A prominent cryptocurrency exchange, Grinex, has halted all operations after falling victim to a sophisticated cyber attack that resulted in the theft of approximately $13 million. The exchange, which was formerly known as Garantex and is based in Kyrgyzstan, made the announcement via its Telegram channel and website.
According to Grinex, the nature and scope of the attack suggest the involvement of state-sponsored actors from hostile nations. In a statement, the company noted that the 'digital fingerprints' and methodology of the attack imply an unusually high level of technical expertise and resources, typically reserved for state-backed entities.
Preliminary findings indicate that the attack was deliberately designed to undermine Russia's financial autonomy. Grinex, which has been sanctioned by the US, UK, and EU for allegedly helping users circumvent restrictions, allowed customers to transfer funds using a ruble-backed stablecoin called A7A5. This token facilitated cross-border transactions when Russia's access to the Swift international banking network was severed following its invasion of Ukraine. After being shut down, the platform reemerged under the name Grinex.
As a result of the suspension, users are currently unable to access their funds while the company conducts an investigation. Additionally, access to the company's Moscow office has been restricted.
Grinex has released a list of 54 affected wallet addresses, with the majority of the stolen funds being in the form of USDT on the TRON blockchain.