Analysts at Global Ledger have determined that the Russian cryptocurrency exchange Grinex, which has been sanctioned, conducted transactions totaling $16.54 billion since its inception in March 2025 until its operations were halted. Notably, $9.25 billion of this amount was processed through the exchange after the sanctions were imposed by the Office of Foreign Assets Control of the U.S. Department of the Treasury (OFAC).
This is reported by Business • Media
Transaction Scale and Consequences of the Hack
Grinex executed operations with assets exceeding $11.02 billion in the stablecoin USDT and $5.51 billion in A7A5. However, following the hacker attack, the exchange’s losses turned out to be significantly greater than the official figures provided by the platform. According to Global Ledger, the investigation recorded the volume of stolen digital assets at around $19.38 million, and considering additional addresses and tokens, this amount could reach $25.37 million. This substantially exceeds the exchange’s official estimate, which was over $13 million.
According to Vladislav Syrotin, head of investigations at Global Ledger, the company’s experts discovered an additional 52.8 million A7A5 (approximately $4.42 million) that were not included in the exchange’s initial calculations. Grinex attributed the attack to “foreign intelligence services,” but analysts at Global Ledger are skeptical of this version.
“These actions resemble a hacker attack for profit rather than an intelligence operation.”
According to the report, the attacker almost simultaneously withdrew tokens A7A5, USDT, and TRX, and exchanged part of the stolen USDT for TRON (TRX) through the decentralized exchange SunSwap, likely to avoid blocking the stablecoins. Among the tracked addresses are:
- TWadfnsL5Rp1… — 478,617,323.23 A7A5 (almost $5.99 million);
- TXK2UQSr447j… — 352,791,567.14 A7A5 (about $4.42 million);
- TH9kgjfrKeTN… — 46,093,251 TRX (almost $14.96 million).
Part of the stolen assets remains in blocked wallets: one holding A7A5 and another holding TRX.
Flow Changes and Adaptation After Sanctions
Despite the sanctions, Grinex continued its active operations. Nearly 30% of all transactions on the exchange after the restrictions — $4.92 billion — were conducted through centralized exchanges (CEX). Before the sanctions were imposed, up to 49% of funds were processed through CEX, while after, it was only 14.5%. Meanwhile, the total monthly transaction volume decreased by only 12.8%, indicating a rapid restructuring of the shadow infrastructure.
“Regulatory pressure has forced illegal liquidity to delve even deeper into the shadows.”
In July 2025, the European Union imposed sanctions against the A7 platform and related individuals for using the stablecoin A7A5 to circumvent financial restrictions and for illegal financing. In February 2026, Elliptic experts recorded at least five new cryptocurrency exchanges that partially took on the functions of Garantex and Grinex in sanction evasion schemes.
Since the beginning of April 2026, there has been an increase in high-profile hacking incidents in the cryptocurrency sector, including:
- an attack on DEX Drift with losses of about $280 million;
- the hack of the Hyperbridge;
- an attack on the KelpDAO liquid restaking protocol with losses of $290 million;
- the hack of web infrastructure provider Vercel systems;
- a hacking attempt on Ethereum Name Service.