More than $13.7 million in digital assets was drained from Grinex, forcing the sanctioned exchange to suspend trading operations. The breach raises fresh concerns about security risks and systemic exposure within crypto platforms linked to sanctioned jurisdictions.
Grinex said Thursday that over 1 billion Russian rubles was stolen from 54 wallets in what it described as a highly sophisticated attack. The Kyrgyzstan-registered exchange stated it had filed a criminal complaint and shared all available data with law enforcement. It also suggested the attackers used resources typically associated with foreign intelligence entities.
Are Sanctioned Exchanges Becoming Prime Attack Targets?
The incident adds to scrutiny around Grinex’s reported ties to the sanctioned Garantex exchange, which ceased operations in March 2025. Blockchain analytics firm Global Ledger previously identified fund migrations from Garantex to Grinex, with user balances reportedly reappearing after earlier freezes. Garantex itself was sanctioned by the United States in 2022 and later restricted by the European Union.
“Due to the attack, the Grinex exchange has been forced to suspend operations,” the company said, adding that the breach showed “an unprecedented level of resources and technology.”
TRM Labs identified additional exposure, linking wallets from another Kyrgyzstan-based exchange, TokenSpot, to the same consolidation address used in the attack.
TRM Team
But the attack pattern reflects a broader trend of targeting exchanges operating in high-risk jurisdictions. In June 2025, Iran-based Nobitex lost $81 million in a breach claimed by a pro-Israel hacker group, illustrating how geopolitical factors can intersect with financial exploitation in crypto markets.
Still, blockchain data from Elliptic shows roughly $15 million in Tether (USDT) was quickly moved across Tron and Ethereum before being converted into other assets, reducing the likelihood of asset freezes. Attention now turns to whether Grinex can restore operations and how regulators respond to exchanges operating at the edge of the global financial system.
