Tools Crypto Exploit Tracker exploit-0056
Exploit record
Grinex
- Loss
- $15M
- Attack vector
- Private Key Compromise
- Chain
- Tron
- Sector
- CEX
What happened
Sanctioned Russia-linked exchange Grinex was drained of roughly $13.7–15 million from its hot wallets on 15 April 2026 and halted all operations the following day.
The theft began around 12:00 UTC on 15 April, with stolen USDT swapped into TRX and ETH to avoid issuer freezes and split across dozens of wallets; TRM Labs later identified around 70 drained addresses, raising the confirmed estimate to about $15 million. Grinex, the successor to sanctioned exchange Garantex, blamed 'Western special services', a claim no independent researcher has verified. Elliptic and Chainalysis both documented the shutdown of the exchange.
Sources
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026