Russia-linked crypto exchange involved in sanctions evasion suspends operations after hack

The crypto exchange Grinex said it would suspend operations following what it described as a large-scale cyberattack “bearing signs of involvement by foreign intelligence services,” according to a post on the exchange’s Telegram channel on April 16.

The hack resulted in the theft of more than 1 billion rubles from Russian users’ crypto wallets, the exchange said, adding that it had published the addresses of the targeted wallets.

Grinex representatives said: “The digital traces and nature of the attack point to an unprecedented level of resources and technology available exclusively to the structures of hostile states. Preliminary data indicates the attack was coordinated with the aim of inflicting direct damage on Russia’s financial sovereignty.” They said they had contacted law enforcement.

Grinex describes itself as a “leading crypto exchange” that enables “settlements between Russian businesses and citizens.” The platform launched in Kyrgyzstan in early 2025, the Financial Times reported.

The exchange also launched trading in the stablecoin A7A5, which is pegged to the ruble and backed by deposits at the sanctioned Russian bank Promsvyazbank. A7A5 is designed to facilitate cross-border payments between Russia and other countries under sanctions, according to the newspaper’s investigation. Grinex says it complies with international sanctions regimes.

Transparency International Russia has described Grinex as a reincarnation of the exchange Garantex, which was placed under Western sanctions for cooperating with criminals from multiple countries and, after Russia launched its full-scale war against Ukraine, was used as a tool for evading financial restrictions.

In August 2025, the United States imposed sanctions on Grinex, saying the platform is linked to Garantex and is involved in crypto transactions aimed at circumventing sanctions.