TokenSpot
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4jnnFa…rxv8Summary
TokenSpot is a Kyrgyzstan-registered cryptocurrency exchange that blockchain-analytics firm TRM Labs has assessed, with high confidence, to be a front company for Grinex, the OFAC- and UK-sanctioned Russian exchange widely regarded as the successor to Garantex. On-chain analysis ties TokenSpot's wallet infrastructure directly to Grinex's fund-consolidation addresses and to the A7A5 ruble-pegged stablecoin network used for sanctions evasion, and TokenSpot was hit by the same attacker in an April 2026 cyberattack that drained roughly $15 million from Grinex. TokenSpot itself does not appear on the OFAC or UK sanctions lists; the front-company determination rests on TRM Labs' private on-chain analysis rather than a court or regulatory finding.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(9 events)
April 2022
OFAC first sanctions Garantex, the Russian exchange later succeeded by Grinex.
The Hacker NewsDecember 2023
Start of the roughly 27-month period (through March 2026) over which TRM Labs says TokenSpot processed more than $4 billion in transaction volume.
TRM LabsDecember 2024
Grinex is incorporated in Kyrgyzstan, emerging as the assessed successor to Garantex.
TRM LabsMarch 2025
Multinational law enforcement action seizes Garantex's domains, disrupting the exchange and prompting the move of operations and customer funds to Grinex.
The Hacker News14 August 2025
OFAC re-designates Garantex and sanctions Grinex, along with several Garantex/Grinex executives and the A7A5 stablecoin issuer Old Vector.
The Hacker News / BleepingComputer20 August 2025
The United Kingdom designates Grinex LLC under its sanctions regime.
WebSearch synthesis citing TRM Labs reporting15 April 2026
TokenSpot goes offline for 'technical work'; TRM later attributes this to the same attacker who hit Grinex, with two TokenSpot addresses sending funds to the Grinex attacker's consolidation address.
TRM Labs16 April 2026
Grinex announces a cyberattack resulting in the theft of approximately $15 million in user funds; TokenSpot announces it has resumed full operations after its own brief outage.
TRM Labs / Elliptic / Cointelegraph2026
TRM Labs publishes a follow-up analysis concluding TokenSpot and Grinex share wallet infrastructure, determining TokenSpot is a front company for Grinex and citing updated figures of $269.2 million sent and $285.7 million received between TokenSpot and Grinex/Garantex after their UK designations.
TRM LabsDecision Log
- slot 454865719 · hash E5NiuWkExriRHewNpF9HMphtk4WWa6L3JSQBgSogvVF6
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 5 of 6 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 10/9/2026, 12:25:06 PM
last updated: 10/9/2026, 12:25:06 PM
avoid.net — verified advice for a post-truth world