Grinex, a Russian cryptocurrency exchange operating under active US, UK, and EU sanctions, suspended all trading and withdrawals on April 16 after attackers reportedly drained more than one billion Russian roubles (approximately $13.1 million) in USDT stablecoins from its wallets on the TRON and Ethereum networks. The exchange announced the shutdown in a statement carried by Russian outlet Izvestia, attributing the breach to "special services" of "unfriendly states." No Western government has claimed responsibility, and the attribution remains unverified.

Grinex is not a new name in sanctions circles. It was incorporated in Kyrgyzstan in December 2024, weeks before US, German, and Finnish authorities disrupted its predecessor, Garantex, in a coordinated law enforcement action on March 6, 2025, though Garantex operations continued in some form despite those measures. That action seized Garantex's web domains and froze roughly $26 million in cryptocurrency. Garantex had been sanctioned by the US Treasury's Office of Foreign Assets Control (OFAC) in April 2022 after processing over $100 million in ransomware-linked transactions and facilitating large-scale money laundering. The exchange operated defiantly for three additional years following that designation, establishing a pattern of defiance that Grinex would go on to continue. Grinex stepped in almost immediately after the 2025 action, marketing itself as a "new platform with familiar functionality" and migrating Garantex's customer balances into a ruble-pegged token called A7A5. OFAC sanctioned Grinex and the broader A7A5 network in August 2025. The UK followed within the week, and the EU included A7A5 in its 19th sanctions package in October 2025.

"Grinex was incorporated in December 2024, well before the seizure [of Garantex]," TRM Labs noted in a sanctions evasion network analysis published in August 2025, suggesting the handoff was planned rather than improvised.

The A7A5 Token and Its Scale

Central to understanding why this matters beyond Russia is the A7A5 token itself. Issued by Old Vector, a Kyrgyz firm with reported ties to sanctioned Moldovan-Russian oligarch Ilan Shor and Russia's Promsvyazbank (a sanctioned lender to Russian defense contractors), A7A5 is a ruble-pegged stablecoin that processed an estimated $72 to $93 billion in transactions during 2025. That figure represents roughly one-third of Russia's annual import bill, according to Chainalysis. The token's "Instant Swapper" service allowed users to convert A7A5 into dollar-pegged stablecoins such as USDT with minimal identity verification. Chainalysis tracked more than $2.2 billion flowing through that conversion mechanism. Grinex itself processed a total lifetime volume of $6.1 billion, according to reporting by Protos and the Financial Times, a figure that underscores its independent scale as a trading venue beyond the broader A7A5 network. Vladimir Putin attended a virtual launch event for A7's Vladivostok branch in September 2025, a signal of Kremlin-level endorsement of the network.

Since Grinex served as A7A5's primary trading venue, the suspension puts the token's liquidity and redemption pathways in immediate doubt for anyone holding a balance.

On-Chain Behavior Points to a Sophisticated Actor

According to Elliptic's blockchain analysis, whoever conducted the hack did not simply move the stolen USDT to a holding address. The funds were rapidly converted into TRX (TRON's native currency) and ETH (Ether, the native currency of the Ethereum network) across two accounts, one on each chain. The likely motivation was to get ahead of a potential freeze by Tether, the company that issues USDT and has previously immobilized wallets connected to sanctioned entities at law enforcement request. The speed and deliberateness of that conversion is consistent with an actor who understood Tether's enforcement capabilities, though it is equally consistent with a sophisticated criminal group or an inside operation. Grinex's statement described "an unprecedented level of resources and technologies available exclusively to structures of unfriendly states," language that fits a Kremlin-approved narrative but carries no evidentiary weight on its own.

Regional Exposure: South Asia and Africa

The fallout extends well beyond Russia's financial system. Garantex executive Aleksej Besciokov was arrested in India in early 2025 while awaiting extradition and died in Delhi's Tihar Jail in August 2025, making India a direct participant in Western enforcement efforts against this network. India's Financial Intelligence Unit (FIU-IND) has maintained an active enforcement posture in this area, having issued show-cause notices to offshore crypto exchanges operating in the country, giving South Asian regulators an existing framework for responding to A7A5-linked exposure. More broadly, USDT on TRON is the dominant stablecoin rail in South Asia and Sub-Saharan Africa, widely used for remittances and peer-to-peer trading because of its low transaction fees. Any exchange or OTC desk in Pakistan, Nepal, Bangladesh, Nigeria, or Zimbabwe that processed A7A5-to-USDT conversions could face secondary sanctions exposure under OFAC rules, even without knowledge of the counterparty's identity. According to reports, the A7A5 network opened physical offices in Nigeria and Zimbabwe, two of Africa's most active crypto markets by adoption.

What Comes Next

Grinex is unlikely to be the last iteration of this infrastructure. After Garantex was taken down in March 2025, Chainalysis documented at least five replacement exchanges appearing within weeks. Transparency International Russia made the pattern plain in September 2025: "Every time regulators cut off one 'head' of this crypto hydra, another appears under a new name." Global sanctions-evading crypto volume reached $104 billion in 2025, a 694% increase year over year, according to Chainalysis's 2026 Crypto Crime Report. For compliance teams and blockchain analytics providers, Grinex's suspension is a prompt to update wallet screening tools against the address clusters already published by OFAC, TRM Labs, and Elliptic. For users in regions where TRON-based USDT is an everyday payment rail, the episode is a reminder of how geopolitical conflict can surface inside infrastructure that feels entirely local.