Garantex Successor Grinex Collapses Days After Coordinated Wallet Exploit
Grinex, a crypto exchange linked to the sanctioned Garantex, suffered a major cyberattack resulting in over 13 million USDT stolen and led to the suspension of its operations. The attack, suspected to be state-backed, involved sophisticated laundering through TRON-based platforms and coincided with similar disruptions at a related platform, TokenSpot. This incident highlights ongoing security risks and regulatory scrutiny in crypto exchanges serving high-risk markets.
Grinex, a sanctioned crypto exchange serving Russian businesses and individual users, said it was hit by a large-scale cyberattack that resulted in the theft of funds worth more than 1 billion rubles from its usersโ wallets. The exchange described the incident as a targeted operation and claimed there were indications of involvement by foreign intelligence agencies. It said the technical footprint and scale of the attack suggested the use of advanced resources typically available to state-backed actors. Following the breach, Grinex suspended its operations. Laundering Route Exposed In its official update, the exchange revealed that all relevant information has been handed over to law enforcement authorities. A criminal complaint has also been filed at the location of its infrastructure. Grinex stated the attack led to total damages estimated at around 13.74 million USDT. Blockchain analytics firm TRM Labs reported around 70 addresses connected to the hack, which is about 16 more than what Grinex publicly disclosed. According to the findings, all stolen assets were swapped into TRX through SunSwap and later pooled into a single TRON address. The report also says TokenSpot, which TRM found to be a potential front linked to Garantex, was affected around the same time. Two of its wallets sent funds to the same consolidation address used by Grinex-linked wallets. Both platforms reportedly went offline on 15 April, which indicates that they may have been targeted by the same attacker. Grinex was set up in Kyrgyzstan in December 2024, just weeks before a coordinated law enforcement operation in March 2025 that took down Garantex, a crypto exchange previously flagged for high-risk activity. Soon after Garantex was shut down, Telegram channels connected to it began directing users toward Grinex and presented it as a replacement platform with similar features. These channels also encouraged former customers to migrate in order to regain access to frozen funds. This led the...
Comments
Log in to comment