Crypto Chaos: Grinex Gets Grifted, $14M Vanishes Faster Than Your New Year’s Resolutions

by

Well, butter my biscuit and call me Liz Lemon, because Grinex, the crypto exchange that’s about as trustworthy as a fart in a spacesuit, has officially hit pause on trading after a cyberattack swiped a cool $15 million in crypto. State-level hackers? More like state-level snackers-they munched on those funds like it was a craft services table.

  • Grinex hit the brakes on trading after a suspected state-linked attack drained roughly $13.7 million from 54 wallets. Because nothing says “sophisticated breach” like emptying 54 digital piggy banks.
  • On-chain data shows $15 million in USDT doing the crypto cha-cha across Tron and Ethereum, with funds converted faster than a Mean Girls quote at a high school reunion.

Grinex announced on Thursday (aka “Oh Crap Day”) that it had suspended operations after losing over 1 billion Russian rubles, or about $13.7 million, from 54 wallets. They’re calling it a “highly sophisticated breach,” which is just a fancy way of saying, “We got played like a flute in a middle school band.” The Kyrgyzstan-registered exchange is pointing fingers at attackers with resources usually reserved for foreign intelligence agencies. Or, you know, a really determined hacker with a Red Bull addiction.

“Due to the attack, the Grinex exchange has been forced to suspend operations,” the exchange said in a statement that screams, “We’re totally fine, everything’s fine, why are you looking at us like that?” All info has been handed to law enforcement, and a criminal complaint has been filed. Because nothing says “we’re on top of this” like a criminal complaint filed in the same place as your infrastructure.

Grinex claims the attack was a coordinated operation, not just your run-of-the-mill exploit. The digital footprint and execution, they say, point to “an unprecedented level of resources and technology available only to entities of hostile states.” Or, you know, a hacker who watched Mr. Robot one too many times.

This incident puts Grinex under the microscope-again. The exchange has been linked to Russia’s sanctioned crypto infrastructure and is basically Garantex’s long-lost twin. Blockchain analysts say it’s just Garantex in a blonde wig, and honestly, the disguise isn’t fooling anyone.

Global Ledger previously reported that Garantex shuffled liquidity and user balances to Grinex after its shutdown in March 2025. Funds moved through one-time-use wallets like a game of crypto hot potato, and some users claim their frozen Garantex balances magically reappeared on Grinex. Investigators also noted similarities in website design and internal confirmations, because nothing says “new business” like copy-pasting your old one.

Garantex was sanctioned by the U.S. in 2022 for being the crypto equivalent of a shady alley deal. The EU followed suit, and operations officially ended in March 2025 after Tether froze $2.5 billion in ruble-backed stablecoins. Co-founder Aleksej Bešciokov was arrested in India shortly after, because apparently, the party’s over, folks.

Was It a Crypto Crime Spree?

TRM Labs thinks the attacker might have been a two-for-one deal. They spotted two wallets linked to Kyrgyzstan-based exchange TokenSpot sending about $5,000 to the same address used in the Grinex heist. TokenSpot had a “technical work” outage earlier this week, which is code for “we’re sweeping this under the rug.”

Further analysis uncovered 16 additional addresses tied to the incident, with funds funneled into a single address holding 45.9 million TRON, or about $15 million. Because why stop at one exchange when you can go on a full-blown crypto shopping spree?

Funds Did the Crypto Version of a Disappearing Act

Elliptic traced $15 million in USDT leaving Grinex and bouncing around Tron and Ethereum like a pinball. The attacker quickly converted the stablecoins into other assets, because nothing says “I’m a professional” like avoiding frozen funds.

“This USDT was then converted to another asset, either TRX or ETH,” Elliptic explained. “By doing so, the thief avoided the risk of the stolen USDT being frozen by Tether.” Because if there’s one thing criminals hate, it’s inconvenient fund freezes.

This isn’t the first time exchanges tied to sanctioned jurisdictions have been targeted. Iran-based Nobitex lost $81 million in June 2025, with a pro-Israel hacker group taking credit. Because in the world of crypto, it’s not just about the money-it’s about sending a message.

Now, all eyes are on Grinex to see if it can bounce back and how authorities will respond. Given its alleged role in sanction evasion and ties to blacklisted entities, let’s just say their to-do list is longer than a 30 Rock writers’ room brainstorming session.

Read More

2026-04-17 10:38