Grinex exchange loses roughly US$14–15 million from customer wallets; repayment unconfirmed
Grinex suspended operations after customer crypto was stolen from its wallets. Reports put the loss around US$14–15 million. Repayment remains unconfirmed. Affected customers should preserve account records and contact official support.
If you held funds on Grinex, preserve your balance and transaction records and contact support through its official website about withdrawals and compensation. There is no device update to install for this theft.
What’s happening
Grinex, a Kyrgyzstan-registered crypto exchange serving Russian-speaking individuals and businesses, suspended operations on 16 April after customer assets were stolen from exchange-controlled wallets. Elliptic dated the transfers to around midday UTC on 15 April. Grinex reported losses exceeding 1 billion roubles; The Hacker News reported US$13.74 million, while Elliptic estimated approximately US$15 million. Elliptic traced stolen USDT through Tron and Ethereum into TRX or ETH, avoiding the issuer’s ability to freeze USDT. The published statements do not establish how access to the wallets was obtained. Grinex blamed foreign intelligence services, but that attribution remains unverified. In its latest published update, dated 30 April, Grinex said the assets were unavailable for return, it was restoring infrastructure and seeking funds for compensation, and Russian police had opened a criminal case. As at 3 November, customer repayment and a full Grinex restart remain unconfirmed. This is an exchange theft with no customer software patch.
- What
- Breach
- Affects
- Grinex cryptocurrency exchange
- Fixed in
- Nothing to patch
- Since
- 15 Apr 2026
- Closed
- 30 Apr 2026
Timeline
- Update
Grinex said the stolen assets were unavailable for return and it was seeking funding and developing compensation arrangements, with A7A5 withdrawals planned as the first step. It also said Russian police had opened a criminal case.
- Update
Chainalysis said Grinex’s attribution to foreign intelligence services remained uncorroborated. Its analysis showed stolen stablecoins being rapidly exchanged for TRX rather than frozen.
- Update
TRM Labs identified approximately 70 connected addresses, about 16 more than Grinex disclosed, and linked a theft of less than US$5,000 from TokenSpot to the same recipient. TokenSpot resumed operations; that announcement did not establish a Grinex restart.
- Made publicNothing to patch
Grinex announced that more than 1 billion roubles belonging to Russian customers had been stolen from its wallets. It suspended operations, published affected wallet addresses and said it had reported the incident to law enforcement.
- Update
Elliptic traced approximately US$15 million in USDT leaving Grinex-linked wallets around this time. Funds moved through Tron and Ethereum and were converted into TRX or ETH, avoiding USDT freezes.
Sources
- Grinex reports a targeted attackGrinex · 16 Apr 2026
- Grinex seeks ways to compensate customers for stolen assetsGrinex · 30 Apr 2026
- Sanctioned Russia-linked crypto exchange Grinex halts operations following alleged hack by Western Special ServicesElliptic · 16 Apr 2026
- Sanctioned Russian Exchange Grinex and Kyrgyzstani Exchange TokenSpot Hit in USD 15 Million TheftTRM Labs · 16 Apr 2026
- Sanctioned Russia-Linked Exchange Grinex Suspends Operations Following Alleged CyberattackChainalysis · 17 Apr 2026
- $13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence ClaimsThe Hacker News · 18 Apr 2026