{"id":"grinex-exchange-wallet-theft-apr-2026","category":"breach","status":"closed","title":"Grinex exchange loses roughly US$14–15 million from customer wallets; repayment unconfirmed","tldr":"Grinex suspended operations after customer crypto was stolen from its wallets. Reports put the loss around US$14–15 million. Repayment remains unconfirmed. Affected customers should preserve account records and contact official support.","summary":"Grinex, a Kyrgyzstan-registered crypto exchange serving Russian-speaking individuals and businesses, suspended operations on 16 April after customer assets were stolen from exchange-controlled wallets. Elliptic dated the transfers to around midday UTC on 15 April. Grinex reported losses exceeding 1 billion roubles; The Hacker News reported US$13.74 million, while Elliptic estimated approximately US$15 million. Elliptic traced stolen USDT through Tron and Ethereum into TRX or ETH, avoiding the issuer’s ability to freeze USDT. The published statements do not establish how access to the wallets was obtained. Grinex blamed foreign intelligence services, but that attribution remains unverified. In its latest published update, dated 30 April, Grinex said the assets were unavailable for return, it was restoring infrastructure and seeking funds for compensation, and Russian police had opened a criminal case. As at 3 November, customer repayment and a full Grinex restart remain unconfirmed. This is an exchange theft with no customer software patch.","action":"If you held funds on Grinex, preserve your balance and transaction records and contact support through its official website about withdrawals and compensation. There is no device update to install for this theft.","product":"Grinex cryptocurrency exchange","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["grinex","crypto","exchange","wallet-theft","tron","ethereum"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Grinex reports a targeted attack","url":"https://grinex.io/post/kriptorublevaya_birzha_grinex_zayavlyaet_o_celenapravlennoy_atake","by":"Grinex","date":"2026-04-16"},{"kind":"advisory","title":"Grinex seeks ways to compensate customers for stolen assets","url":"https://grinex.io/post/grinex_izyskivaet_vozmozhnost_kompensirovat_klientam_ukradennye_aktivy","by":"Grinex","date":"2026-04-30"},{"kind":"research","title":"Sanctioned Russia-linked crypto exchange Grinex halts operations following alleged hack by Western Special Services","url":"https://www.elliptic.co/insights/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack/","by":"Elliptic","date":"2026-04-16"},{"kind":"research","title":"Sanctioned Russian Exchange Grinex and Kyrgyzstani Exchange TokenSpot Hit in USD 15 Million Theft","url":"https://www.trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft","by":"TRM Labs","date":"2026-04-16"},{"kind":"research","title":"Sanctioned Russia-Linked Exchange Grinex Suspends Operations Following Alleged Cyberattack","url":"https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/","by":"Chainalysis","date":"2026-04-17"},{"kind":"news","title":"$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims","url":"https://thehackernews.com/2026/04/1374m-hack-shuts-down-sanctioned-grinex.html","by":"The Hacker News","date":"2026-04-18"}],"started":"2026-04-15","closed":"2026-04-30","created":"2026-11-03T22:09:02.796Z","updated":"2026-11-03T22:09:02.796Z","cve_notes":[],"timeline":[{"at":"2026-04-30","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Grinex said the stolen assets were unavailable for return and it was seeking funding and developing compensation arrangements, with A7A5 withdrawals planned as the first step. It also said Russian police had opened a criminal case.","url":"https://grinex.io/post/grinex_izyskivaet_vozmozhnost_kompensirovat_klientam_ukradennye_aktivy","by":"Grinex","patch":null},{"at":"2026-04-17","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Chainalysis said Grinex’s attribution to foreign intelligence services remained uncorroborated. Its analysis showed stolen stablecoins being rapidly exchanged for TRX rather than frozen.","url":"https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/","by":"Chainalysis","patch":null},{"at":"2026-04-16","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"TRM Labs identified approximately 70 connected addresses, about 16 more than Grinex disclosed, and linked a theft of less than US$5,000 from TokenSpot to the same recipient. TokenSpot resumed operations; that announcement did not establish a Grinex restart.","url":"https://www.trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft","by":"TRM Labs","patch":null},{"at":"2026-04-16","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Grinex announced that more than 1 billion roubles belonging to Russian customers had been stolen from its wallets. It suspended operations, published affected wallet addresses and said it had reported the incident to law enforcement.","url":"https://grinex.io/post/kriptorublevaya_birzha_grinex_zayavlyaet_o_celenapravlennoy_atake","by":"Grinex","patch":"na"},{"at":"2026-04-15T12:00Z","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Elliptic traced approximately US$15 million in USDT leaving Grinex-linked wallets around this time. Funds moved through Tron and Ethereum and were converted into TRX or ETH, avoiding USDT freezes.","url":"https://www.elliptic.co/insights/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack/","by":"Elliptic","patch":null}],"url":"https://hard.fyi/live/grinex-exchange-wallet-theft-apr-2026/","json":"https://hard.fyi/api/live?id=grinex-exchange-wallet-theft-apr-2026"}