Grinex Collapses After Coordinated Wallet Exploit and TRX Laundering

Sanctioned exchange **Grinex** shut down days after a coordinated wallet exploit that reportedly drained user funds worth **over 1 billion rubles**. Grinex claimed the breach was “targeted” and showed signs of advanced, state-level resources, then said it paused operations, handed evidence to law enforcement, and filed a criminal complaint. Blockchain analytics from **TRM Labs** expanded the picture: roughly **70 related addresses** (more than Grinex previously disclosed) allegedly swapped the stolen assets into **TRX** via **SunSwap**, then consolidated proceeds into a single TRON address tied to Grinex-linked wallets. TRM also flagged **TokenSpot** as a potential related front—two TokenSpot wallets reportedly sent funds to the same consolidation address, and both platforms went offline around **15 April**, suggesting a connected actor. The report further ties the incident to the Russia-linked sanctions-evasion chain around Garantex → Grinex and the ruble-pegged stablecoin **A7A5** (Old Vector). After Garantex was shut down in 2025, Grinex issued **A7A5 credits** linked to frozen balances, enabling continued activity despite sanctions. OFAC had previously sanctioned Grinex and the A7A5 issuer. Estimated financial impact cited is about **13.74M USDT**. TRM also noted illicit crypto inflows rose sharply in 2025 with Russia-linked activity, while illicit transactions remained around **1.2%** of total on-chain volume. **Why it matters for traders:** this is primarily a counterparty and compliance risk story. It can tighten scrutiny on TRX liquidity routes (e.g., SunSwap) and may trigger short-term risk-off sentiment around addresses and connected venues, but the direct price impact on **TRX** is likely limited, as the stolen funds appear consolidated rather than broadly destabilizing markets.