Grinex’s April theft: transaction evidence does not identify an attacker

The April 2026 Grinex incident involved three different kinds of evidence: an exchange's account of a theft, blockchain researchers' tracing and an existing sanctions record. Combining them into one narrative can make an allegation about the attacker sound as well established as an observed transfer.

The distinction matters especially here. Grinex blamed hostile state services, while researchers identified suspicious fund movements without independently confirming that attribution. This analysis examines that evidential boundary. It does not advise moving assets, using an alternative venue or restructuring a cryptocurrency portfolio.

Keep the loss estimates attributed

Ars Technica's April 17 report described Grinex's initial claim of a loss around thirteen million dollars and researchers' higher estimate near fifteen million. Those figures should retain their source and context rather than be treated as two inconsistent final audited balances.

In its own analysis, TRM Labs identified approximately seventy addresses connected to the incident, about sixteen more than Grinex had publicly disclosed. It also linked transfers from TokenSpot addresses to the same consolidation destination.

The different address sets explain why an initial statement and a research estimate may have different scope. They do not prove that every address a researcher associates with an exchange corresponds to a distinct customer, or that the total is a completed reconciliation of all customer claims.

Tracing funds and identifying an operator are different tasks

TRM said it had not independently verified Grinex's allegation that foreign state services were responsible. It assessed an external operation as more likely than an exit scam, based on the patterns it described. That is an analytical assessment, not an identified perpetrator or a judicial finding.

Elliptic's April 16 account likewise described suspicious outgoing transactions totalling approximately fifteen million dollars in USDT and attributed the hostile-state allegation to Grinex. Observing transfers does not, by itself, reveal the real-world person or organization controlling the destination.

The missing step is important. A timeline and a flow of assets can support a loss estimate or a connection among wallets. They cannot substitute for evidence of access method, operator identity or state direction. A politically forceful explanation does not eliminate that gap.

Sanctions history is a separate documented fact

The U.S. Treasury's August 14, 2025 announcement designated Grinex as Garantex's successor while taking action against associated people and entities. This predated the reported theft; it was not a designation first triggered by the April incident.

That official record supplies essential context for describing the exchange. It does not establish who stole from it months later, and an incident affecting a sanctioned entity does not make every subsequent claim about the incident true.

The earlier article converted this context into instructions to withdraw, choose other platforms and use alternative trading routes. Those instructions were unsupported by the incident evidence and omitted the need to establish the applicable restrictions. They have been removed rather than repackaged as a generic safety checklist.

An outage is not a solvency assessment

Grinex's reported suspension of operations was an operational response. It did not supply a full account of assets, liabilities, recoveries or eventual customer reimbursement. A theft estimate and a balance-sheet assessment answer different questions.

The same distinction limits the conclusions that can be drawn from security labels, reserve snapshots and insurance descriptions. None of those appeared in this incident record as proof that a replacement venue would protect a particular person's funds. The previous arbitrary custody allocations and exchange-exposure percentages therefore had no basis here.

This article also does not infer present withdrawal availability from an April announcement. A historical interruption and a current service status require different dated evidence.

What the record supports

The defensible account is that Grinex reported a theft, researchers traced a roughly fifteen-million-dollar incident with related TokenSpot activity, and the exchange's state-actor attribution remained unverified by the cited researchers. Treasury's earlier designation is independently documented context.

Keeping loss measurement, attribution, operational status and sanctions history separate preserves the significance of the incident without inventing a culprit or turning uncertain breach reporting into financial instructions.