A major leak from the A7 group, a business network tied to Ilan Shor, shows how Russia is using cryptocurrency to bypass Western sanctions and interfere in Moldova’s elections. The documents reveal how wallets linked to A7 and Shor’s companies processed more than $8 billion in stablecoin transactions over the past 18 months. These funds supported political projects in Moldova, including apps that paid activists and managed election activities.
Ilan Shor is a Moldovan politician and businessman who fled the country after being convicted in 2017 for his role in the theft of $1 billion from Moldovan banks. He settled in Israel and later in Russia, where he received citizenship. In 2022, the United States sanctioned him for helping Russia destabilize Moldova’s democracy. Shor has been accused of organizing large-scale vote buying, disinformation campaigns, and attempts to block Moldova from moving closer to the European Union. By 2024, Shor founded the A7 group of companies, with nearly half owned by the Russian state-owned Promsvyazbank, or PSB. The bank plays a key role in financing Russia’s defense industry and was sanctioned for its role in helping Russian businesses avoid restrictions. A7 itself was sanctioned by the United States in August 2025.
The leaked files describe how A7 acted as “sanctions evasion-as-a-service.” In a speech to Vladimir Putin, Shor claimed A7 moved 7.5 trillion rubles, worth around $89 billion, across borders in just ten months. Much of this trade went through Asian countries. The leaks show payments routed through Kyrgyzstan, where Russia maintains close ties. They also reveal Shor’s relationship with Kyrgyz President Sadyr Japarov, including evidence that Shor arranged a luxury jet for him through proxies. The network used cash, promissory notes, and cryptocurrency, with crypto playing a growing role in avoiding detection by the global financial system.
The A7 leaks show how USDT, Tether’s stablecoin, became central to these operations. Employees openly discussed large transfers in chat logs. One account, linked to former Moldovan politician Maria Albot, requested a transfer of two million USDT, revealing a wallet that later processed $677 million. Overall, A7 wallets received billions in stablecoins since early 2024. Elliptic’s blockchain analysis connected these transactions to Shor’s network. This transparency demonstrates how leaked data and blockchain forensics can expose illicit finance, even when businesses try to hide behind layers of wallets and intermediaries.
Shor’s network also launched its own Ruble-backed stablecoin called A7A5. Unlike USDT, which can be frozen by Western authorities, A7A5 gave Russian businesses a tool to move funds without oversight. Around 41.6 billion tokens worth nearly $500 million are in circulation, with transactions totaling $68 billion. The token is issued through Old Vector LLC in Kyrgyzstan, backed by deposits in PSB accounts. Leaked chats show A7 employees worked to build liquidity for A7A5 by sending billions in USDT to exchanges and swapping it for their own stablecoin. This effort pushed adoption of the ruble-based token as a way around sanctions.
Beyond finance, the A7 leaks describe direct election interference in Moldova. Projects such as the Taito app were used to pay activists and fund illegal campaign efforts. Moldovan police said Taito helped finance voter bribery. Another project called Callcenter managed political polling, while a Telegram bot sent Toncoin payments to users after a basic identity check. These tools allowed Shor’s team to fund and organize activities that supported pro-Russia candidates, even while under sanctions. The chats show servers and infrastructure for these operations were paid for in USDT, keeping them active outside of normal banking channels.
Cryptocurrencies give sanctioned groups cash-like freedom to move money without banks, but blockchain transparency makes their actions visible when data leaks or investigators track wallets. The A7 leaks connect crypto transactions directly to election interference and sanctions evasion. They show how Russia uses stablecoins like USDT and new tokens like A7A5 to move billions across borders, how companies like Promsvyazbank play a role, and how allies such as Kyrgyzstan become part of the network. They also highlight how digital payments supported political projects in Moldova, from paying activists to financing polling and spreading disinformation.
The revelations provide rare insight into how illicit financial networks function in practice. They show that while cryptocurrency can be a tool for sanctions evasion, blockchain analysis by groups like Elliptic can still uncover the details. For the United States, the European Union, and Moldova’s pro-European government, the A7 leaks are a clear sign of how crypto is used to support Russian influence campaigns and how financial transparency can be used to fight back.
