A sanctioned crypto exchange serving Russian users, Grinex, has suspended operations after a cyberattack stole approximately $14 million from user wallets. The exchange described it as a targeted operation with indications of foreign intelligence involvement. Stolen funds were laundered through SunSwap into TRX and consolidated into a single TRON address. The incident follows earlier sanctions imposed by the US Treasury.
The sanctioned crypto exchange Grinex reported a large-scale cyberattack resulting in the theft of over 1 billion rubles from user wallets. The exchange described the incident as a targeted operation and claimed there were indications of involvement by foreign intelligence agencies.
Following the breach, Grinex suspended its operations and filed a criminal complaint. The total damages were estimated at around $13.74 million.
Blockchain analytics reported around 70 addresses connected to the hack. All stolen assets were swapped into TRX through SunSwap and later pooled into a single TRON address.
The report also found that TokenSpot, a potential front linked to Garantex, was affected around the same time. Two of its wallets sent funds to the same consolidation address used by Grinex-linked wallets.
Grinex was set up in Kyrgyzstan in December 2024. Soon after Garantex was shut down in March 2025, Telegram channels began directing users toward Grinex as a replacement platform.
This led the US Treasury’s OFAC to impose sanctions on Grinex that same year. Before its closure, Garantex had processed over $100 billion in transactions while under sanctions.
The report also shed light on the use of A7A5, a ruble-pegged stablecoin. According to the findings, Garantex wallets began moving funds into A7A5 in early 2025.
After the shutdown, former users were issued A7A5 credits on Grinex equal to their frozen balances. This allowed them to continue transactions through the new system.
Illicit crypto inflows jumped in 2025, with about $158 billion flowing into suspicious wallets. The rise was mainly linked to Russia-related activity and improved tracking methods.
A7A5 was the largest contributor, bringing in about $72 billion in incoming value. Another $39 billion was linked to the A7 wallet cluster.
