Approximately $13 million in user funds disappeared from the Russian cryptocurrency exchange Grinex in April 2026, and by the time the exchange suspended operations, the money was already moving rapidly through blockchain networks toward a single-destination wallet. The outage left users unable to access their funds, withdraw balances or execute transactions, with no timeline established for the restoration of services.
Blockchain intelligence company Elliptical It confirmed the exploit and began tracking the stolen assets on the chain. The firm identified Grinex as one of the largest places to convert Russian rubles into cryptoassets, even though the exchange is formally registered in Kyrgyzstan, a detail that is very important for users now waiting for answers.
The full extent of the breach and whether all affected funds can be accounted for is still being actively investigated.
Grinex, one of the largest cryptocurrency exchanges in Russia, was attacked, resulting in a loss of approximately 13 million USDT.
Grinex reported a cyber attack that caused losses of around one billion rubles (approximately $13 million) and led to the suspension of trading services.…
– Wu Blockchain (@WuBlockchain) April 17, 2026
DISCOVER: The Next Crypto Gem 1000x Before It Lists On Binance
How attackers drained and disappeared $13 million from one of Russia’s largest crypto exchanges
The attackers targeted Grinex hot wallets, the exchange’s internet-connected storage used to process live transactions, and drained a mix of cryptocurrencies in a single coordinated operation. They then converted those assets into Tron ($TRX) tokens via decentralized and over-the-counter trading hubs, before consolidating approximately 45.9 million TRX into a destination wallet.
The choice of TRX was not coincidental. Tron offers lower transaction fees and faster settlement times than Ethereum, reducing both cost and complexity during the wash phase, the kind of operational detail that points to planning, not opportunism. An anonymous blockchain forensic analyst noted that “the rapid conversion to a single asset like $TRX, followed by consolidation, indicates a highly planned operation.”
Grinex publicly attributed the attack to “foreign intelligence services,” specifically pointing to Western state actors. Elliptic found no clear evidence to support that claim. The stolen funds remain traceable on-chain, but have not been recovered. Grinex says it filed criminal complaints and turned over all available evidence to authorities.
The exchange has also reported links to A7A5, a ruble-backed stablecoin allegedly used to facilitate more than $100 billion in sanctions evasion activities, a connection that adds a significant layer of regulatory complexity to an already complicated situation.
DISCOVER: The best Meme Coin ICOs to invest in in 2026
Why you can trust 99Bitcoins
Established in 2013, 99Bitcoin team members have been crypto experts since the early days of Bitcoin.
90 hours+
Weekly Research
100k+
Monthly readers
50+
Expert collaborators
2000+
Crypto Projects Reviewed
Follow 99Bitcoins on your Google News Feed
Get the latest updates, trends and insights right at your fingertips. Subscribe now!
Subscribe now 
