Russia-friendly exchange says “western special service” behind $15 million cyberattack

Grinex, a cryptocurrency exchange based in Kyrgyzstan and currently under U.S. sanctions, has announced it is ceasing operations after suffering a significant cyber theft estimated at $15 million. The exchange alleges that the attack was executed by hackers believed to be associated with Western intelligence agencies. Recent research by TRM, a blockchain analysis firm, confirmed the breach and noted that approximately 70 wallets were compromised during the incident. This number exceeds the 54 wallets that Grinex initially reported as being affected. While the exact methods used by the attackers remain unclear, both TRM and another research firm, Elliptic, have noted that Grinex has faced ongoing cyber threats since it began operations 16 months ago. Grinex specifically pointed to the targeting of its Russian clientele during the latest assault, stating, "The digital footprints and nature of the attack reveal an unprecedented level of resources and technology that appear to be exclusive to hostile state actors." The exchange further claimed that the attack aimed to undermine Russia's financial independence. As a result of the cyberattack, Grinex has suspended all trading activities and has reported the incident to law enforcement agencies, initiating an investigation into the breach. In addition to Grinex, TRM indicated that another Kyrgyz exchange, TokenSpot, was also compromised, with links between the two platforms suggesting they may have been attacked by the same group. The U.S. Treasury Department previously sanctioned Grinex, identifying it as a rebranding of Garantex, an exchange implicated in facilitating illegal transactions exceeding $100 million since 2019. The sanctions came shortly after TRM raised concerns about the legitimacy of Grinex's operations, highlighting its potential connections to cybercriminal activities.