Breaches and incidentsBriefChecked against a primary source
Grinex: sanctioned Garantex-successor exchange drained
Theft around 15 Apr 2026, announced 16 Apr: about USD 15M (more than 1B roubles) per TRM; Grinex said about 1B roubles (about USD 13.7M).
- Disclosed
What happened
- Theft around 15 Apr 2026, announced 16 Apr: about USD 15M (more than 1B roubles) per TRM; Grinex said about 1B roubles (about USD 13.7M). Mostly USDT on Tron, converted to TRX and consolidated. TokenSpot (Kyrgyzstan) hit in the same operation for under USD 5K.
- Root cause: not disclosed.
- Attribution: Grinex blamed “the special services of unfriendly states”. Not verified by TRM or Reuters. TRM assesses an external operation is more likely than an exit scam.
- Response: Grinex suspended operations and filed a criminal complaint.
Sources
- https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft
- https://bleepingcomputer.com/news/security/grinex-exchange-blames-western-intelligence-for-137m-crypto-hack
- https://thehackernews.com/2026/04/1374m-hack-shuts-down-sanctioned-grinex.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.