Grinex, a Russian cryptocurrency exchange, announced on Thursday that it suffered a hack resulting in the loss of over 1 billion rubles, equivalent to approximately $13 million. In an official statement shared via Telegram and translated by Google, Grinex attributed this cyberattack to ‘Western special services.’ The firm is known for facilitating transactions in digital assets between Russian businesses and citizens using cryptorubles.
According to the company’s announcement, the attack demonstrated a high level of technological prowess typically accessible only to hostile states. This incident, they claimed, was aimed at undermining Russia’s financial independence. Consequently, Grinex has suspended all trading activities and reported the matter to law enforcement for potential criminal proceedings.
Grinex shares operational similarities with Garantex, another Russian exchange that was previously seized by U.S. authorities due to alleged links with sanctioned banks and criminal organizations. It is primarily used for trading A7A5, a ruble-backed stablecoin developed as part of an effort to circumvent international sanctions, according to blockchain analyst Elliptic. The token has seen over $100 billion in transactions.
In its statement, Grinex highlighted ongoing threats against its infrastructure since inception. They reported efforts to restrict the movement of cryptocurrencies outside the Commonwealth of Independent States by marking crypto wallets and blocking transactions. Furthermore, they noted recent escalation in attacks targeting Russia’s financial sector through sophisticated cyber methods aimed at stealing assets from Russian entities.
The specific perpetrator of this hack remains unidentified; however, on-chain analysis by Elliptic reveals that roughly $15 million worth of USDT was withdrawn from the exchange. These funds were subsequently converted to ETH and TRX on Ethereum and Tron blockchains, respectively. The U.S. Secret Service, which had previously seized Garantex, declined to comment on any ongoing investigations when contacted by Decrypt.