Cryptocurrency exchange Grinex, popular among Russian users seeking to circumvent sanctions, has halted all operations after falling victim to a sophisticated cyber attack that resulted in the theft of approximately 1 billion rubles, equivalent to $13 million. The breach was disclosed by the exchange via its official Telegram channel and website, with Grinex attributing the attack to state-sponsored actors from 'hostile nations'. According to the exchange, the nature and scope of the attack suggest an 'unprecedented level of resources and technology', implying the involvement of 'structures of unfriendly states'.
The primary objective of the attack, as per Grinex, was to directly compromise Russia's financial sovereignty. Having been sanctioned by the US, UK, and EU last year for allegedly aiding users in evading restrictions through a ruble-backed stablecoin called A7A5, Grinex had previously operated under the name Garantex. The A7A5 token enabled cross-border transactions after Russia's access to the Swift messaging system was severed due to its invasion of Ukraine. Following the sanctions, the platform re-emerged as Grinex.
The temporary suspension of trading activities has left users without access to their funds, pending an investigation. Additionally, access to Grinex's Moscow office has been restricted. A list of 54 affected wallets, along with the corresponding drained amounts – primarily in USDT on the TRON blockchain – has been published by the exchange.