A prominent cryptocurrency exchange, Grinex, which was popular among Russian users seeking to circumvent sanctions, has temporarily ceased operations after falling victim to a sophisticated cyber attack that resulted in the theft of approximately $13 million. The exchange, which is based in Kyrgyzstan, announced the breach on its official Telegram channel and website, attributing the attack to state-sponsored actors from hostile nations. According to Grinex, the nature and scale of the attack suggest that it was executed with extensive resources and advanced technology, typically only available to state-backed entities.
The exchange stated that preliminary data indicates the attack was orchestrated to deliberately undermine Russia's financial autonomy. Grinex, previously known as Garantex, was sanctioned by the US, UK, and EU last year for allegedly enabling users to bypass restrictions through a ruble-pegged stablecoin called A7A5. This token facilitated cross-border transactions when Russia's access to the Swift interbank messaging system was suspended following its invasion of Ukraine. After being shut down, the platform reemerged as Grinex.
The suspension of trading activities has left users unable to access their funds while the company conducts an investigation. Additionally, access to Grinex's Moscow office has been restricted. The exchange has released a list of 54 affected wallet addresses and the corresponding amounts that were drained, with most of the stolen funds being in the form of USDT on the TRON blockchain.