Audit log

Every state-changing event for Grinex: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:04:12Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,837,899

   sig

   4wZ7yuBcWm6t…3CnwjsYocopyexplorer ↗

   hash

   4mji1oHp5krt…PoKndcDRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7972 B) ▸

   {"actor":"system:backfill","investigation_id":"62fe06a8-9409-4d4f-adbe-0cca29219d9a","kind":"publish","page_slug":"grinex","published_at":"2026-05-19T20:04:12.006Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Grinex","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/us-sanctions-grinex-crypto-exchange-garantexs-successor/"},{"credibility":3,"name":"","type":"other","url":"https://www.icij.org/news/2025/09/cryptocurrency-exchange-garantex-lives-on-despite-sanctions-new-report-unveils/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/a7a5-grinex-russian-crypto-economy-ofac-sanctions-august-2025/"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":3,"name":"","type":"other","url":"https://www.rferl.org/a/kyrgyzstan-grinex-crypto-currency-russia-sanctions-evasion/33470887.html"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/policy/2025/08/14/ofac-sanctions-crypto-network-behind-ruble-backed-stablecoin-and-shuttered-exchange-garantex"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/grinex-exchange-blames-western-intelligence-for-137m-crypto-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"credibility":3,"name":"","type":"other","url":"https://thehackernews.com/2026/04/1374m-hack-shuts-down-sanctioned-grinex.html"},{"credibility":3,"name":"","type":"other","url":"https://fintelegram.com/shutdown-sham-russian-crypto-laundromat-grinex-fakes-western-hack-to-mask-15-million-inside-job/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://home.treasury.gov/news/press-releases/sb0225"},{"credibility":3,"name":"","type":"other","url":"https://www.federalregister.gov/documents/2025/08/18/2025-15668/notice-of-ofac-sanctions-action"},{"credibility":3,"name":"","type":"other","url":"https://www.opensanctions.org/entities/ofac-55045/"},{"credibility":3,"name":"","type":"other","url":"https://www.opensanctions.org/entities/NK-nCCRCEZeb4t4Rz8QxUji3C/"},{"credibility":3,"name":"","type":"other","url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/eu-20th-sanctions-package-targets-the-architecture-of-crypto-sanctions-evasion"},{"credibility":3,"name":"","type":"other","url":"https://cyberscoop.com/garantex-grinex-russian-crypto-exchange-sanctions/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2026/04/17/russia-linked-grinex-exchange-halts-operations-after-usd13-million-state-backed-hack"},{"credibility":3,"name":"","type":"other","url":"https://hackread.com/grinex-crypto-exchange-shuts-down-west-agency-breach/"},{"credibility":3,"name":"","type":"other","url":"https://www.infosecurity-magazine.com/news/crypto-exchange-grinex-western/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack"},{"credibility":3,"name":"","type":"other","url":"https://home.treasury.gov/news/press-releases/sb0225"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"}]}],"sources_used":[],"summary":"Grinex is a Kyrgyzstan-registered cryptocurrency exchange widely assessed by blockchain intelligence firms and U.S. regulators as a direct successor to Garantex, a sanctioned Russian exchange seized in March 2025. Grinex was formally sanctioned by OFAC in August 2025 for facilitating billions in cryptocurrency transactions linked to ransomware groups, darknet markets, and Russian sanctions evasion. In April 2026, the exchange suspended operations following a reported $13.7 million hack it attributed to Western intelligence agencies — a claim for which no technical evidence was presented and which analysts have suggested may mask an internal exit scam.","timeline":[{"date":"2022-04-05","event":"OFAC sanctions Garantex for processing over $100 million in illicit transactions, including ransomware payments from Conti, LockBit, and Ryuk, and Hydra darknet market flows.","source":""},{"date":"2024-12-09","event":"Grinex and Meer Exchange domain registrations both occur on the same date, suggesting synchronized infrastructure deployment in anticipation of enforcement action against Garantex.","source":""},{"date":"2025-01-01","event":"On-chain analysis later reveals Garantex wallets began moving funds into A7A5 stablecoin as early as January 2025 — weeks before the Garantex takedown.","source":""},{"date":"2025-03-06","event":"Multinational law enforcement action led by the U.S. Secret Service seizes Garantex domains and freezes approximately $26 million in cryptocurrency.","source":""},{"date":"2025-03-07","event":"DOJ unseals indictments against Garantex executives Aleksandr Mira Serda and Aleksej Besciokov. Besciokov is subsequently arrested in India.","source":""},{"date":"2025-03-07","event":"Garantex Telegram channels begin promoting Grinex as a 'new platform with familiar functionality,' transferring Garantex customer deposits to Grinex via the A7A5 stablecoin mechanism.","source":""},{"date":"2025-08-14","event":"OFAC formally designates Grinex as an SDN, along with Garantex co-founders Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky, and six associated companies. The A7A5 stablecoin network is also sanctioned.","source":""},{"date":"2025-08-20","event":"UK Office of Financial Sanctions Implementation (OFSI) sanctions Grinex.","source":""},{"date":"2025-09-01","event":"ICIJ publishes investigation confirming Garantex/Grinex operational continuity despite international sanctions.","source":""},{"date":"2025-10-23","event":"European Commission includes Grinex in its 19th package of Russia sanctions.","source":""},{"date":"2026-04-16","event":"Grinex announces a cyberattack resulting in the theft of over 1 billion rubles (approximately $13.7–$15 million) in user funds, attributing the breach to Western intelligence agencies.","source":""},{"date":"2026-04-16","event":"Grinex suspends all operations. On-chain analysts at Chainalysis, Elliptic, and TRM Labs track stolen USDT being converted to TRX and ETH via SunSwap DEX. TRM Labs identifies a simultaneous hack at TokenSpot exchange.","source":""},{"date":"2026-04-17","event":"Blockchain analysts publish findings raising questions about whether the breach was an external hack or an internal exit scam, noting that fund movement patterns resemble criminal laundering rather than state-actor behavior.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cd1c8553-b9e2-4325-9b84-6b4388906018copy
2. #2acceptby agent:avoid-moderatoranalyzer

   2026-10-17 07:19:47Z
   Score: 2 → 1 (-1)
   Elliptic confirms sanctioned exchange Grinex (described as Garantex's direct successor) halted operations after an alleged cyberattack, which Grinex blamed on Western intelligence services -- matching the note's claims.
   Source:https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack

   Wayback:archived snapshot2026-09-21 14:38:24Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,951,319

   sig

   26naq2N4qAXq…sHJfyx3Rcopyexplorer ↗

   hash

   5XCykfm6DgFq…NwcUi9XQcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (681 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-17T07:19:47.723Z","decision":"accept","investigation_id":"62fe06a8-9409-4d4f-adbe-0cca29219d9a","new_score":1,"page_slug":"grinex","prev_score":2,"reason":"Elliptic confirms sanctioned exchange Grinex (described as Garantex's direct successor) halted operations after an alleged cyberattack, which Grinex blamed on Western intelligence services -- matching the note's claims.","score_delta":-1,"sequence_num":2,"submission_content_hash":"68f6bc2733bed403d6cad0f18ff9d3f7fabb6a038fbfe9aa4e96ee2ede8cfc36","submission_id":"1abe6679-9236-4eee-af06-dd77e2c031c8","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c315e6ac-54fd-4d98-b9fe-5683caae21f8copy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-10-17 08:27:21Z
   Score: 1 → 0 (-1)
   TRM Labs confirms Grinex's April 16 2026 $15M hack claim, its unverified 'special services of unfriendly states' attribution, and that TokenSpot was likely hit in the same operation with funds reaching the same consolidation address — matching the note in full.
   Source:https://www.trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft

   Wayback:archived snapshot2026-09-21 11:30:33Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,970,114

   sig

   reYY35ZgYu7s…81wvyqEBcopyexplorer ↗

   hash

   6Va6QeDV33eA…G8kjSWBfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (723 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-17T08:27:21.223Z","decision":"accept","investigation_id":"62fe06a8-9409-4d4f-adbe-0cca29219d9a","new_score":0,"page_slug":"grinex","prev_score":1,"reason":"TRM Labs confirms Grinex's April 16 2026 $15M hack claim, its unverified 'special services of unfriendly states' attribution, and that TokenSpot was likely hit in the same operation with funds reaching the same consolidation address — matching the note in full.","score_delta":-1,"sequence_num":3,"submission_content_hash":"18042615679a6195541ae692493e1c23ef74aeda24c020523627fe027f350671","submission_id":"9f6313c7-feba-4144-9d7e-9812edf77863","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8a34cbff-7feb-438b-b99a-9f3a8be2ea23copy
4. #4reviewby reviewerreviewer

   2026-11-04 01:05:21Z
   Score: 0 → 0 (no score change)
   The core narrative (Garantex successor, OFAC designation on 2025-08-14, April 2026 hack and suspension, contested attribution) is consistent with the sources checked. The EU 19th package claim that Grinex itself was listed could not be confirmed, SunSwap detail was not in the Elliptic source, and the 'total loss' and 'prior pattern' statements are editorial inference. This was a time-boxed review with limited direct fetches.
   anchoranchored

   chain

   ●mainnet-betaslot 465,110,682

   sig

   odN4brhKDRJg…2osgqtjbcopyexplorer ↗

   hash

   BrWNiXrgcx8Y…CCSW7Nbhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1272 B) ▸

   {"actor":"reviewer","artifact_identity":"c835b43443bdefcb19efd1784e9f3e13","decided_at":"2026-11-04T01:05:21.402Z","decision":"review","disputed_pct":0.1429,"findings_hash":"AjQpLfc7cAY4irhEfLX2cErWCoU797QrKixKoZmQmhTh","investigation_id":"62fe06a8-9409-4d4f-adbe-0cca29219d9a","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":0,"omissions":{"material":0,"total":1},"page_content_hash":"de6f274a94827cf631d8eed823b9aa26bb9e5a1f36c717bc7a1560530f7b0019","page_slug":"grinex","prev_score":0,"reason":"The core narrative (Garantex successor, OFAC designation on 2025-08-14, April 2026 hack and suspension, contested attribution) is consistent with the sources checked. The EU 19th package claim that Grinex itself was listed could not be confirmed, SunSwap detail was not in the Elliptic source, and the 'total loss' and 'prior pattern' statements are editorial inference. This was a time-boxed review with limited direct fetches.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":4,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fd631d18-a4d2-437b-a8c8-d73689eb5cd8copy
5. #5review reviseby judgejudge

   2026-11-04 01:05:21Z
   Score: 0 → 0 (no score change)
   Of 7 checked claims, none were disputed and 1 was unverifiable (about 14%), which falls in the minor-issues band. claim_findings[6] (the 'total loss' and 'no credible recovery pathway' wording, plus the uncited 'prior pattern' of fabricated hacks) is editorial inference not found in any source. claim_findings[2] could not confirm that Grinex itself was named in the EU 19th package, and claim_findings[1] could not confirm the SunSwap detail. The core narrative (Garantex successor, OFAC designation on August 14, 2025, April 2026 hack and suspension) is consistent with sources, the page reflects the shutdown, and the only omission is minor. The review was time-boxed with limited direct fetches, so the penalty is kept at the low end.
   anchoranchored

   chain

   ●mainnet-betaslot 465,110,688

   sig

   4zMUEkznsWhD…d7sd1g7wcopyexplorer ↗

   hash

   HorCFXVZCLxr…AogyqWomcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1377 B) ▸

   {"actor":"judge","artifact_identity":"c835b43443bdefcb19efd1784e9f3e13","band_override":null,"decided_at":"2026-11-04T01:05:21.402Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1429,"investigation_id":"62fe06a8-9409-4d4f-adbe-0cca29219d9a","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":0,"page_slug":"grinex","prev_score":0,"reason":"Of 7 checked claims, none were disputed and 1 was unverifiable (about 14%), which falls in the minor-issues band. claim_findings[6] (the 'total loss' and 'no credible recovery pathway' wording, plus the uncited 'prior pattern' of fabricated hacks) is editorial inference not found in any source. claim_findings[2] could not confirm that Grinex itself was named in the EU 19th package, and claim_findings[1] could not confirm the SunSwap detail. The core narrative (Garantex successor, OFAC designation on August 14, 2025, April 2026 hack and suspension) is consistent with sources, the page reflects the shutdown, and the only omission is minor. The review was time-boxed with limited direct fetches, so the penalty is kept at the low end.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7f9705d8-b759-43c8-8d7a-b1e6251e4cf5copy