A7 Leak and Ilan Shor: Crypto for Sanctions Evasion and Elections in Moldova

A7 leak and Ilan Shor: crypto for sanctions evasion and elections in Moldova. Elliptic shares an investigation that allegedly reveals an entire infrastructure where cryptocurrency plays a key role in evading Russian sanctions and financing interference in Moldova's parliamentary elections this weekend. Their analysis links A7 with affiliated entities' crypto wallets, $8B in stablecoin payments since the beginning of 2024, and the procurement and funding of infrastructure for Shor's initiatives, including an app for managing and paying activists, and the formation of an address pool for subsequent sanctions enforcement actions.

Stack 10% More on Your First BTCC Deposit

Start Trading

Presumed A7 Network and the Stablecoin Layer

At the center of the investigation are internal documents presumably related to Shor's activities; he was convicted in 2017 in a case involving the theft of $1 billion from three Moldovan banks and later obtained Russian citizenship. In 2022, the United States imposed sanctions on Shor for assisting Russia's attempts to undermine democratic processes in Moldova. In 2024, in Russia, Shor created the A7 group of companies, specializing in helping Russian businesses evade sanctions and facilitate cross-border payments.

A7 is 49% owned by the state-owned bank Promsvyazbank, which serves the defense sector; PSB was sanctioned for financing the defense industry and assisting in sanctions evasion, and A7 itself came under U.S. sanctions in August 2025. And the use of cryptocurrencies here acts as a key element of the infrastructure: cash and promissory notes are combined with digital payments, reducing dependence on the traditional financial system, where attempts at sanctions evasion are detected and thwarted more efficiently.

The chats of employees of Shor's companies also came under scrutiny and demonstrate an operational dependence on Tether's USDT: there, they discuss transfers for treasury and payments. In particular, a user under the name athena1098 requests a transfer of 2M USDT to an address marked treasury; subsequently, a wallet of the A7 group was identified through which more than $677M has flowed.

The documents state that athena1098 is Maria Albot, a former Moldovan politician and close ally of Shor, sanctioned by the EU for actions "destabilizing, threatening or undermining Moldova's independence and sovereignty." In total, several crypto wallets tied to A7 and affiliated entities have received $8 billion since the beginning of 2024; these values are designated as a lower bound, since some addresses may remain unidentified.

Further investigation allegedly reconstructs an entire funnel of payments from Russia through various companies, primarily in Kyrgyzstan. Here we see financial and political ties between Russia and this jurisdiction, as well as Shor's closeness to Kyrgyzstan's president, Sadar Japarov, including evidence of providing him with a business jet through a network of proxies.

A7A5: A Ruble Stablecoin for Sanctions Resilience

But perhaps the most notable thing here is A7A5, a ruble stablecoin developed by A7. Unlike USDT, which is centralized and subject to freezes at the request of regulators and law enforcement, A7A5 is not subject to the risk of freezes by Western authorities. Judging by the investigation, there are 41.6B A7A5 in circulation totaling $496M, and the aggregate value of all A7A5 transactions has reached $68B. A7A5 is issued through the Kyrgyz company Old Vector LLC, with a stated 1:1 backing by ruble deposits in PSB accounts. In April 2025 chats, employees discuss the need for market-making on crypto exchanges to provide liquidity for the A7A5/USDT pair; it is further recorded that A7 wallets sent at least $2B in USDT to exchanges to sell into A7A5 and stimulate its adoption.

The Influence Infrastructure Is Still Active

The investigation also indicates that the influence infrastructure is active, and it is not limited to the fact that Shor and his companies financed political and electoral initiatives in Moldova, with ties to the Kremlin and the FSB. In the chats, developers discuss other ongoing projects, including the "Taito" app for managing a network of political activists and payments. In August 2025, the Moldovan police warned about the use of Taito for illegal campaign financing and voter bribery; "Callcenter" also appears as a tool for political polling with signs of violations. According to the correspondence, the server infrastructure and related services were paid for in USDT, which allowed the initiatives to operate despite the sanctions imposed. There is also the development of a Telegram bot with KYC, able to send Toncoin, redirect funds between users, and exchange for other assets.

The Infrastructure Is Adaptive, the Wallet System Has Changed

Another interesting aspect of the investigation is the indicators of a change in the crypto wallet infrastructure of Shor's business in August 2025, likely in response to the compromise that led to the leak. There may have been a loss of cryptographic keys controlling a number of addresses, and an additional marker is the anomalous activity of wallets associated with A7A5 around August 14, coinciding with a mass reshuffling of wallets managing Shor's assets. Taken together, this likely indicates that A7's cryptocurrency layer is managed as an independent tier of payment and settlement infrastructure, where the levers of resilience are distributed between established stablecoins and its own ruble issuance.

Beyond the day-to-day market news, onboarding incentives remain a steady feature of the exchange landscape. BTCC’s current campaign includes a 10% deposit bonus for new users and access to additional community-based rewards. You can explore the offer directly on BTCC here.

Ambiguous Use of Cryptocurrencies, Not by Cybercriminals

The A7 leak presumably shows a service model of sanctions evasion and financing of political activity using cryptocurrencies: from USDT treasury operations and A7A5 market liquidity to routing through companies in Kyrgyzstan and paying for the infrastructure of electoral projects in Moldova.

Of course, this is a dubious precedent, but it is a kind of further proof of the tremendous potential of decentralization and the functionality of cryptocurrencies. Clearly, we are witnessing a fundamental financial transition, with still very different and often unpredictable scenarios. Stay tuned for the latest updates and opportunities in the new economy, crypto industry, and blockchain developments.