A prominent cryptocurrency exchange, Grinex, which catered to Russian users seeking to circumvent sanctions, has halted all operations after suffering a significant cyber attack that resulted in the theft of approximately 1 billion rubles, equivalent to $13 million. The breach was disclosed by the exchange through its official Telegram channel and website, with indications suggesting the involvement of state-sponsored actors from hostile nations.
According to Grinex, the nature and scale of the attack imply a high level of technological sophistication and resources, typically associated with state-backed entities. The exchange stated, 'The digital traces and characteristics of the attack suggest an unprecedented level of resources and technology, typically available only to the structures of unfriendly states.' It further noted that preliminary data indicate the attack was orchestrated to directly impact Russia's financial sovereignty. Grinex, originally operating as Garantex, was sanctioned by the US, UK, and EU due to its role in helping users bypass restrictions through the use of a ruble-backed stablecoin called A7A5.
This token enabled cross-border transactions at a time when Russia's access to the Swift international banking system was suspended following its invasion of Ukraine. After being shut down, the platform re-emerged under the name Grinex.
The current suspension of trading activities means that users are temporarily unable to access their funds while the company conducts an investigation. Additionally, access to Grinex's Moscow office has been restricted. In response to the incident, Grinex has released a list detailing 54 affected wallet addresses and the corresponding amounts that were drained, with the majority of the stolen funds being in the form of USDT on the TRON blockchain.