Garantex Successor Grinex Collapses Days After Coordinated Wallet Exploit

Hackers drained Grinex wallets and moved funds by SunSwap into TRX earlier than consolidating property right into a single TRON deal with.

Grinex, a sanctioned crypto trade serving Russian companies and particular person customers, stated it was hit by a large-scale cyberattack that resulted within the theft of funds value greater than 1 billion rubles from its customers’ wallets.

The trade described the incident as a focused operation and claimed there have been indications of involvement by international intelligence companies. It stated the technical footprint and scale of the assault prompt the usage of superior sources usually out there to state-backed actors.

Following the breach, Grinex suspended its operations.

Laundering Route Uncovered

In its official replace, the trade revealed that each one related data has been handed over to legislation enforcement authorities. A felony grievance has additionally been filed on the location of its infrastructure. Grinex said the assault led to complete damages estimated at round 13.74 million USDT.

Blockchain analytics agency TRM Labs reported round 70 addresses linked to the hack, which is about 16 greater than what Grinex publicly disclosed. In response to the findings, all stolen property had been swapped into TRX by SunSwap and later pooled right into a single TRON deal with.

The report additionally says TokenSpot, which TRM discovered to be a possible entrance linked to Garantex, was affected across the identical time. Two of its wallets despatched funds to the identical consolidation deal with utilized by Grinex-linked wallets. Each platforms reportedly went offline on 15 April, which signifies that they could have been focused by the identical attacker.

Grinex was arrange in Kyrgyzstan in December 2024, simply weeks earlier than a coordinated legislation enforcement operation in March 2025 that took down Garantex, a crypto trade beforehand flagged for high-risk exercise. Quickly after Garantex was shut down, Telegram channels linked to it started directing customers towards Grinex and offered it as a substitute platform with related options. These channels additionally inspired former prospects emigrate in an effort to regain entry to frozen funds.

You might also like:

This led the US Treasury’s OFAC to impose sanctions on Grinex, together with people linked to Garantex and the issuer of the A7A5 token, Outdated Vector, that very same 12 months. Earlier than its closure, Garantex had processed over $100 billion in transactions whereas below sanctions since 2022.

The report additionally make clear the usage of A7A5, a ruble-pegged stablecoin issued by Outdated Vector. In response to the findings, Garantex wallets started transferring funds into A7A5 in early 2025, earlier than enforcement motion started. After the shutdown, former customers had been issued A7A5 credit on Grinex equal to their frozen balances, permitting them to proceed transactions by the brand new system.

Russia-Linked Illicit Exercise

An earlier report by the platform found that illicit crypto inflows jumped in 2025, with about $158 billion flowing into suspicious wallets. The rise was primarily linked to Russia-related exercise and improved monitoring strategies. Regardless of the rise, illicit transactions nonetheless made up solely round 1.2% of complete on-chain quantity.

A7A5 was the most important contributor, which introduced in about $72 billion in incoming worth. One other $39 billion was linked to the A7 pockets cluster. Most of this exercise was tied to Garantex, Grinex, and A7.