TokenSpot Named Front Company for Sanctioned Russian Exchange Grinex

Blockchain intelligence firm TRM Labs has assessed with high confidence that TokenSpot, a cryptocurrency exchange registered in Kyrgyzstan, functions as a front company for Grinex, a Russian exchange sanctioned by the United States, the United Kingdom, and the European Union. The two entities share deposit addresses, a shared fee-collection address on the TRON network, and a director who is also linked to a payments company whose technical infrastructure overlaps with the A7A5 token ecosystem. For accounting firms, auditors, and CFOs that recorded or processed any flow touching TokenSpot, the compliance implications are immediate and serious.

Background: How Grinex Became a Sanctioned Entity

To understand what the TokenSpot finding means, it helps to trace the regulatory timeline. Garantex, a Russia-based exchange widely used to launder proceeds of ransomware and other illicit activity, was designated by the UK on May 4, 2022. Law enforcement then took Garantex's infrastructure down in March 2025. In the months that followed, Grinex emerged as its operational successor. The US Treasury's Office of Foreign Assets Control (OFAC) designated Grinex on August 14, 2025, and the UK followed six days later, on August 20, 2025. The EU designation arrived in the same period. TRM Labs has previously documented connections between Grinex, the broader A7 network, and the A7A5 token.

What the A7 Network Connection Adds

A7 is TokenSpot's single largest external counterparty. TokenSpot sent A7 USD 679.5 million and received USD 48.5 million from it across the period TRM analysed. TokenSpot also sent USD 26.5 million to the A7A5 token and received USD 7.7 million. Grinex and Garantex together represent two of the next three largest external counterparties for TokenSpot, collectively accounting for 30% of its outgoing volume and 10% of its incoming volume. That concentration is striking: no legitimate exchange operating at arm's length from sanctioned entities would route such a large share of its flows through designated or closely connected parties.

The Onchain Evidence TRM Labs Identified

TRM's earliest record of TokenSpot's onchain activity dates to December 8, 2023. Through September 27, 2026, its TRON addresses received USD 3.54 billion and sent USD 3.14 billion. The scale alone makes this a significant compliance event. The firm's analysis rests on three distinct categories of blockchain evidence.

Shared Deposit and Aggregator Addresses

Exchanges typically assign each customer a unique deposit address and then sweep collected funds into a central aggregator address. After a cyberattack on April 16, 2026, Grinex published a list of addresses it said were affected. One of those addresses, TA8vyBg93KXaiQXV22WWXTB9hz3caN81DE, was active from February 5 to July 29, 2026, and received USD 268.9 million in total. Of that amount, USD 146.3 million came directly from 126 TokenSpot deposit addresses. At least two of those TokenSpot deposit addresses had been activated by an address TRM has independently verified as belonging to TokenSpot, and all their funds had previously been swept into that same TokenSpot-attributed address. A further USD 116.3 million arrived from three addresses attributed to both exchanges simultaneously. Addresses attributed only to Grinex contributed USD 1.9 million.

The practical effect is that funds withdrawn from TokenSpot via that aggregator were mixed with funds from an exchange sanctioned by the US, UK, and EU. Any downstream recipient of those funds, and any firm that recorded those receipts, may have indirect exposure under OFAC's strict-liability framework.

Shared Fee-Collection Address

Every transaction on TRON requires a fee paid in TRX, the network's native token. Services typically pre-fund their deposit addresses with TRX and later sweep unused balances back to a single reservoir address. TRM identified TWqeMbv3EJtJhmKYUTodT7BmG9fcQRjwor as receiving leftover TRX from both TokenSpot and Grinex addresses between April 23 and July 8, 2026. In total, 711 TokenSpot addresses and 58 Grinex addresses sent their residual TRX to that single address, which collected roughly USD 25,000 across 1,126 transfers, an average of about USD 22 per transfer. TRM considered the possibility that a third party drained both exchanges into one address, but the amounts involved are consistent with routine fee management and are far too small to represent a theft from two exchanges that moved hundreds of millions of dollars. The assessment is that a shared operator controls that reservoir.

Simultaneous Technical Outages During the April 2026 Attack

On April 15, 2026, at 13:02 UTC, Grinex announced a "technical break," telling customers that deposits, withdrawals, and its website were temporarily unavailable. Twenty-five minutes later, at 13:27 UTC, TokenSpot posted its own notice citing "technical work" and warning that deposits and withdrawals might be unstable. The following day, Grinex confirmed a cyberattack and published its list of affected addresses, which included two addresses that TRM attributes to TokenSpot. No other exchanges appear in that disclosure. TRM assesses that the coincidence of those two announcements, combined with the inclusion of TokenSpot-attributed addresses in Grinex's own hack disclosure, is consistent with common operational control.

The Director Link and Infrastructure Overlap

The connection extends beyond onchain data. Reporting from June 2024, citing records from the Kyrgyz Justice Ministry, identified Melis Batyrbekovich Umarhodjaev as the director of both TokenSpot and Tsunami Payments, a Kyrgyz payments company. As of September 2026, the relevant registry no longer lists him in that role. Public DNS records on dnsdumpster.com show that Tsunami Payments' domain and the A7A5 token's domain share an identical set of staging subdomains: account-api-stage, account-stage, internal-stage, and kyc-stage. Sharing staging infrastructure across ostensibly unrelated companies is a strong indicator of common technical development or shared backend systems, and it ties TokenSpot's former director into the broader A7 network that regulators and blockchain analysts have been tracking for months.

Sanctions Flow Totals: What the Numbers Show

TRM's analysis captures the total flows between TokenSpot and its sanctioned counterparties across the periods during which each designation was in effect.

The post-designation figures are the most legally significant. TokenSpot sent USD 109.7 million to Garantex after that exchange was designated, and it sent and received substantial sums with Grinex after August 2025. Under OFAC's strict-liability standard, a party need not have known a transaction was sanctions-prohibited in order to face civil liability. Knowledge is relevant to penalty mitigation, not to the underlying violation itself.

Accounting and Compliance Implications for Firms

For Accounting Practices and Auditors

Any client whose digital asset transactions touched TokenSpot, directly or through an intermediary, should now be treated as a potential sanctions-exposure matter until a full tracing exercise rules it out. The commingling of TokenSpot and Grinex funds in a shared aggregator means that even a client who believed they were transacting solely with a Kyrgyz exchange may have received or sent funds that passed through an aggregator containing designated-entity proceeds.

From a bookkeeping standpoint, funds received from a sanctioned source may need to be classified differently from ordinary trading receipts. Depending on jurisdiction, they may be subject to blocking obligations, meaning they cannot simply be recognised as income and moved on. Robust crypto accounting software with real-time sanctions screening at the transaction level, not just at onboarding, is essential for catching exactly this kind of indirect exposure. If your current digital asset accounting software does not flag counterparty sanctions status at the transaction level, the TokenSpot case illustrates precisely why that gap is dangerous.

Auditors reviewing financial statements for periods covering December 2023 onward should ask whether clients held accounts on TokenSpot and whether those positions have been assessed for sanctions risk. The answer will affect how balances are stated and whether contingent liabilities need to be disclosed. For guidance on how the Garantex designations have already shaped practice, see our earlier coverage of how the Garantex sanctions affected crypto firms and their books.

For CFOs and Treasury Functions

CFOs at businesses that accepted payments via TokenSpot or used it for treasury operations face a two-part problem: potential OFAC civil liability and financial statement risk. The strict-liability standard means that the firm's intent is irrelevant to whether a violation occurred. What matters now is the quality and speed of the response.

A voluntary self-disclosure to OFAC, made promptly and accompanied by a thorough internal investigation, is one of the most significant mitigating factors the agency weighs when setting civil penalties. The same principle applies in the UK under the Office of Financial Sanctions Implementation (OFSI) and in EU member states under their respective national sanctions authorities. Firms should also review their AML transaction monitoring systems: if TokenSpot was not flagged as a high-risk counterparty prior to the TRM finding, that is a gap in the firm's risk-based approach that needs to be addressed and documented.

For the broader policy context on how EU regulators are treating crypto-related financial crime, our analysis of EU anti-corruption rules and what they mean for digital asset compliance teams sets out the direction of travel.

Practical Next Steps for Compliance and Finance Teams

The TRM Labs finding does not require firms to wait for a formal regulatory action before acting. The blockchain evidence is public, the designations are in force, and the commingling of funds is documented. Teams should move quickly on the following:

• Run a retrospective screen of all client or counterparty relationships involving TokenSpot, covering activity from December 2023 to the present.
• Map any flows that passed through the shared aggregator address or the shared fee-collection address identified in the TRM report.
• Assess whether blocking obligations apply under OFAC, OFSI, or EU sanctions regulations for any funds received.
• Consult sanctions counsel on whether voluntary self-disclosure is appropriate before a regulatory inquiry arrives.
• Update internal risk ratings for Kyrgyz exchanges and any exchange in the A7 network, pending further investigation.
• Review your crypto bookkeeping software and transaction monitoring stack to ensure sanctions screening runs at the transaction level, not just at customer onboarding.

Source: TRM Labs

Frequently Asked Questions

What makes TokenSpot a front company rather than simply a counterparty of Grinex?

TRM Labs identifies three categories of evidence pointing to shared operational control rather than a mere business relationship: shared deposit and aggregator addresses on TRON (including one address that Grinex claimed as its own but which was collecting TokenSpot customer deposits), a single fee-collection address that received residual TRX from hundreds of both exchanges' addresses, and near-simultaneous technical outage announcements during the April 2026 cyberattack that targeted Grinex specifically. The combination of infrastructure sharing and the director-level links to the A7A5 ecosystem underpins the high-confidence assessment.

Does transacting with TokenSpot automatically mean a firm violated sanctions?

Not automatically, but it creates meaningful risk that must be assessed. Under OFAC's strict-liability standard, a sanctions violation can occur without knowledge or intent. The critical questions are whether the firm transacted with TokenSpot after the relevant designations of Grinex or Garantex took effect, and whether the funds in question passed through a commingled aggregator containing designated-entity proceeds. Legal counsel and a detailed blockchain tracing exercise are needed to determine actual exposure.

How should funds already received from TokenSpot be treated in the accounts?

If a blocking obligation applies under OFAC, OFSI, or EU sanctions regulations, affected funds cannot simply be recognised as ordinary income and used freely. They may need to be segregated and reported to the relevant sanctions authority. The classification in the financial statements will depend on the jurisdiction and the specific facts. Auditors should flag any such receipts as a potential contingent liability pending legal and regulatory advice.

What is the significance of the shared staging subdomains between Tsunami Payments and A7A5?

Staging subdomains are part of the development and testing infrastructure that a software team builds and maintains. Identical staging subdomain names across two ostensibly unrelated companies, when confirmed through public DNS records, suggest they share the same technical backend or development team. Combined with the director-level overlap between TokenSpot and Tsunami Payments, this infrastructure link extends the network of connected entities well beyond what publicly registered corporate structures would indicate.

Which regulators are most relevant for firms outside the US that processed TokenSpot transactions?

UK firms should assess exposure under OFSI, which administers UK financial sanctions and can impose civil penalties on a strict-liability basis since the Economic Crime (Transparency and Enforcement) Act 2022. EU firms should review obligations under the relevant EU sanctions regulations and their national implementing legislation. Kyrgyzstan itself is the domicile of TokenSpot, but Kyrgyz law does not govern the sanctions obligations of US, UK, or EU firms. Any firm holding a licence in a Financial Action Task Force (FATF) member jurisdiction also faces the risk that its national AML supervisor will scrutinise transaction monitoring failures exposed by this case.