Russia-Linked Grinex Exchange Suspends Operations After $13-15 Million Hack

Apr 17, 2026

Russian cryptocurrency exchange Grinex suspended all trading operations after suffering a cyberattack that resulted in losses between $13-15 million (over 1 billion rubles), with blockchain analysis from Elliptic confirming approximately $15 million in USDT was stolen and converted to ETH or TRX. Grinex blamed the attack on Western intelligence services, claiming it demonstrated state-level resources aimed at destabilizing Russia's financial sector, and reported the incident to law enforcement for criminal investigation. Blockchain firm Elliptic identified Grinex as sharing the same technical fingerprint as Garantex, a sanctioned exchange seized by the U.S. Secret Service in March for alleged ties to Russian banks and criminal groups. Grinex serves as the primary trading venue for A7A5, a ruble-backed stablecoin that Elliptic characterizes as a sanctions evasion tool that has processed over $100 billion in transactions.

Grinex Exchange Hack and Suspension of Operations

▪On-chain analysis from Elliptic shows around $15 million worth of USDT left the Grinex exchange.
▪Russian crypto exchange Grinex was hacked for more than 1 billion rubles on Thursday.
▪The Grinex hack resulted in losses of around $13 million to $15 million in funds.
▪Stolen funds from Grinex were transferred and converted to ETH or TRX on the Ethereum or Tron blockchains.
▪Grinex passed information about the hack to law enforcement to open a criminal case.
▪Grinex suspended all exchange activity following the cyberattack.

Alleged Foreign State Involvement and Sanctions Evasion Claims

▪Grinex claimed the attack was designed to destabilize Russia's financial sector.
▪Grinex alleged the cyberattack was conducted by foreign special services from Western countries.
▪Grinex claimed the cyberattack showed an unprecedented level of resources and technologies available exclusively to structures of unfriendly states.
▪Grinex was entered into sanctions lists according to the exchange's official statement.
▪Grinex claimed its infrastructure has been under attack since the beginning of its operations.

Links to Garantex and Russian Stablecoin Infrastructure

▪Garantex was seized and taken offline by the U.S. Secret Service due to alleged ties to sanctioned Russian banks and criminal groups.
▪Grinex is the main vehicle for trading ruble-backed stablecoin A7A5 according to blockchain firm Elliptic.
▪Ruble-backed stablecoin A7A5 was created as part of a Russian sanctions evasion enterprise according to Elliptic.
▪Ruble-backed stablecoin A7A5 has transferred values of more than $100 billion.
▪The U.S. Secret Service performed the seizure of Garantex in March.

Perspective of Elliptic and blockchain analysts

▪Elliptic characterized the A7A5 ruble-backed stablecoin as a tool created specifically for Russian sanctions evasion.
▪Blockchain analysts view Grinex's role in facilitating A7A5 trading as evidence of systematic sanctions circumvention.