Fact-check findings
What an automated fact-checker found when it re-read Grinex against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Risk Assessment
“resulted in the total loss of approximately $13.7–$15 million in user funds with no credible recovery pathway”
reviewerGrinex was the 'total loss' of user funds with no credible recovery pathwaySources report theft of ~$13-15M; none fetched states users' losses are total or unrecoverable. This is editorial inference. Also the page states a 'prior pattern of Russian-linked exchanges fabricating external hacks' with no cited example.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in section: Security History
“On April 16, 2026 at approximately 12:00 UTC, Grinex announced it had suffered a cyberattack resulting in the theft of over 1 billion rubles (approximately $13.7–$15 million) in user funds.”
reviewerGrinex announced a cyberattack on April 16, 2026 involving over 1 billion rubles (~$13.7-15M) and blamed unfriendly states' special servicesBroadly supported; the 12:00 UTC outflow time falls on Wednesday (April 15), so the announcement/outflow date is ambiguous. Not corrected because the announcement date of April 16 is consistent with multiple sources. - #2[partially supported][awaiting moderator]in section: Security History
“The exfiltrated funds consisted primarily of fiat-backed stablecoins (USDT) that were rapidly converted to Tron (TRX) and Ethereum (ETH) using the SunSwap decentralized exchange protocol”
reviewerStolen USDT was converted using SunSwap, previously used by Garantex; Elliptic flagged conversion to freeze-resistant assetsConversion to TRX/ETH confirmed; SunSwap detail not confirmed in the Elliptic piece (other cited sources not fetched within time budget). - #3[partially supported][awaiting moderator]in section: Regulatory Status
“The European Commission included Grinex in its 19th package of Russia sanctions on October 23, 2025”
reviewerThe EU included Grinex in its 19th sanctions package on October 23, 2025Package date is correct, but I could not confirm Grinex itself was named in it; sources describe A7A5 entities and a Paraguay-based platform. Cited page is about the 20th package. Needs primary Council annex check.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #4[confirmed][no action needed]in section: Regulatory Status
“On August 14, 2025, OFAC formally designated Grinex as a Specially Designated National (SDN)”
reviewerOFAC designated Grinex as SDN on August 14, 2025 along with Garantex co-founders and six companiesConsistent across multiple sources; Treasury page not fetched directly. - #5[confirmed][no action needed]in the summary
“In April 2026, the exchange suspended operations following a reported $13.7 million hack it attributed to Western intelligence agencies”
reviewerGrinex suspended operations in April 2026 after the reported hackConfirmed. - #6[confirmed][no action needed]in section: Security History
“Elliptic's analysis similarly flagged that funds were converted to assets resistant to centralized freezing.”
reviewerAnalysts suggested an internal exit scam; Elliptic reportedly flagged exit-scam questionsConfirmed. Note the page's timeline[13] says analysts noted patterns, but Elliptic does not mention exit scam; the exit scam claim is attributed to Fintelegram on the page, which is appropriately framed.