A prominent cryptocurrency exchange, Grinex, has temporarily ceased operations after falling victim to a sophisticated cyber attack that resulted in the theft of approximately $13 million. The exchange, which was previously known as Garantex and is based in Kyrgyzstan, made the announcement via its Telegram channel and official website. According to Grinex, the nature and coordination of the attack suggest the involvement of state-sponsored actors from hostile nations.
In a statement, Grinex noted that the 'digital fingerprints' and the attack's characteristics imply an unprecedented level of technological expertise and resources, typically reserved for 'structures of unfriendly states.' Preliminary findings indicate that the attack was orchestrated to directly undermine Russia's financial independence. Grinex has been under sanctions imposed by the United States, the United Kingdom, and the European Union since last year.
The sanctions were a result of the exchange's alleged role in helping users circumvent restrictions through a ruble-backed stablecoin called A7A5. This token enabled cross-border transactions after Russia's access to the Swift inter-bank messaging system was severed due to its invasion of Ukraine. Following the imposition of sanctions, the platform re-emerged under the name Grinex. The suspension of trading activities has left users without access to their funds while the company conducts an investigation.
Additionally, access to Grinex's Moscow office has been restricted. The exchange has published a list of 54 affected wallet addresses, along with the corresponding amounts that were drained, with the majority being in the form of USDT on the TRON blockchain.