Grinex halts trading after $13M hack; suspends operations amid sanctions ties

Kyrgyzstan‑registered crypto exchange Grinex said it suspended trading and withdrawals after a cyberattack that resulted in the theft of roughly 1 billion roubles, about $13.1 million by Reuters’ conversion, according to the exchange statement and reporting. The platform temporarily went dark as it investigated the breach and the movement of funds.

In a message on its Telegram channel, Grinex accused “foreign intelligence services of unfriendly states” of involvement in the attack; Reuters noted it could not independently verify that claim. U.S. authorities had designated Grinex previously, alleging the exchange served as a successor to sanctioned operator Garantex and facilitated sanctions evasion using a ruble‑pegged token called A7A5, according to an August 14, 2025 OFAC press release.

Blockchain analytics groups and industry outlets reported that the stolen assets were largely moved as USDT and some were converted into other tokens such as TRX before dispersal. Firms tracking on‑chain flows estimated the outflow in the $13–15 million range and described techniques consistent with laundering and rapid obfuscation of provenance. These technical traces are being used by investigators to follow the funds across multiple addresses and chains.

The incident highlights both the security risks faced by mid‑tier centralized exchanges and the geopolitical dimension when a platform is already flagged for sanctions‑related activity. Grinex’s alleged role in facilitating cross‑border ruble payments and working with ruble‑backed tokens has put it under heightened scrutiny from Western regulators and intelligence authorities, complicating incident response and potential cooperation from third‑party service providers.

Market observers expect intensified enforcement and more concerted blockchain surveillance as outcomes of the breach. Analysts say centralized venues will face pressure to tighten custody practices and to enhance cooperation with on‑chain monitors and law enforcement; depending on investigative findings, further sanctions, asset freezes or criminal charges against individuals behind the exchange cannot be ruled out. The situation remains fluid as investigators and analytics firms continue tracing the stolen funds.