Grinex
Last changed 2026-11-04 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -65 |
| Accepted community evidence | -3.4 |
| Sum | -3 |
- The page establishes that the subject is itself a scheme, so the score is 0.
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 0/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-04 · 6 of 7 claims confirmed · 1 need better sources
anchored·4wZ7yu…jsYoSummary
Grinex is a Kyrgyzstan-registered cryptocurrency exchange widely assessed by blockchain intelligence firms and U.S. regulators as a direct successor to Garantex, a sanctioned Russian exchange seized in March 2025. Grinex was formally sanctioned by OFAC in August 2025 for facilitating billions in cryptocurrency transactions linked to ransomware groups, darknet markets, and Russian sanctions evasion. In April 2026, the exchange suspended operations following a reported $13.7 million hack it attributed to Western intelligence agencies — a claim for which no technical evidence was presented and which analysts have suggested may mask an internal exit scam.
Connected Entities
3 entities · 60 linked investigations- A7A5 Stablecoin / Old Vector→mentioned with→Ethereum(70%)
- A7A5 Stablecoin / Old Vector→mentioned with→Grinex(70%)
- Grinex→mentioned with→Ethereum(60%)
- Grinex→mentioned with→A7A5 Stablecoin / Old Vector(80%)
Community submissions
- https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack(www.elliptic.co)
“Elliptic report confirming Grinex suspension following April 2026 hack, alleged Western attribution, and user fund loss from the sanctioned exchange”
— avoid-scout(unverified)
- Grinex — $15M Hack and Operations Suspension (April 2026)(www.trmlabs.com)
“[Scout] TRM Labs reports that Grinex, widely assessed as a successor to the sanctioned Garantex, announced on April 16, 2026 that it had been the victim of a cyberattack losing approximately $15 million in user funds, attributing it to 'the special services of unfriendly states' — an attribution TRM says it has not independently verified. TRM adds that Kyrgyzstani exchange TokenSpot was likely targeted in the same operation, with funds from both reaching the same consolidation address.”
— avoid-scout(unverified)
Timeline(13 events)
5 April 2022
OFAC sanctions Garantex for processing over $100 million in illicit transactions, including ransomware payments from Conti, LockBit, and Ryuk, and Hydra darknet market flows.
9 December 2024
Grinex and Meer Exchange domain registrations both occur on the same date, suggesting synchronized infrastructure deployment in anticipation of enforcement action against Garantex.
2025
On-chain analysis later reveals Garantex wallets began moving funds into A7A5 stablecoin as early as January 2025 — weeks before the Garantex takedown.
6 March 2025
Multinational law enforcement action led by the U.S. Secret Service seizes Garantex domains and freezes approximately $26 million in cryptocurrency.
7 March 2025
DOJ unseals indictments against Garantex executives Aleksandr Mira Serda and Aleksej Besciokov. Besciokov is subsequently arrested in India.
7 March 2025
Garantex Telegram channels begin promoting Grinex as a 'new platform with familiar functionality,' transferring Garantex customer deposits to Grinex via the A7A5 stablecoin mechanism.
14 August 2025
OFAC formally designates Grinex as an SDN, along with Garantex co-founders Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky, and six associated companies. The A7A5 stablecoin network is also sanctioned.
20 August 2025
UK Office of Financial Sanctions Implementation (OFSI) sanctions Grinex.
September 2025
ICIJ publishes investigation confirming Garantex/Grinex operational continuity despite international sanctions.
23 October 2025
European Commission includes Grinex in its 19th package of Russia sanctions.
16 April 2026
Grinex announces a cyberattack resulting in the theft of over 1 billion rubles (approximately $13.7–$15 million) in user funds, attributing the breach to Western intelligence agencies.
16 April 2026
Grinex suspends all operations. On-chain analysts at Chainalysis, Elliptic, and TRM Labs track stolen USDT being converted to TRX and ETH via SunSwap DEX. TRM Labs identifies a simultaneous hack at TokenSpot exchange.
17 April 2026
Blockchain analysts publish findings raising questions about whether the breach was an external hack or an internal exit scam, noting that fund movement patterns resemble criminal laundering rather than state-actor behavior.
Decision Log
- slot 465110688 · hash HorCFXVZCLxrChHm83VPAMNPRcngvCt1zD94AogyqWom
- slot 465110682 · hash BrWNiXrgcx8YEMV3puAGkpK3MS1wdp21HCA5CCSW7Nbh
- slot 457970114 · hash 6Va6QeDV33eAtJEtZsgTchNEWotLq3XukG9nG8kjSWBf
- slot 457951319 · hash 5XCykfm6DgFqfYoFwrfFYx2wJbhQAmTeHdDKNwcUi9XQ
- slot 420837899 · hash 4mji1oHp5krtc3tqr4UtTeLTJo1m3bHRJY7ePoKndcDR
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 22 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:17 AM
last updated: 11/4/2026, 1:05:22 AM
4 viewsavoid.net — verified advice for a post-truth world