Crypto Exchange Greenex to Halt Operations Following Major Hack
Greenex, a cryptocurrency exchange operating under a Kyrgyzstan registration and U.S. license, has announced it will shut down after hackers, allegedly linked to a “Western special agency,” stole $13 million.
TRM researchers confirmed the breach, identifying around 70 compromised wallets with the theft’s estimated value rising to $15 million—actually about 16 percent more than Greenex initially disclosed. Details about how the hackers breached Greenex’s security measures haven’t been revealed by either TRM or blockchain analytics firm Elliptic. Greenex has claimed it has faced near-constant attacks since launching 16 months ago, with this latest incident particularly affecting users in Russia.
Concerns Over Financial Sovereignty
“The digital footprint and nature of the attack suggest that only unfriendly state entities possess the unprecedented resources and technology involved,” said Greenex. “Preliminary data indicates this was a coordinated effort aimed at undermining Russia’s financial sovereignty.”
Greenex further remarked, “The attack compelled us to suspend operations. We’ve passed all available information to law enforcement and submitted a request to initiate a criminal investigation related to our infrastructure.”
TRM also indicated that another exchange, TokenSpot, based in Kyrgyzstan, appears to have been targeted in the same incident. Some addresses from TokenSpot allegedly transferred funds to a wallet associated with the affected Greenex wallets, and both platforms were out of operation as of Wednesday, implying a coordinated attack.
TRM noted that TokenSpot is believed to be a front for Greenex, which was authorized by the U.S. Treasury in the previous year. The Office of Foreign Assets Control stated that Greenex is a rebranding of Galantex, a previously sanctioned exchange. In 2022, it was communicated that Galantex had facilitated ransomware attacks and other cybercrimes, processing over $100 million in illicit transactions since 2019. Sanctions against Greenex were imposed only months after TRM identified it as likely being a cover for Galantex.
