According to a Global Ledger investigation published in April 2026, Grinex, a sanctioned cryptocurrency exchange operating out of Kyrgyzstan, was drained of approximately $13.7 million and immediately suspended operations. Grinex had emerged in March 2025 as an apparent successor to Garantex, a Moscow-based exchange seized by law enforcement in 2025 after being sanctioned by the U.S. Treasury in 2022 for processing over $100 million in ransomware-linked and darknet market transactions.
The incident reflects broader darknet market activity, with Chainalysis reporting nearly $2.6 billion in aggregate cryptocurrency flows to darknet markets in 2025. Monero has become the dominant payment method on 89 percent of darknet markets, replacing Bitcoin due to its superior privacy features. Global Ledger's research also found at least 20 centralized exchanges with 130 international licenses indirectly exposed to wallets linked to active darknet markets.