A suspected state‑linked $13m hack has shuttered sanctioned Russian crypto exchange Grinex, cutting a major ruble‑to‑crypto sanctions‑evasion channel.
Summary
Russian-linked crypto exchange Grinex shuts down after losing over $13m in a suspected state-level cyberattack
Platform, already sanctioned by the U.S., U.K. and EU, was a key ruble off‑ramp helping Russian businesses dodge sanctions
Experts say the loss of Grinex will “seriously damage” Russia’s shadow economy and its ability to move money offshore
A major Russian cryptocurrency exchange used to funnel money around Western sanctions has shut down after a suspected large‑scale cyberattack that wiped out more than $13 million and severed a critical financial channel for the country’s shadow economy.
According to DL News, Grinex reported losing over 1 billion rubles, or roughly $13 million, in a hack that targeted its core wallet infrastructure, prompting it to halt trading and withdrawals before announcing it would cease operations entirely.
In a statement on its Telegram channel, the platform claimed the breach showed “signs of involvement from foreign intelligence agencies,” suggesting the tools and resources used were “beyond typical hackers” and part of “broader pressure on the Russian financial system.”
Grinex was created by former Garantex employees as a successor platform after U.S. authorities and allies sanctioned Garantex for processing more than $100 million in ransomware and other illicit flows, according to the U.S. Treasury’s Office of Foreign Assets Control.
OFAC described Grinex as “another cryptocurrency exchange created by Garantex employees to support the company’s sanctions evasion efforts,” and in August 2025 it sanctioned Grinex alongside A7A5, a ruble‑backed token that helped move Russian funds through Kyrgyz and other regional intermediaries.
Chainalysis, which has tracked the network, said the August 2025 designations were part of “a multi‑year effort to dismantle a sanctions‑evasion infrastructure” that laundered ransomware proceeds, darknet market revenues and other illicit transactions since at least 2019.
DL News reports that experts now view Grinex’s collapse as more damaging than the hack itself, because it removes one of the last large trading venues Russian businesses used to turn rubles into stablecoins and other liquid crypto assets that could be cashed out abroad.
One sanctions researcher quoted by the outlet argued that shutting Grinex would “seriously damage” the shadow infrastructure allowing Russia to dodge Western measures, making it harder for companies to import goods, pay contractors and move capital out of the country.
Grinex’s shutdown also lands as Russia’s broader economy weakens, with President Vladimir Putin recently acknowledging that GDP fell 1.8% year‑on‑year over January and February and warning that maritime oil exports could drop to their lowest level since 2023, tightening the squeeze on hard‑currency inflows.
As noted in a previous crypto.news story on how tokenized rails and offshore exchanges can be repurposed for sanctions evasion, the loss of a hub like Grinex underlines how quickly geopolitical pressure and cybersecurity risks can reverse the advantages that opaque platforms once gave to Russia‑linked actors.
