$13 Million Drained, Grinex Suspends All Operations

Grinex, a cryptocurrency exchange widely used by Russians to evade international sanctions, has halted operations after disclosing a cyberattack that drained approximately 1 billion rubles (around $13 million) from its systems. The Kyrgyzstan-based platform announced the breach via its Telegram channel and official website, attributing the attack to state-backed actors from "unfriendly states."

The exchange's statement read: "The digital footprints and nature of the attack indicate an unprecedented level of resources and technology available exclusively to the structures of unfriendly states," adding that the attack was "coordinated with the goal of inflicting direct damage on Russia's financial sovereignty." Grinex published a list of 54 affected wallet addresses, with most funds drained in the form of USDT on the TRON blockchain.

Why This Matters

This is not a routine exchange hack. Grinex is a sanctioned entity — placed under restrictions by the U.S., U.K., and European Union — that served as a key conduit for circumventing Western financial pressure on Russia. Its predecessor, Garantex, facilitated cross-border payments via a ruble-backed stablecoin called A7A5 after Russia was cut off from the SWIFT interbank messaging system following its invasion of Ukraine.

The suspension has left users unable to access their funds, while the exchange's Moscow office has also been restricted.

From Garantex to Grinex: A History of Sanction Evasion

The exchange's trajectory illustrates the cat-and-mouse dynamic between Western sanctions regimes and Russia-linked financial infrastructure. After Garantex was taken down by international authorities, the platform quickly re-emerged as Grinex — same function, new name, new jurisdiction.

Since Russia's 2022 invasion of Ukraine, Western powers have layered financial pressure through SWIFT disconnection, asset freezes, and targeted crypto exchange sanctions. In response, Russian capital increasingly flowed through blockchain-based stablecoins and P2P platforms, with Grinex serving as a critical node in that network.

Outlook [Expert Analysis]

This incident may signal the beginning of more aggressive cyber operations targeting sanctions-evasion infrastructure. While Grinex's attribution claims cannot be independently verified, the precision and scale of the attack suggest a level of sophistication beyond typical criminal actors.

Three scenarios are worth monitoring. First, Grinex may resurface under yet another name — the Garantex precedent makes this likely. Second, Western authorities may use this moment to intensify tracing and sanctioning of TRON-based USDT flows. Third, if Russia officially frames the attack as financial warfare, it could escalate geopolitical tensions around the broader cryptocurrency ecosystem. Compensation for affected users and a timeline for resumption remain unclear.