Summary
Grinex, the sanctioned successor to the Russian exchange Garantex, suspended operations yesterday following a claimed 1 billion ruble ($13.7 million) cyberattack. The exchange blamed “foreign intelligence services of unfriendly states” for the breach.
However, on-chain data shows the alleged hacker rapidly swapping exfiltrated fiat-backed stablecoins for Tron (TRX) using a decentralized exchange (DEX) previously favored by Garantex.
Because Western law enforcement typically freezes centralized stablecoins rather than swapping them, the movement of funds raises questions about who actually exfiltrated the funds.
At the time of writing, the exfiltrated funds remain as a balance on a single address; as the funds move downstream, forensic blockchain evidence will provide additional clues into who might be responsible for the alleged hack.
