Loading story…
Grinex, a Kyrgyzstan-based cryptocurrency exchange tied by investigators to the sanctioned Russian platform Garantex, suspended operations after attackers stole roughly $13.7 million to $15 million from user wallets. The exchange alleged the intrusion was carried out by actors linked to Western intelligence services and said it had filed a criminal complaint, but no public technical evidence was provided to support that attribution. Reporting says the stolen assets belonged largely to Russian users, and the incident disrupted a platform associated with crypto-ruble activity, including the ruble-backed stablecoin A7A5.
Blockchain analysis from TRM Labs and Elliptic found the stolen funds were moved across TRON and Ethereum, with large amounts of USDT on TRON swapped into TRX through SunSwap before being consolidated. TRM said it identified about 70 addresses linked to the theft, exceeding the 54 publicly disclosed by Grinex, and assessed that Kyrgyzstan-based TokenSpot was likely compromised in the same operation after two of its addresses sent funds to the same consolidation wallet and the exchange suffered an outage. Investigators said both exchanges are part of a broader Russian sanctions-evasion ecosystem connected to Garantex, Grinex, A7, and A7A5.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Chainalysis said the movement of stolen Grinex funds did not resemble a government seizure or Western intelligence operation, contradicting Grinex's public claims. Instead, it assessed the on-chain behavior as more consistent with an internal exit scam, noting use of a Tron-based DEX previously linked to Garantex wallet funding.
TRM Labs published analysis concluding that TokenSpot was likely also compromised in the same campaign that hit Grinex. The report tied both exchanges to a broader Russian sanctions-evasion ecosystem associated with Garantex, Grinex, A7, and the ruble-backed stablecoin A7A5.
Following the disclosure, blockchain analysts reported that the stolen assets were moved through TRON and Ethereum addresses and swapped into TRX and ETH, including via SunSwap. TRM Labs identified about 70 addresses linked to the theft, exceeding the 54 addresses Grinex publicly disclosed, and found the funds were largely consolidated into a single TRON address.
In its public response to the incident, Grinex claimed the attack was carried out by actors tied to 'unfriendly states' or Western intelligence services as part of an effort to undermine Russia's financial sovereignty. No public technical evidence was cited to substantiate this attribution.
On April 16, 2026, Grinex announced that a cyberattack stole roughly USD 13.7 million to USD 15 million in user funds. The exchange suspended operations and said it filed a criminal complaint over the theft.
On April 15, 2026, Kyrgyzstan-based exchange TokenSpot experienced an outage. TRM Labs later assessed that TokenSpot was likely hit in the same operation after two of its addresses sent funds to the same attacker consolidation address.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
13 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcehackread.com
Open sourceeurasianet.org
Open sourcebleepingcomputer.com
Open sourceelliptic.co
Open sourcetrmlabs.com
Open sourceincrypted.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities escalated action against the Russian cryptocurrency exchange **Garantex** after a March international law-enforcement operation seized its domains and servers, froze more than **$26 million** in cryptocurrency, and unsealed charges against alleged operators **Aleksej Besciokov** and **Aleksandr Mira Serda**. The Justice Department, Secret Service, FBI, Germany, and Finland said Garantex processed at least **$96 billion** in transactions since 2019 and was used to launder proceeds from hacking, ransomware, terrorism, drug trafficking, and sanctions violations, including activity that continued after OFAC sanctioned the exchange in 2022. The State and Treasury departments later expanded the pressure campaign by offering rewards of up to **$6 million** for information on Garantex leadership and sanctioning executives and affiliated firms. Investigators and blockchain analysts say activity quickly shifted to replacement infrastructure in Kyrgyzstan, where **Grinex** emerged as Garantex’s successor and the ruble-backed stablecoin **`A7A5`** became a major channel for cross-border transfers linked to Russian sanctions evasion. Reporting cited transfer volumes above **$1 billion per day** and **$41.2 billion** in cumulative value by late July 2025, with **`A7A5`** marketed as a lower-freeze-risk route into **USDT** after the Garantex takedown. Treasury subsequently designated **Grinex**, while broader U.K. and U.S. scrutiny of Kyrgyz banks and crypto services underscored how sanctions-evasion networks are moving from traditional banking rails to regional exchanges, stablecoins, and decentralized liquidity pools.
Jun 29, 2026
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed **A7 network**, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated **Huobi Global S.A.**, the entity behind crypto exchange **HTX**, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows. Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across **TRON**, **Ethereum**, **BNB Smart Chain**, and **Solana**, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for **A7 LLC** and **Garantex** and to the UK National Crime Agency-led **Operation Destabilize**, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
Jul 24, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026