Grinex and TokenSpot Linked to $15 Million Crypto Theft

Grinex, a Kyrgyzstan-based cryptocurrency exchange tied by investigators to the sanctioned Russian platform Garantex, suspended operations after attackers stole roughly $13.7 million to $15 million from user wallets. The exchange alleged the intrusion was carried out by actors linked to Western intelligence services and said it had filed a criminal complaint, but no public technical evidence was provided to support that attribution. Reporting says the stolen assets belonged largely to Russian users, and the incident disrupted a platform associated with crypto-ruble activity, including the ruble-backed stablecoin A7A5.

Blockchain analysis from TRM Labs and Elliptic found the stolen funds were moved across TRON and Ethereum, with large amounts of USDT on TRON swapped into TRX through SunSwap before being consolidated. TRM said it identified about 70 addresses linked to the theft, exceeding the 54 publicly disclosed by Grinex, and assessed that Kyrgyzstan-based TokenSpot was likely compromised in the same operation after two of its addresses sent funds to the same consolidation wallet and the exchange suffered an outage. Investigators said both exchanges are part of a broader Russian sanctions-evasion ecosystem connected to Garantex, Grinex, A7, and A7A5.