Uncover the details behind April 2026's biggest crypto hacks.
The Russian sanctioned exchange Grinex processed about $16.54 billion worth of A7A5 and USDT before suspension. The platform halted its operations on April 16, 2026, after a hack.
Key Takeaways
- Grinex processed about $16.54 billion before halting its operations. $9.25 billion of this volume is from the post-sanctions period.
- CEXs account for nearly 30% of total Grinex’s volumes. That’s 4.92 billion.
- Grinex’s monthly volume stayed stable, decreasing about −12.8% post-sanctions.
- After the sanctions went into force, the share of funds processed by CEXs dropped from 49% to 14.5%.
- Grinex halted its operations on April 16 after a hack. The exchange reported losing about $13.1 million. Global Ledger traced $25.37 million of stolen funds.
Grinex claims losing about $13.1M. We’ve traced $19.38M
The exchange claimed losing 1 billion rubles (about $13.1 million), attributing the attack to the “foreign intelligence services”. Our investigation shows that about $19.38 million was stolen from Grinex.
The attack targeted both operational and deposit wallets on TRON. It means customer deposit addresses were compromised, as well.
A7A5, USDT, and TRX were drained simultaneously. The attacker swapped stolen USDT to TRX via the SunSwap DEX and consolidated in self-hosted wallets:
- TXK2UQSr447j… 352,791,567.14 A7A5 (~$4.42 million)
- TH9kgjfrKeTN… 46,093,251.00 TRX (~$14.96 million)
Explore the case below in our KYT solution.
If you'd like to take a closer look at this case, check it in our Global Ledger Vision tool.
Grinex processed $9.25B after OFAC sanctions
From its launch in March 2025 till the suspension, Grinex processed $16.54 billion worth of USDT and A7A5:
- More than 11.02 billion USDT (nearly 5.5 USDT in incoming and about the same amount in outgoing transactions)
- Nearly 440 billion A7A5 (224.97 billion in incoming and 294.96 billion in outgoing transactions). That’s over $5.51 billion as of April 17, 2026.
Read More
Same Garantex, Different Sauce
Grinex was launched as a direct successor to Garantex. Global Ledger was the first to find on-chain and off-chain evidence indicating that Garantex transferred assets to Grinex to maintain operations.
See More Details
Grinex was sanctioned by OFAC on August 14, 2025. By that time, it had processed about ~$7.3 billion. The platform hasn’t stopped its operations after the sanctions, “facilitating digital asset payments between Russian businesses and individuals.” From August 15, 2025 to April 15, 2026, Grinex processed $9.25 billion.
CEXs processed about $4.92B, or 30%, of total Grinex’s exposure
Centralized exchanges (CEXs) account for about 4.92 billion (nearly 30%) of total Grinex’s exposure. They received more than $2.44 billion from Grinex and sent over 2.47 billion to it.
Most of these funds are in USDT; 582.87K A7A5 make up about $7.3K (~0.00015% of total Grinex’s funds that CEXs processed). USDT is liquid and widely accepted, while A7A5 is sanctioned and the main liquidity for it is wash trading.
The share of funds processed by CEXs dropped by 34.5 p.p.
Before sanctions, 3.58 billion USDT moved through centralized exchanges (over 49% of total Grinex’s volumes before the SDN designation). After they were imposed, the volume fell to $1.34 billion (14.5% of volumes post-sanctions).
Grinex’s activity didn’t slow down much after sanctions
Sanctions isolated Grinex from the regulated market, dropping the volume that went through CEXs by nearly 35 p.p. But Grinex adapted, losing only 12.8% of its monthly transaction volume, and went on to process a staggering $9.25 billion while under sanctions.
For compliance teams, Grinex shows why sanctions exposure cannot be assessed only by watching direct flows to regulated exchanges. Once those routes narrow, the same ecosystem can continue through less visible liquidity paths, related wallets, successor entities, and operational infrastructure that keeps funds moving outside the channels where risk is easiest to detect.
See how Global Ledger helps track Russia-linked sanctions exposure.
In this case, regulatory pressure pushed illicit liquidity deeper into the shadows. The infrastructure compromise turned out to be Grinex’s real Achilles' heel.
