PANews reported on April 17 that, according to The Block, Grinex, an exchange registered in Kyrgyzstan with ties to the Russian cryptocurrency market, suspended withdrawals and trading after suffering a massive cyberattack. The exchange's website stated that over 1 billion rubles (approximately $13.1 million) were stolen, and that the attack was a "coordinated action aimed at undermining Russia's financial sovereignty," requiring resources and technology exclusive to "hostile states" to carry out.

Blockchain analytics firm Elliptic reports that suspected attackers stole approximately $15 million worth of USDT from Grinex-related wallets, subsequently routing it through the Tron and Ethereum networks and exchanging it for TRX and ETH. This move may have been an attempt to mitigate the risk of being frozen by Tether. Grinex, considered the successor to the previously sanctioned Garantex exchange, inherited Garantex's liquidity and users after its closure and became a major venue for ruble-to-cryptocurrency trading.