A significant cyber attack has prompted Grinex, a cryptocurrency platform popular among Russian users seeking to circumvent sanctions, to halt its operations. The breach, which is believed to have resulted in the theft of approximately 1 billion rubles ($13 million), was disclosed by the exchange via its Telegram channel and an official statement on its website.
According to Grinex, the sophistication and coordination of the attack suggest the involvement of state-sponsored actors from 'hostile nations.' The exchange's statement noted that 'the digital traces and nature of the attack indicate an unprecedented level of resources and technology, typically available only to the structures of unfriendly states.' It further suggested that the attack was orchestrated to directly undermine Russia's financial autonomy. Grinex, which was originally known as Garantex, has been the subject of sanctions imposed by the US, UK, and EU due to its alleged role in enabling users to bypass restrictions through a ruble-backed stablecoin called A7A5. This token facilitated cross-border transactions at a time when Russia's access to the Swift interbank messaging system was suspended following its invasion of Ukraine. After being shut down, the platform reemerged as Grinex.
The temporary suspension of trading activities has left users without access to their funds, pending an investigation. Additionally, access to the company's Moscow office has been restricted. Grinex has released a list of 54 affected wallet addresses, along with the corresponding amounts that were drained, with the majority being in the form of USDT on the TRON blockchain.