Stolen $13.7M From Grinex Hack Moves to Major Exchanges, Raising Insider Laundering Concerns

Funds stolen from the Russian cryptocurrency exchange Grinex in a large-scale cyberattack this April have begun moving through the blockchain, raising new questions about whether the original hackers or an insider is now attempting to launder the money. According to blockchain analytics firm Chainalysis, over $13.7 million in stolen assets are being routed through mixers and cross-chain bridges toward major exchanges for withdrawal.

Fund Movement Raises New Questions

The movement of the stolen funds, which had remained largely dormant for weeks, signals a deliberate effort to obfuscate the trail and cash out. Chainalysis noted in its analysis that it is currently unclear whether the activity is being conducted by the original threat actors who breached Grinex or by an insider with access to the stolen wallets. The distinction is critical, as it could point to either a sophisticated laundering operation or an internal compromise at the exchange itself.

Grinex’s Troubled Origins

Grinex launched just two weeks after the sanctioned Russian exchange Garantex was shut down in March 2025. Industry analysts and security researchers have long suspected that Grinex is a rebranded version of Garantex, potentially operating with the same team, infrastructure, and user base. Garantex had been under international sanctions for its role in facilitating ransomware payments and illicit finance. The close timing of Grinex’s launch and the similarities in operational patterns have drawn scrutiny from regulators and blockchain forensic firms.

Why This Matters

The case highlights ongoing challenges in policing the cryptocurrency ecosystem, particularly around exchanges operating in jurisdictions with limited regulatory oversight. The use of mixers and cross-chain bridges to move stolen funds is a well-known technique employed by cybercriminals to evade tracking. If the funds are successfully withdrawn at major exchanges, it could undermine efforts to hold bad actors accountable and signal to other criminals that the crypto financial system remains exploitable.

Conclusion

The movement of the stolen Grinex funds marks a critical juncture in the investigation. Whether the laundering is carried out by external hackers or an insider, the incident underscores the vulnerabilities in the crypto exchange landscape and the urgent need for stronger compliance measures. As the funds continue to flow, law enforcement and analytics firms will be watching closely to see if they can be frozen or traced back to those responsible.

FAQs

Q1: What is a crypto mixer and why is it used in this case?
A crypto mixer is a service that blends multiple transactions together to obscure the origin of funds. In this case, the hackers or launderers are using mixers to break the on-chain link between the stolen funds and their eventual destination, making it harder for investigators to trace the money.

Q2: How is Grinex connected to the sanctioned exchange Garantex?
Grinex launched only two weeks after Garantex was shut down in March 2025. Security researchers suspect Grinex is a rebranded version of Garantex, potentially operated by the same team and using the same infrastructure, though this has not been officially confirmed.

Q3: What are cross-chain bridges and how do they help launder stolen crypto?
Cross-chain bridges allow users to transfer assets from one blockchain to another. By moving stolen funds across different blockchains, launderers can further complicate the tracking process, as each blockchain has its own record-keeping system and may not be easily cross-referenced.