Leak Reveals $8B Crypto Network for Sanctions Evasion

The leaked files from companies connected to fugitive Moldovan oligarch Ilan Shor reveal what analysts describe as a comprehensive ‘sanctions evasion as a service’ operation. At the heart of this system is the A7 network, which Elliptic’s analysis connects to at least $8 billion in stablecoin transactions over the past 18 months. This massive flow of digital assets suggests cryptocurrency has moved from being an auxiliary tool to a deliberate channel for Russian power projection, with nearly half of A7 reportedly owned by Russia’s state-owned Promsvyazbank—already under sanctions for its role in defense financing.

The internal documents show a sophisticated operational structure where A7 facilitates cross-border transactions for Russian actors blocked from mainstream financial systems. The network appears to have developed its own settlement schemes, routing funds through Kyrgyz companies while using a mixture of traditional finance instruments like promissory notes and cash alongside cryptocurrency. This layered approach creates complexity that challenges conventional financial monitoring systems, with internal chat logs discussing multi-million-dollar USDT transfers specifically designed to build liquidity for A7’s proprietary stablecoin.

A key revelation from the leak is A7’s development of its own stablecoin, A7A5, pegged to the Russian ruble and registered in Kyrgyzstan. This represents a strategic move to reduce reliance on U.S.-based stablecoins like Tether, which remain susceptible to regulatory freezes by Western authorities. Internal communications show engineers actively working to make A7A5 harder for regulators to choke off, while the stablecoin had already processed over $40 billion in total volume by July according to Reuters reporting.

The creation of ruble-backed stablecoins follows a broader trend of Russia and allied actors building alternative financial infrastructure to escape Western constraints. Financial commentators view A7A5 as a high-stakes bet: when traditional financial rails become inaccessible, building independent crypto-based systems becomes essential for moving value at scale. The massive transaction volume suggests this strategy is gaining traction, with rushes to adopt the stablecoin driven by urgent needs to circumvent financial isolation.

Perhaps most concerning are the political implications revealed in the leaked documents. Elliptic’s analysis connects A7’s crypto flows to election interference infrastructure in Moldova, including a smartphone app named Taito that allegedly paid local activists. The leak also identifies a ‘Callcenter’ system operating illicit polling and Telegram bots distributing payments after rudimentary identity checks. These findings suggest crypto is being used to fund a new frontier of hybrid warfare that blends financial power with digital persuasion tactics.

The documents also reveal specific individuals involved in the operation, including Maria Albot, a former Moldovan politician sanctioned by the EU, who appears in chat logs requesting USDT transfers tied to wallets receiving massive inflows. With Moldovan parliamentary elections imminent when the leak published, the timing underscores how cryptocurrency can be weaponized to influence democratic processes through sophisticated financial engineering that traditional campaign finance laws struggle to monitor or prevent.

While the Elliptic report provides compelling evidence, analysts urge careful scrutiny of leak-based revelations due to inherent limitations. The core claim of $8 billion in stablecoin flows relies on matching wallet addresses to entities and inferring ownership—a method widely used in blockchain forensics but rarely infallible. Similarly, while A7’s ownership ties to Promsvyazbank appear plausible, the exact degree of state control or direction remains difficult to confirm independently through leaked documents alone.

For Western regulators, the leak represents both a challenge and an opportunity. It provides new wallet addresses to monitor and confirms long-held suspicions about crypto’s central role in modernized sanction evasion. If the attributions hold, financial watchdogs may gain additional levers to freeze or blacklist infrastructure. However, the rapid evolution of Russia’s crypto ecosystem—particularly the development of ruble-pegged stablecoins outside Western jurisdiction—poses significant challenges to traditional financial oversight mechanisms.

The ultimate question raised by these revelations is not whether such crypto-powered geopolitical architecture is possible—the evidence suggests it’s already operational—but whether Western institutions can develop effective countermeasures quickly enough. As blockchain analytics firms like Elliptic continue to expose these networks, the race between financial innovation and regulatory response intensifies, with billions of dollars and the integrity of democratic processes hanging in the balance.