Verify a decision

{"actor":"system:backfill","investigation_id":"62fe06a8-9409-4d4f-adbe-0cca29219d9a","kind":"publish","page_slug":"grinex","published_at":"2026-05-19T20:04:12.006Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Grinex","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/us-sanctions-grinex-crypto-exchange-garantexs-successor/"},{"credibility":3,"name":"","type":"other","url":"https://www.icij.org/news/2025/09/cryptocurrency-exchange-garantex-lives-on-despite-sanctions-new-report-unveils/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/a7a5-grinex-russian-crypto-economy-ofac-sanctions-august-2025/"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"},{"credibility":3,"name":"","type":"other","url":"https://www.rferl.org/a/kyrgyzstan-grinex-crypto-currency-russia-sanctions-evasion/33470887.html"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/policy/2025/08/14/ofac-sanctions-crypto-network-behind-ruble-backed-stablecoin-and-shuttered-exchange-garantex"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/grinex-exchange-blames-western-intelligence-for-137m-crypto-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/sanctioned-russian-exchange-grinex-and-kyrgyzstani-exchange-tokenspot-hit-in-usd-15-million-theft"},{"credibility":3,"name":"","type":"other","url":"https://thehackernews.com/2026/04/1374m-hack-shuts-down-sanctioned-grinex.html"},{"credibility":3,"name":"","type":"other","url":"https://fintelegram.com/shutdown-sham-russian-crypto-laundromat-grinex-fakes-western-hack-to-mask-15-million-inside-job/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://home.treasury.gov/news/press-releases/sb0225"},{"credibility":3,"name":"","type":"other","url":"https://www.federalregister.gov/documents/2025/08/18/2025-15668/notice-of-ofac-sanctions-action"},{"credibility":3,"name":"","type":"other","url":"https://www.opensanctions.org/entities/ofac-55045/"},{"credibility":3,"name":"","type":"other","url":"https://www.opensanctions.org/entities/NK-nCCRCEZeb4t4Rz8QxUji3C/"},{"credibility":3,"name":"","type":"other","url":"https://thehackernews.com/2025/08/us-sanctions-garantex-and-grinex-over.html"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/eu-20th-sanctions-package-targets-the-architecture-of-crypto-sanctions-evasion"},{"credibility":3,"name":"","type":"other","url":"https://cyberscoop.com/garantex-grinex-russian-crypto-exchange-sanctions/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2026/04/17/russia-linked-grinex-exchange-halts-operations-after-usd13-million-state-backed-hack"},{"credibility":3,"name":"","type":"other","url":"https://hackread.com/grinex-crypto-exchange-shuts-down-west-agency-breach/"},{"credibility":3,"name":"","type":"other","url":"https://www.infosecurity-magazine.com/news/crypto-exchange-grinex-western/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/sanctioned-grinex-exchange-suspends-operations/"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/sanctioned-russia-linked-crypto-exchange-grinex-halts-operations-following-alleged-hack"},{"credibility":3,"name":"","type":"other","url":"https://home.treasury.gov/news/press-releases/sb0225"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks"}]}],"sources_used":[],"summary":"Grinex is a Kyrgyzstan-registered cryptocurrency exchange widely assessed by blockchain intelligence firms and U.S. regulators as a direct successor to Garantex, a sanctioned Russian exchange seized in March 2025. Grinex was formally sanctioned by OFAC in August 2025 for facilitating billions in cryptocurrency transactions linked to ransomware groups, darknet markets, and Russian sanctions evasion. In April 2026, the exchange suspended operations following a reported $13.7 million hack it attributed to Western intelligence agencies — a claim for which no technical evidence was presented and which analysts have suggested may mask an internal exit scam.","timeline":[{"date":"2022-04-05","event":"OFAC sanctions Garantex for processing over $100 million in illicit transactions, including ransomware payments from Conti, LockBit, and Ryuk, and Hydra darknet market flows.","source":""},{"date":"2024-12-09","event":"Grinex and Meer Exchange domain registrations both occur on the same date, suggesting synchronized infrastructure deployment in anticipation of enforcement action against Garantex.","source":""},{"date":"2025-01-01","event":"On-chain analysis later reveals Garantex wallets began moving funds into A7A5 stablecoin as early as January 2025 — weeks before the Garantex takedown.","source":""},{"date":"2025-03-06","event":"Multinational law enforcement action led by the U.S. Secret Service seizes Garantex domains and freezes approximately $26 million in cryptocurrency.","source":""},{"date":"2025-03-07","event":"DOJ unseals indictments against Garantex executives Aleksandr Mira Serda and Aleksej Besciokov. Besciokov is subsequently arrested in India.","source":""},{"date":"2025-03-07","event":"Garantex Telegram channels begin promoting Grinex as a 'new platform with familiar functionality,' transferring Garantex customer deposits to Grinex via the A7A5 stablecoin mechanism.","source":""},{"date":"2025-08-14","event":"OFAC formally designates Grinex as an SDN, along with Garantex co-founders Sergey Mendeleev, Aleksandr Mira Serda, and Pavel Karavatsky, and six associated companies. The A7A5 stablecoin network is also sanctioned.","source":""},{"date":"2025-08-20","event":"UK Office of Financial Sanctions Implementation (OFSI) sanctions Grinex.","source":""},{"date":"2025-09-01","event":"ICIJ publishes investigation confirming Garantex/Grinex operational continuity despite international sanctions.","source":""},{"date":"2025-10-23","event":"European Commission includes Grinex in its 19th package of Russia sanctions.","source":""},{"date":"2026-04-16","event":"Grinex announces a cyberattack resulting in the theft of over 1 billion rubles (approximately $13.7–$15 million) in user funds, attributing the breach to Western intelligence agencies.","source":""},{"date":"2026-04-16","event":"Grinex suspends all operations. On-chain analysts at Chainalysis, Elliptic, and TRM Labs track stolen USDT being converted to TRX and ETH via SunSwap DEX. TRM Labs identifies a simultaneous hack at TokenSpot exchange.","source":""},{"date":"2026-04-17","event":"Blockchain analysts publish findings raising questions about whether the breach was an external hack or an internal exit scam, noting that fund movement patterns resemble criminal laundering rather than state-actor behavior.","source":""}]},"v":1}