Grinex, Garantex’s Sanctioned Successor, Collapses After $14M Hack
Grinex, the Russia-linked crypto exchange that absorbed users and liquidity from the sanctioned Garantex platform, suspended all operations on April 17 after attackers drained more than 1 billion rubles from 54 wallets. The exchange confirmed losses of roughly $13.7 million, though blockchain analytics firm Elliptic puts the actual damage closer to $15 million based on on-chain transfer data. Users are currently locked out of their funds with no timeline for recovery.
How the Funds Were Moved and Why It Matters
Elliptic tracked rapid outflows of USDT across both the TRON and Ethereum networks within hours of the breach. The attackers then converted that USDT into TRX and ETH, a deliberate step to sidestep Tether’s ability to blacklist addresses and freeze stolen stablecoins. It worked. Wallet data cited by Grinex itself shows a remaining consolidated balance of roughly 45.9 million TRX, worth over $15 million at current prices, meaning a substantial portion of the stolen funds is sitting in assets that no single issuer can freeze. This is the same weakness that makes cross-chain theft so effective, and state-level actors have exploited it repeatedly.
Sources put the total loss figure between $13.1 million and $15 million depending on methodology. Grinex’s own statement cites “over 1 billion rubles,” which at current exchange rates lands around $13.7 million. Elliptic’s on-chain estimate of $15 million is more credible here, since it is based on observed wallet movements rather than the exchange’s self-reported figure from an entity with an obvious incentive to minimize the disclosed damage.
Bitcoin BTC$62,053.00▲1.37%
Ethereum ETH$1,637.88▲0.70%
Tether USDT$0.9992▼0.01%
BNB BNB$591.54▲0.82%
USDC USDC$0.9999▲0.01%
XRP XRP$1.11▼1.40%
Solana SOL$64.36▲0.66%
TRON TRX$0.3226▲0.26%
Figure Heloc FIGR_HELOC$1.03▼0.12%
Dogecoin DOGE$0.0839▼0.08%Grinex Was Already a Red Flag Before This Attack
Grinex is registered in Kyrgyzstan but operated as a primary hub for ruble-to-crypto conversion inside Russia, processing over $6 billion in transactions. It stepped into the role vacated by Garantex after U.S. Treasury’s OFAC sanctioned that exchange for laundering funds tied to ransomware operators and darknet markets. Grinex also became the dominant venue for the A7A5 ruble-backed stablecoin, which Elliptic estimates has processed more than $100 billion in transactions. Any exchange that builds its market share by absorbing a sanctioned platform’s user base is not a compliance success story; it is the same operation with a new name.
Grinex blamed the attack on “hostile state” actors, framing it as an assault on Russia’s financial sovereignty, according to Decrypt. That framing is politically convenient but irrelevant to the users who cannot access their funds right now. A criminal complaint has been filed, Grinex says, but given the exchange’s sanctions baggage and opaque structure, expecting meaningful legal recourse for affected users would be naive. This is what happens when you park money on an exchange built to evade Western financial controls: the exit, whether forced or otherwise, is rarely clean.
