Garantex Successor Grinex Collapses Days After Coordinated Wallet Exploit
Grinex, a sanctioned crypto change serving Russian companies and particular person customers, mentioned it was hit by a large-scale cyberattack that resulted within the theft of funds price greater than 1 billion rubles from its customers’ wallets.
The change described the incident as a focused operation and claimed there have been indications of involvement by international intelligence businesses. It mentioned the technical footprint and scale of the assault steered using superior sources sometimes accessible to state-backed actors.
Following the breach, Grinex suspended its operations.
Laundering Route Exposed
In its official replace, the change revealed that every one related info has been handed over to legislation enforcement authorities. A legal criticism has additionally been filed on the location of its infrastructure. Grinex acknowledged the assault led to complete damages estimated at round 13.74 million USDT.
Blockchain analytics agency TRM Labs reported round 70 addresses linked to the hack, which is about 16 greater than what Grinex publicly disclosed. According to the findings, all stolen property have been swapped into TRX by SunSwap and later pooled right into a single TRON tackle.
The report additionally says TokenSpot, which TRM discovered to be a possible entrance linked to Garantex, was affected across the similar time. Two of its wallets despatched funds to the identical consolidation tackle utilized by Grinex-linked wallets. Both platforms reportedly went offline on 15 April, which signifies that they might have been focused by the identical attacker.
Grinex was arrange in Kyrgyzstan in December 2024, simply weeks earlier than a coordinated legislation enforcement operation in March 2025 that took down Garantex, a crypto change beforehand flagged for high-risk exercise. Soon after Garantex was shut down, Telegram channels linked to it started directing customers towards Grinex and introduced it as a substitute platform with comparable options. These channels additionally inspired former clients emigrate with a purpose to regain entry to frozen funds.
This led the US Treasury’s OFAC to impose sanctions on Grinex, together with people linked to Garantex and the issuer of the A7A5 token, Old Vector, that very same yr. Before its closure, Garantex had processed over $100 billion in transactions whereas beneath sanctions since 2022.
The report additionally make clear using A7A5, a ruble-pegged stablecoin issued by Old Vector. According to the findings, Garantex wallets started transferring funds into A7A5 in early 2025, earlier than enforcement motion started. After the shutdown, former customers have been issued A7A5 credit on Grinex equal to their frozen balances, permitting them to proceed transactions by the brand new system.
Russia-Linked Illicit Activity
An earlier report by the platform found that illicit crypto inflows jumped in 2025, with about $158 billion flowing into suspicious wallets. The rise was primarily linked to Russia-related exercise and improved monitoring strategies. Despite the rise, illicit transactions nonetheless made up solely round 1.2% of complete on-chain quantity.
A7A5 was the most important contributor, which introduced in about $72 billion in incoming worth. Another $39 billion was linked to the A7 pockets cluster. Most of this exercise was tied to Garantex, Grinex, and A7.
The put up Garantex Successor Grinex Collapses Days After Coordinated Wallet Exploit appeared first on CryptoPotato.
