctions-Evasion Platforms

This breach is not entirely isolated in the crypto landscape. Recalling previous instances, the Iranian exchange, Nobitex, experienced a crippling hack in June 2025, with $81 million depleted by actors claiming a stance pro-Israel. Notably, Grinex’s event underscores a persistent threat in exchanges that have affiliations with nations sidestepping US sanctions.

Grinex had voiced opposition to illegal practices like sanctions evasion or money laundering. However, the recent attack highlights the pervasive security vulnerabilities and geopolitical entanglements that exchanges face when accusations of sanctions-busting arise.

FAQ Section

What is the magnitude of loss in the Grinex hack?

Grinex experienced a loss totaling 1 billion Russian rubles, equivalent to $13.7 million, revealing a critical security lapse and raising stakes about the involvement of hostile state-backed entities.

How does the Grinex incident relate to TokenSpot?

Blockchain intelligence has identified potential on-chain links between Grinex and the Kyrgyzstan-based TokenSpot, suggesting shared vectors for similar security breaches.

Why is the conversion of USDT significant in this hack?

The hackers’ decision to convert USDT to other cryptocurrencies like TRX or ETH displays calculated evasion techniques, thwarting potential asset freezes by companies like Tether.

Has Grinex been implicated in prior illegal activities?

Yes, US authorities have long suspected Grinex of aiding in sanctions evasion and laundering for Russian hacking entities, marking it similar to the former Garantex exchange.

Are similar breaches common in the crypto sector?

Unfortunately, yes. Exchanges with links to nations under US sanctions often face such breaches, as evidenced by the Nobitex hack in 2025, emphasizing ongoing geopolitical and cyber vulnerabilities in cryptocurrency platforms.

You may also like

ZachXBT: Humanity private key leak and abnormal surge in H token should be viewed separately

On June 9, according to related disclosures, on-chain investigator ZachXBT posted an update on Humanity’s roughly $31 million security incident, saying that after further analyzing fund flows, he currently tends to believe the project team was not involved in an “inside job” or a self-staged attack. According to him, the official explanation about the private key leak was broadly accurate, but before the token unlock, the price of H had been artificially pushed higher, and the hacker later took advantage of that market environment; therefore, the private key leak and the earlier abnormal price pumping should be regarded as two separate and independent events. This reframing has shifted the market’s understanding of the nature of the incident. Earlier discussion around Humanity had focused on whether the team directly participated in the attack or used the security incident to cover up internal operations. ZachXBT’s latest remarks shift the focus from “whether it was self-theft” to “whether there were pre-unlock market structure issues.” He also questioned whether the team may have.

Morning Report | OpenAI has submitted an S-1 registration statement draft to the U.S. SEC; Morpho completes $175 million financing

Overview of Important Market Events on June 9th

Morning Report | BitMine increased its holdings by 126,971 ETH last week; trader Eugene announced his exit from the crypto market

Overview of Important Market Events on June 8th

Wang Chuan: How can one not feel anxious after the neighbor Old Wang made thirty times profit by investing in storage stocks? (Seven) - A quarter-century cycle

In-depth analysis of the "reflexivity" bubble trap in storage stocks: Beware of the backlash from the bullwhip effect and the false narrative of high growth; do not let the short-term myth of wealth become a wealth abyss that cannot be recovered for 25 years.

Cryptocurrency CEXs are flocking to sell US stocks, and traditional brokerages are facing an "uninvited guest."

The major reshuffle has just begun.

$75 billion in foreign capital has fled, and South Korean retail investors have absorbed it all using leverage

Despite the accelerated migration of Korean funds from cryptocurrency to the stock market, the Korean market remains an important barometer for global cryptocurrency retail liquidity and recovery turning points.

Popular coins

Latest Crypto News

Read more
iconiconiconiconiconiconicon
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com