Russia-linked crypto exchange Grinex halts trading after $14M hack

Sanctioned crypto exchange Grinex said it has suspended trading after losing more than 1 billion Russian rubles ($13.7 million) to an attack bearing signs of involvement by foreign intelligence agencies.

The exchange, which is registered in Kyrgyzstan but has been linked to Russia’s crypto ecosystem and alleged sanctions evasion, said on Thursday that the funds were taken from 54 addresses and that the digital footprint and nature of the attack indicate an “unprecedented level of resources and technology available only to entities of hostile states.”

“Due to the attack, the Grinex exchange has been forced to suspend operations. All available information has been transferred to law enforcement agencies. A criminal complaint has been filed at the location of the infrastructure,” it added.

Grinex had been widely seen as the successor to the similarly sanctioned Garantex exchange. Both have been accused by US authorities of assisting Russia and other entities in evading sanctions and laundering funds for Russia-linked hackers.

Elliptic founder Tom Robinson has accused it of being the primary platform for trading A7A5, a ruble-backed stablecoin linked to sanctions evasion.

A Grinex spokesperson told Cointelegraph last year that it strongly condemns any form of illegal activity, including sanctions evasion and money laundering.

Another exchange might have been hit by the same attacker

Grinex may not have been the only exchange targeted. Blockchain intelligence company TRM Labs said on Thursday that two wallets from TokenSpot, a Kyrgyzstan-based exchange with on-chain links to Grinex, sent around $5,000 to the same consolidation address used by the Grinex attacker.

TokenSpot’s Telegram channel announced technical work and a brief platform outage on April 15, followed the next day by an announcement that it had resumed full operations.