According to CryptoComLearn, Grinex, a sanctioned Russian crypto-to-ruble exchange, has suspended all operations after suffering a sophisticated cyberattack that resulted in the theft of approximately $13.74 million (over 1 billion rubles) worth of USDT stablecoins. The exchange claims the “unprecedented” hack bears the hallmarks of a state-sponsored attack, accusing “hostile countries” of orchestrating the incident through their foreign intelligence agencies.
Incident Details and Initial Findings
Grinex provides cryptocurrency-to-ruble exchange services for Russian businesses and individual investors. Preliminary forensic data released by the exchange shows that the attackers' digital footprint exhibits a level of coordination typically associated with state-level actors. A spokesperson for the exchange stated, “This attack is a deliberate attempt to destabilize the domestic financial system and undermine Russia's financial sovereignty.” The exchange remains under U.S. and international sanctions intended to isolate it from the global financial system.
In 2025, Grinex gained prominence after taking over the client base and infrastructure of Garantex, another exchange that shut down under Western regulatory pressure. This acquisition made Grinex a primary target of current U.S. sanctions. According to the exchange, the stolen funds were moved from several dozen personal wallets, converted into TRX cryptocurrency, and consolidated into a single destination address. Law enforcement authorities are now reviewing logs from 54 wallets to trace the flow of stolen assets.
Exchange Response and Legal Recourse
Grinex has officially filed a criminal complaint and handed over technical logs and digital evidence to law enforcement. Although the exchange remains offline, it insists that these “hostile actions” are part of a broader geopolitical campaign aimed at restricting digital asset transfers within the Commonwealth of Independent States (CIS). The spokesperson further explained, “From the very beginning, the exchange's infrastructure has been under constant attack. It was placed on sanctions lists, its crypto wallets were targeted, transactions were blocked. Now, attempts to shake the domestic financial system have escalated to a new level—direct asset theft.”
Grinex noted that it had previously participated in recovering and returning 2.5 billion rubles worth of digital assets that were frozen by Tether, the issuer of USDT. Currently, no timeline has been set for resuming operations, and no formal compensation plan for affected users has been announced.
Sanctions and Geopolitical Implications
Grinex continues to be subject to U.S. and international sanctions designed to sever its ties with the global financial system. The acquisition of Garantex in 2025 further cemented its status as a high-priority target for Western regulators. This hack comes amid growing international regulatory pressure on Russia's cryptocurrency market. Recently, the European Union added the Russian ruble-pegged stablecoin A7A5 to its sanctions list, recognizing it as a key player in Russian crypto financing activities.
Industry analysts suggest this attack may not be an isolated incident but part of an ongoing campaign targeting Russia's crypto infrastructure. As geopolitical tensions intensify, the lines between crypto asset security and national sovereignty are becoming increasingly blurred. Grinex's predicament highlights the vulnerability of sanctioned entities to cyber threats and the potential penetration of state actors into cryptocurrency markets.