Verify a decision

{"actor":"system:backfill","investigation_id":"a85c028a-b4a7-4597-adef-2b66c793daa9","kind":"publish","page_slug":"tokenspot","published_at":"2026-10-09T12:25:12.592Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"TokenSpot","sections":[{"content":"TRM Labs, a blockchain intelligence firm, assessed with what it described as high confidence that TokenSpot and Grinex, while separate legal entities registered in Kyrgyzstan, run on shared wallet infrastructure and function as parts of the same operation. TRM reported that six TRON addresses are attributed to both exchanges and that a single collection address gathers leftover TRX fee balances from both platforms. Based on this overlap, TRM concluded that TokenSpot likely operates as a front company giving Grinex a second, separately registered channel for moving funds. TRM further reported that TokenSpot processed more than $4 billion in transaction volume between December 2023 and March 2026, and that it sent a combined $269.2 million to Grinex and Garantex and received $285.7 million back from them after the UK had already designated each of those exchanges. An earlier TRM estimate put the TokenSpot-to-Garantex/Grinex transfer figure at $88 million sent and $12 million received, with the larger figures appearing in TRM's later follow-up analysis. TRM also noted that TokenSpot sent more than $257.5 million to the broader 'A7' sanctions-evasion network associated with the A7A5 ruble-backed stablecoin. These findings are the product of a private analytics firm's on-chain methodology rather than a court judgment or government sanctions designation naming TokenSpot directly; no OFAC or UK sanctions listing for TokenSpot itself was found.","heading":"Front-Company Determination (TRM Labs)","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Kyrgyzstani Exchange TokenSpot Determined to Be Front Company for Sanctioned Russian Exchange Grinex","type":"research","url":"https://www.trmlabs.com/resources/blog/kyrgyzstani-exchange-tokenspot-determined-to-be-front-company-for-sanctioned-russian-exchange-grinex"}]},{"content":"On April 16, 2026, Grinex announced it had suffered a large-scale cyberattack resulting in the theft of approximately $15 million (reported as over 1 billion rubles) in user funds, mainly USDT on the TRON network, which the attacker swapped for TRX via the SunSwap decentralized exchange before consolidating the proceeds. Grinex published a list of 54 wallet addresses it attributed to the attacker and blamed 'the special services of unfriendly states,' a characterization TRM Labs said it could not independently verify; TRM instead assessed the incident as more likely an external cyber operation than an internal exit scam, citing the relatively low total value stolen and the indiscriminate targeting of wallets across platforms. TRM's own tracing identified roughly 70 addresses connected to the theft, about 16 more than Grinex had disclosed. Separately, TRM found that TokenSpot was hit by what it assessed to be the same attacker: two TokenSpot addresses, out of service around April 15, 2026, sent a combined total of less than $5,000 to the identical TRON consolidation address used by the Grinex-linked wallets. TokenSpot's Telegram channel announced 'technical work' and a brief outage on April 15, 2026, followed by an announcement the next day that full operations had resumed. TRM noted that one of the addresses Grinex later listed as attacker-controlled had also collected deposits on behalf of TokenSpot, which TRM said reinforced its front-company assessment. Elliptic separately confirmed outflows of roughly $15 million in USDT from Grinex-controlled accounts around midday UTC, but its published analysis did not address TokenSpot.","heading":"April 2026 Cyberattack Linking TokenSpot to Grinex","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Sanctioned Russian Exchange Grinex and Kyrgyzstani Exchange TokenSpot Hit in USD 15 Million Theft","type":"research","url":"https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"credibility":2,"name":"Elliptic: Sanctioned Russia-linked crypto exchange Grinex halts operations following alleged hack","type":"research","url":"https://www.elliptic.co/insights/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack/"},{"credibility":2,"name":"Cointelegraph: Grinex hack: $14M crypto exchange suspends trading","type":"news_article","url":"https://cointelegraph.com/news/grinex-hack-14m-crypto-exchange-suspends-trading"}]},{"content":"Grinex is widely assessed by blockchain-analytics firms and Western authorities to be the direct successor to Garantex, a Russian exchange first sanctioned by OFAC in April 2022 and whose domains were seized in a multinational law-enforcement action in March 2025. On August 14, 2025, OFAC re-designated Garantex and separately sanctioned Grinex, describing it as the successor exchange that Garantex staff created to continue moving customer funds and evade sanctions after the March 2025 disruption. The same action designated three Garantex/Grinex-linked executives (Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky) and six associated entities, including Old Vector, the issuer of the A7A5 ruble-backed stablecoin central to the network's operations. The UK designated Grinex LLC on August 20, 2025. Grinex has reportedly handled over $6 billion in crypto transactions by Elliptic's count, and the A7A5 token has been used in transactions Elliptic estimated at over $1 billion per day, mostly routed through Grinex. TRM Labs research cited in connection with this network found that more than 90% of illicit crypto inflows to Kyrgyz-registered exchanges between February 2022 and July 2025 were tied to sanctions-related activity. TokenSpot itself has not been named in the OFAC or UK sanctions designations identified in available reporting; its implication rests on TRM Labs' on-chain attribution linking it to Grinex's infrastructure.","heading":"Grinex and Garantex: Sanctions Background","severity":"critical","sources":[{"credibility":2,"name":"The Hacker News: US Sanctions Garantex and Grinex Over $100M in Ransomware-Linked Illicit Crypto Transactions","type":"news_article","url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"credibility":1,"name":"BleepingComputer: US sanctions Grinex crypto exchange, Garantex's successor","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/us-sanctions-grinex-crypto-exchange-garantexs-successor"},{"credibility":2,"name":"Elliptic: Sanctioned Russia-linked crypto exchange Grinex halts operations following alleged hack","type":"research","url":"https://www.elliptic.co/insights/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack/"},{"credibility":2,"name":"TRM Labs: Kyrgyzstani Exchange TokenSpot Determined to Be Front Company for Sanctioned Russian Exchange Grinex","type":"research","url":"https://www.trmlabs.com/resources/blog/kyrgyzstani-exchange-tokenspot-determined-to-be-front-company-for-sanctioned-russian-exchange-grinex"}]},{"content":"TokenSpot is registered in Kyrgyzstan, a jurisdiction that TRM Labs research has flagged for a disproportionate share of sanctions-linked illicit crypto activity: TRM found that more than 90% of illicit crypto inflows to Kyrgyz-registered exchanges from February 2022 through July 2025 were tied to sanctions-related activity. Reporting on the broader Grinex/A7A5 network indicates that Kyrgyz financial regulators, including the Ministry of Finance and the National Bank of Kyrgyzstan, have stated that oversight of crypto exchanges falls outside their jurisdiction, leaving platforms like TokenSpot operating with limited local regulatory scrutiny despite the scale of funds alleged to flow through them. No independent government or court finding confirming TokenSpot's front-company status was identified in available reporting; the determination remains that of a private blockchain-analytics firm.","heading":"Regulatory Status and Jurisdictional Gaps","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Kyrgyzstani Exchange TokenSpot Determined to Be Front Company for Sanctioned Russian Exchange Grinex","type":"research","url":"https://www.trmlabs.com/resources/blog/kyrgyzstani-exchange-tokenspot-determined-to-be-front-company-for-sanctioned-russian-exchange-grinex"}]}],"sources_used":[{"credibility":2,"name":"TRM Labs: Sanctioned Russian Exchange Grinex and Kyrgyzstani Exchange TokenSpot Hit in USD 15 Million Theft","type":"research","url":"https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"credibility":2,"name":"TRM Labs: Kyrgyzstani Exchange TokenSpot Determined to Be Front Company for Sanctioned Russian Exchange Grinex","type":"research","url":"https://www.trmlabs.com/resources/blog/kyrgyzstani-exchange-tokenspot-determined-to-be-front-company-for-sanctioned-russian-exchange-grinex"},{"credibility":2,"name":"Elliptic: Sanctioned Russia-linked crypto exchange Grinex halts operations following alleged hack","type":"research","url":"https://www.elliptic.co/insights/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack/"},{"credibility":2,"name":"Cointelegraph: Grinex hack: $14M crypto exchange suspends trading","type":"news_article","url":"https://cointelegraph.com/news/grinex-hack-14m-crypto-exchange-suspends-trading"},{"credibility":2,"name":"The Hacker News: US Sanctions Garantex and Grinex Over $100M in Ransomware-Linked Illicit Crypto Transactions","type":"news_article","url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"credibility":1,"name":"BleepingComputer: US sanctions Grinex crypto exchange, Garantex's successor","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/us-sanctions-grinex-crypto-exchange-garantexs-successor"}],"summary":"TokenSpot is a Kyrgyzstan-registered cryptocurrency exchange that blockchain-analytics firm TRM Labs has assessed, with high confidence, to be a front company for Grinex, the OFAC- and UK-sanctioned Russian exchange widely regarded as the successor to Garantex. On-chain analysis ties TokenSpot's wallet infrastructure directly to Grinex's fund-consolidation addresses and to the A7A5 ruble-pegged stablecoin network used for sanctions evasion, and TokenSpot was hit by the same attacker in an April 2026 cyberattack that drained roughly $15 million from Grinex. TokenSpot itself does not appear on the OFAC or UK sanctions lists; the front-company determination rests on TRM Labs' private on-chain analysis rather than a court or regulatory finding.","timeline":[{"date":"2022-04","event":"OFAC first sanctions Garantex, the Russian exchange later succeeded by Grinex.","source":"The Hacker News","source_url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"date":"2023-12","event":"Start of the roughly 27-month period (through March 2026) over which TRM Labs says TokenSpot processed more than $4 billion in transaction volume.","source":"TRM Labs","source_url":"https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"date":"2024-12","event":"Grinex is incorporated in Kyrgyzstan, emerging as the assessed successor to Garantex.","source":"TRM Labs","source_url":"https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"date":"2025-03","event":"Multinational law enforcement action seizes Garantex's domains, disrupting the exchange and prompting the move of operations and customer funds to Grinex.","source":"The Hacker News","source_url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"date":"2025-08-14","date_evidence":"On August 14, 2025, the U.S. Treasury's Office of Foreign Assets Control (OFAC) re-designated Garantex and sanctioned Grinex, which it described as Garantex's successor exchange.","event":"OFAC re-designates Garantex and sanctions Grinex, along with several Garantex/Grinex executives and the A7A5 stablecoin issuer Old Vector.","source":"The Hacker News / BleepingComputer","source_url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"date":"2025-08-20","date_evidence":"The UK designated Grinex LLC six days later, on August 20, 2025.","event":"The United Kingdom designates Grinex LLC under its sanctions regime.","source":"WebSearch synthesis citing TRM Labs reporting","source_url":"https://www.trmlabs.com/resources/blog/kyrgyzstani-exchange-tokenspot-determined-to-be-front-company-for-sanctioned-russian-exchange-grinex"},{"date":"2026-04-15","date_evidence":"TokenSpot's Telegram channel announced 'technical work' and a brief platform outage on April 15, 2026.","event":"TokenSpot goes offline for 'technical work'; TRM later attributes this to the same attacker who hit Grinex, with two TokenSpot addresses sending funds to the Grinex attacker's consolidation address.","source":"TRM Labs","source_url":"https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"date":"2026-04-16","date_evidence":"Grinex announced on April 16, 2026 that it had been hacked.","event":"Grinex announces a cyberattack resulting in the theft of approximately $15 million in user funds; TokenSpot announces it has resumed full operations after its own brief outage.","source":"TRM Labs / Elliptic / Cointelegraph","source_url":"https://trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"date":"2026","event":"TRM Labs publishes a follow-up analysis concluding TokenSpot and Grinex share wallet infrastructure, determining TokenSpot is a front company for Grinex and citing updated figures of $269.2 million sent and $285.7 million received between TokenSpot and Grinex/Garantex after their UK designations.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/kyrgyzstani-exchange-tokenspot-determined-to-be-front-company-for-sanctioned-russian-exchange-grinex"}]},"v":1}