Grinex Suspends Operations After Reported $13.74M Crypto Theft
Summary
Grinex said it is suspending operations after an April 15, 2026 theft of about $13.74 million. Analysts traced funds across TRON and Ethereum; the exchange blamed Western intelligence, while a criminal exploit or false flag remained possible.
Key points
- Grinex said a breach on April 15, 2026, resulted in the theft of about $13.74 million and led it to suspend operations.
- The exchange alleged foreign intelligence involvement; the article presents this as a company claim, with analysts also considering a criminal exploit or false-flag operation.
- Elliptic reported that stolen USDT moved through TRON or Ethereum and was swapped for TRX or ETH, which would reduce the risk of the USDT being frozen.
- TRM Labs identified about 70 addresses connected to the incident and said TokenSpot was also impacted; TokenSpot resumed operations the next day, and its estimated loss was under $5,000.
- Grinex is believed to be a rebrand of sanctioned Garantex, which reportedly used the A7A5 ruble-backed stablecoin.
Article Details
- Victim Organization
- Grinex
- Incident Type
- Cyberattack resulting in theft of user funds. Grinex alleged foreign intelligence involvement; analysts said criminal exploitation or a false-flag operation remained possible.
- Incident Date
- 2026-04-15
- Operational Impact
- Grinex suspended operations. TRM Labs reported that TokenSpot was also affected; TokenSpot temporarily became unavailable and announced that operations had resumed on April 16. The attacker was estimated to have stolen less than $5,000 from TokenSpot.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Products
A7A5transfers on TRON and Ethereum, highlighted rapid swaps from USDT to non-freezable tokens and use of the A7A5 ruble-backed stablecoin, and warned the incident could be either criminal exploitation or a false-flagEthereumBlockchain analysts traced the theft to transfers on TRON and Ethereum, highlighted rapid swaps from USDT to non-freezable tokens and use of the A7A5 ruble-backed stablecoin, and warned the incident could be eitherTRONBlockchain analysts traced the theft to transfers on TRON and Ethereum, highlighted rapid swaps from USDT to non-freezable tokens and use of the A7A5 ruble-backed stablecoin, and warned the incident could be either
Countries
KyrgyzstanGrinex, a Kyrgyzstan-incorporated crypto exchange believed to be a rebrand of sanctioned Garantex, said it is suspending operations after a hack that stole about $13.74 million (over 1 billion rubles) and blamed WesternRussiaand warned the incident could be either criminal exploitation or a false-flag attack undermining Russia-linked sanctions-evasion infrastructure.