What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Grinex suspended operations on April 16, 2026, after saying attackers took more than 1 billion Russian rubles from user funds—reported in different accounts as roughly $13.1 million to $15 million, including a widely cited $13.74 million estimate. The exchange blamed “foreign intelligence services,” but no public evidence reviewed through October 1, 2026, identifies a government, intelligence agency or named attacker.
The firmest evidence is on-chain: assets moved from wallets associated with Grinex, stablecoins were rapidly swapped into other cryptoassets, and funds were consolidated across Tron- and Ethereum-linked addresses. Those transactions show what happened to money, not who ordered the attack.
What happened to Grinex?
Grinex, incorporated in Kyrgyzstan and sanctioned by the United States and United Kingdom, announced a suspension on April 16, 2026. It said a cyberattack removed more than 1 billion rubles and characterized the incident as an attack by hostile foreign special services intended to damage Russia’s financial sovereignty.
Elliptic placed the theft at about 12:00 UTC on April 15. Elliptic and Chainalysis then published early blockchain analysis, and The Hacker News reported the commonly quoted $13.74 million figure on April 18. As of October 1, 2026, the reviewed public reporting contains no confirmed attribution, recovery announcement or final forensic accounting.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Elliptic’s account, Chainalysis’ analysis and The Hacker News’ report all distinguish the exchange’s allegation from independently observable transactions.
Timeline
| Date | Event |
|---|---|
| March 6, 2025 | U.S.-led law-enforcement action disrupted Garantex-related infrastructure, according to a later Treasury notice. |
| August 14, 2025 | OFAC redesignated Garantex, designated Grinex as its successor and sanctioned associated entities and executives. |
| April 15, 2026 | Elliptic estimated that the Grinex theft occurred at approximately 12:00 UTC. TokenSpot reportedly announced temporary technical maintenance and became unavailable. |
| April 16, 2026 | Grinex announced its operational suspension and blamed foreign intelligence services. |
| April 16–17, 2026 | Elliptic and Chainalysis published early blockchain findings. |
| April 18, 2026 | The Hacker News published an account using the $13.74 million estimate. |
How much was stolen?
The exchange-reported loss was more than 1 billion rubles. Dollar conversions and blockchain counts differ because analysts used different exchange rates, transaction windows and definitions of which outflows belonged to the incident.
| Figure | What it represents | Qualification |
|---|---|---|
| More than 1 billion rubles | Grinex’s own reported loss | Exchange statement; not an independently audited total |
| About $13.1 million | Early estimate cited in Elliptic’s coverage | Conversion in the exchange-statement context |
| $13.74 million | Figure used by The Hacker News | Reported conversion, not a settled forensic dollar amount |
| Roughly $15 million | Some on-chain estimates of USDT outflows or balances | Depends on which transactions are counted |
The defensible summary is a reported loss exceeding 1 billion rubles, or approximately $13–15 million at the time. It is not accurate to present $13.74 million as a final audited figure.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What the blockchain evidence shows
Observed transaction pattern
- Assets moved from wallets analysts associated with Grinex.
- Stablecoins, including USDT, were rapidly exchanged for TRX and, in some reporting, ETH.
- Funds moved through Tron- and Ethereum-related addresses and were consolidated at common destinations.
- TRM Labs reportedly identified about 70 connected addresses.
- Two TokenSpot-linked addresses reportedly sent less than $5,000 to the same consolidation address.
Chainalysis reported swaps of stolen stablecoins into TRX through a decentralized exchange associated with the Garantex ecosystem. Elliptic described subsequent movement and conversion through Tron or Ethereum. These assets remain publicly traceable; changing from USDT to TRX or ETH changes the issuer, route and counterparty exposure, but does not make transactions anonymous.
What remains unknown
- The initial access method—such as stolen keys, compromised hot-wallet systems, backend intrusion or an insider account.
- Whether every affected asset belonged to customers rather than exchange reserves or operating wallets.
- Whether any funds were frozen or recovered after the initial reports.
- Who controlled each address. Wallet clustering is analytical and probabilistic unless supported by direct evidence.
Why convert USDT so quickly?
USDT can potentially be frozen by its issuer following a lawful request. Rapidly exchanging it into TRX or ETH may reduce immediate issuer-freezing exposure and complicate the path investigators must follow. It does not prove laundering, state involvement or even who controlled the wallets. A decentralized exchange is not an invisible channel: the transactions remain recorded on public blockchains and can be analyzed alongside counterparties, timing and infrastructure.
Why Grinex was already a sanctions concern
The shutdown matters because Grinex was part of a broader sanctions story, not an isolated retail exchange failure. In its August 14, 2025 notice, the U.S. Treasury said Garantex had been sanctioned in April 2022 and had processed more than $100 million in transactions linked to illicit activity since 2019. Treasury said Garantex-associated personnel created Grinex after the March 2025 disruption to continue key services and move customer deposits or access to the new platform.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Treasury also linked the structure to A7A5, a ruble-backed digital asset issued by Kyrgyzstani firm Old Vector. Chainalysis described Grinex as a major A7A5 trading hub and reported extremely large transaction volumes. Volume is not the same as reserves, market capitalization or legitimate economic value.
Treasury’s designation supports describing Grinex as a successor created by Garantex-associated personnel in a sanctions-evasion structure. Calling it simply a legal renaming or “rebrand” requires separate attribution to analysts or media, not an assertion of independently proven corporate identity. See the Treasury notice and Chainalysis background on A7A5.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What role did TokenSpot play?
TokenSpot was described in reporting as a Kyrgyzstan-based exchange likely operating as a front for Grinex. It announced technical maintenance on April 15, and its reported loss was less than $5,000. Analysts linked two TokenSpot addresses to the same consolidation destination used by Grinex-linked wallets. Those facts support a reported connection, not definitive proof of ownership or control.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
How strong is the intelligence-agency allegation?
Grinex said the sophistication, preparation and resources behind the breach pointed to Western or other hostile intelligence services. The public material reviewed does not independently corroborate that claim. Chainalysis said the rapid conversion into assets less directly exposed to issuer freezing was not the most obvious description of a conventional public law-enforcement seizure, while noting several explanations remain possible.
| Explanation | What fits | Status |
|---|---|---|
| External criminal compromise | Theft followed by rapid movement and concealment; requires no state capability. | Plausible, but no initial-access evidence is public. |
| Insider theft | Could explain knowledge of wallet structure and fast transfers. | Speculative. |
| Law-enforcement or intelligence operation | Grinex’s stated explanation. | No government has claimed responsibility in the reviewed sources. |
| False-flag operation | Reuse of familiar Garantex-linked laundering patterns could misdirect attribution. | Possibility raised by Chainalysis, not a finding. |
“Sophisticated” is not a synonym for “state-sponsored.” The strongest conclusion is narrower: analysts observed fund movement; the attacker’s identity and motive remain unresolved.
What this means for exchanges and compliance teams
Screen beyond the immediate deposit address
Sanctions exposure can arrive through intermediaries, shared wallets, bridges, over-the-counter desks or counterparties that later interact with a designated service. Screening should include historical exposure and related addresses, not only the address presented by a customer.
Alert on behavior, not one asset alone
A rapid stablecoin-to-TRX or stablecoin-to-ETH conversion followed by consolidation is a useful risk signal. It is not conclusive proof of laundering, so alerts require transaction context, customer information and documented escalation.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Preserve evidence and escalate quickly
- Record transaction hashes, timestamps, wallet labels and counterparties.
- Pause or review transfers involving sanctioned or closely linked infrastructure under the organization’s legal obligations.
- Coordinate with counsel, relevant regulators, issuers and qualified blockchain investigators.
- Do not describe an address cluster as legal ownership without corroborating evidence.
What users and counterparties should know
A suspension, an alleged theft and eventual recovery are separate events. Customers should preserve account statements, deposit and withdrawal hashes, identity records and communications. They should not attempt to move assets through a related or sanctioned platform to “rescue” funds without qualified legal and compliance advice. The exchange’s sanctions status also creates counterparty risk for institutions that accepted deposits, processed withdrawals or relied on intermediaries connected to its wallet network.
Unanswered questions
- How attackers obtained access and whether any insider participated.
- Which wallets were customer funds, reserves or operating accounts.
- Whether issuers, regulators or investigators froze or recovered assets.
- Whether TokenSpot and other related services remain active.
- Whether any government will publish a formal attribution.
Until those questions are answered, transaction tracing can establish chronology and exposure, but not nationality, intent or criminal liability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
