Grinex suspends trading after $13–15M USDT breach as attackers move funds to ETH and TRON, blames Western agencies
Grinex, described in reporting as Russian-linked and also as Kyrgyzstan-based, suspended trading after a cyberattack the exchange said resulted in the theft of roughly 1 billion roubles (about $13 million) [1] [2] [3].
On-chain analysis and blockchain firms tracked roughly $15 million in USDT withdrawals that attackers converted into Ethereum and TRON as they moved the funds off the platform [4] [2].
In a public statement, Grinex blamed 'foreign intelligence services' or 'western special services' for the exploit and said it halted services while investigations proceed; the exchange has previously been linked to Garantex, which U.S. authorities seized, according to reports [1] [3] [4].
Investigations are ongoing and the exchange remains offline as on-chain tracing continues to follow the stolen funds [1] [4] [2].
Anonymous signal used only for weekly cluster rankings. No public counters.
Share
Broadcast this coverage
Copy-ready links for the networks your audience checks first.
Support independent reporting
If this summary helped, a small tip helps keep ClusterWire running.
Privacy note: we log tip UI events (page + action, and article slug when applicable) to improve the feature. We don’t store IP address, user-agent, or wallet addresses in analytics. Tips are on-chain, so the sending address is public in the transaction.
Citations
Follow the primary reporting behind this analysis. Click a citation to open the referenced source in a new tab.
- 1Trading Halted: Another Crypto Exchange Goes Dark After Cyber AttackBitcoinist• Apr 16, 2026
- 2Kyrgyzstan-based crypto exchange halts trading after $15M USDT cyberattack and wallet breachCryptopolitan• Apr 17, 2026
- 4Grinex, one of Russia's largest cryptocurrency exchanges, was attacked, resulting in a loss of appro...Wu Blockchain• Apr 17, 2026
Themes
Themes driving this story
Curated from the cluster of sources powering this article.