Grinex to compensate clients for 1B ruble hack loss

Grinex, a Kyrgyzstan-registered cryptocurrency exchange, announced it will compensate users after a mid-April hack that removed more than 1 billion rubles, roughly $13 to $15 million, from customer accounts. The platform halted deposits and withdrawals on April 15 and posted a notice on Telegram.

Blockchain analysis indicates attackers withdrew Tether (USDT) from 54 addresses, mostly on the Tron network, converted the tokens to Tron (TRX) on the decentralized platform SunSwap, and consolidated the proceeds into a single public address: TH9kgjfrKeTNeyXtDKvxCXZ1dVKr7neKVa.

International anti-money-laundering services have flagged the seized coins as stolen. The exchange said the assets now sit in wallets controlled by the perpetrators and are not recoverable through the platform. Russian authorities opened a criminal investigation; Grinex provided transaction data and other materials to investigators.

To reimburse affected users, Grinex plans to allow withdrawals in A7A5, a stablecoin pegged to the ruble, as an initial compensation measure. The exchange described the A7A5 withdrawal as the first step while it raises funds, develops further compensation methods and restores platform infrastructure.

The company is working with blockchain forensics and cybersecurity specialists to trace the theft and strengthen systems. The exchange characterized the attack as “prolonged, complex and highly technical” and added that “finding ways to compensate clients remains our absolute priority.”

Grinex was established in Kyrgyzstan last year as the successor to the Russian exchange Garantex, which was shut down in March 2025. The exchange and entities linked to the A7A5 stablecoin have been sanctioned by the United States, the European Union and the United Kingdom. Grinex alleged in a Telegram post that Western intelligence agencies were involved; some analysts disputed that attribution.