CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Grinex cryptocurrency exchange reports $13.2m theft attributed to foreign intelligence agencies

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A sanctioned cryptocurrency exchange operating in Kyrgyzstan, Grinex, reported a $13.2 million theft from Russian customers following a targeted cyber-attack described as highly sophisticated. The exchange attributed the incident to Western intelligence agencies, claiming the operation required unprecedented resources and technology to execute. Grinex suspended operations and filed criminal complaints while providing forensic details and blockchain addresses linked to the theft, including conversion of funds to TRX.

Timeline

  1. 20.04.2026 12:00 1 articles · 2h ago

    Grinex reports $13.2m theft amid claims of foreign intelligence agency involvement

    A sanctioned cryptocurrency exchange, Grinex, reported a targeted cyber-attack resulting in the theft of $13.2 million from Russian customers. The exchange attributed the incident to Western intelligence agencies and suspended operations, filing a criminal complaint and sharing blockchain addresses linked to the exfiltrated funds, which were converted to TRX.

    Show sources
    Open in new tab

Information Snippets

  • Grinex, a Kyrgyzstan-based cryptocurrency exchange sanctioned by the US in August 2025, reported a cyber-attack resulting in the theft of one billion rubles ($13.2 million) from Russian customers.

    First reported: 20.04.2026 12:00
    1 source, 1 article
    Show sources

  • The exchange attributed the attack to Western intelligence agencies, citing the unprecedented level of resources and technology required for such a raid aimed at undermining Russia’s financial sovereignty.

    First reported: 20.04.2026 12:00
    1 source, 1 article
    Show sources

  • Grinex suspended operations following the attack and filed a criminal complaint, sharing forensic evidence and the blockchain address where the exfiltrated funds were allegedly deposited after conversion to TRX.

    First reported: 20.04.2026 12:00
    1 source, 1 article
    Show sources

  • Blockchain forensics firm Chainalysis questioned Grinex’s narrative, noting that Western agencies typically freeze centralized stablecoins rather than swap them for non-freezable tokens, which occurred in this incident.

    First reported: 20.04.2026 12:00
    1 source, 1 article
    Show sources

  • Chainalysis highlighted that the funds were rapidly swapped via a Tron-based DEX previously used by Grinex’s predecessor, Garantex, to fund hot wallets, raising concerns about a potential false flag operation.

    First reported: 20.04.2026 12:00
    1 source, 1 article
    Show sources

  • Chainalysis suggested Grinex’s claim could be a cover for an exit scam, with administrators using the hack narrative to siphon liquidity under international pressure.

    First reported: 20.04.2026 12:00
    1 source, 1 article
    Show sources