Grinex Halts Exchange After Cyberattack as Links to Sanctioned Garantex Draw Renewed Scrutiny

• Grinex has paused all exchange activity after what it described as a large-scale cyberattack and said it has referred the case to law enforcement.
• The platform, linked by blockchain investigators to the same operational “fingerprint” as sanctioned exchange Garantex, is a key venue for trading the ruble-backed stablecoin A7A5.

Grinex has halted trading after reporting a major cyberattack, drawing fresh attention to a platform already under scrutiny for its ties to the sanctioned Russian exchange Garantex.

The exchange said all activity has been paused and that information related to the incident has been handed to law enforcement as it seeks to open a criminal case. In a statement posted to its Telegram channel, Grinex alleged that the attack bore signs of involvement by what it called “Western special services,” claiming the operation was designed to damage Russia’s financial sovereignty.

Grinex blames foreign state actors as trading stops

The tone of the company’s statement was, to put it mildly, political. Grinex described itself as a leading “cryptoruble” exchange serving Russian businesses and citizens, and said the digital traces of the attack pointed to a level of resources available only to hostile foreign state structures.

That claim has not been independently verified, and it lands in an already murky context. Crypto exchanges tied to sanctioned jurisdictions or politically sensitive payment rails often become focal points for narratives that are as geopolitical as they are technical.

Still, the practical fact is simpler. Trading has been stopped, and the platform says it is now trying to move the case into a criminal investigation.

Garantex links and A7A5 activity deepen the stakes

What makes the incident more notable is who Grinex is. According to blockchain analytics firm Elliptic, the exchange shares the same “fingerprint” as Garantex, the Russian platform seized and taken offline by the US Secret Service over alleged ties to sanctioned Russian banks and criminal groups.

Elliptic has also identified Grinex as the main vehicle for trading A7A5, a ruble-backed stablecoin.

That matters because it places the attack well beyond the category of an ordinary exchange outage. Grinex sits at the intersection of sanctions risk, alternative payment infrastructure and Russian digital asset flows. When a platform like that goes dark, even briefly, the consequences are likely to be measured not only in trading disruption, but in how the broader network around it is forced to respond.