Executive Summary
Leaked documents detail an $8 billion cryptocurrency network, A7, linked to sanctioned Moldovan oligarch Ilan Shor and Russia's Promsvyazbank, which has allegedly facilitated sanctions evasion and election interference in Moldova. This exposure is anticipated to increase regulatory pressure on crypto platforms concerning anti-money laundering and know-your-customer compliance, particularly for stablecoin transactions.
The Event in Detail
A cache of internal documents, leaked on September 3, 2025, from businesses controlled by Ilan Shor, has exposed a network processing at least $8 billion in stablecoin transactions over an 18-month period since early 2024. Shor, a Moldovan fugitive convicted in 2017 for a $1 billion bank fraud and sanctioned by the United States in 2022 for undermining Moldovan elections, established the A7 Group in 2024 after relocating to Russia. This group specializes in aiding Russian businesses to circumvent sanctions and conduct cross-border payments. A7 is 49% owned by the Russian state-owned Promsvyazbank (PSB), a financial institution sanctioned for its role in financing Russia's defense sector and facilitating sanctions evasion. A7 itself was sanctioned by the U.S. in August 2025.
The network's activities extended to election interference in Moldova, utilizing crypto payments to fund infrastructure for political campaigns, including an app for activist management and a "Callcenter" for political polling. Elliptic's analysis of the leaked data identified numerous crypto wallets associated with A7, revealing the scope of these operations.
Financial Mechanics
The A7 network primarily leveraged stablecoins, including USDT and its proprietary ruble-backed stablecoin, A7A5. USDT was utilized for its price stability relative to the volatile ruble, broad payment utility, and its role in bypassing sanctions. However, the centralized nature of USDT, which allows for regulatory freezes, prompted A7 to develop A7A5, registered in Kyrgyzstan. Internal chat logs from April 2025 indicate discussions among Shor's employees regarding market-making activities to ensure liquidity for A7A5 and USDT on crypto exchanges. Subsequently, A7 wallets reportedly sent at least $2 billion in USDT to exchanges to be converted into A7A5, aimed at bolstering the adoption of the ruble-backed stablecoin and reducing reliance on U.S.-based alternatives.
Business Strategy & Market Positioning
A7 operates as a "sanctions evasion as a service" provider, positioning itself as a critical financial infrastructure for Russian entities seeking to bypass international restrictions. The strategic launch of A7A5 demonstrates an effort to create a localized, less susceptible alternative to Western-controlled stablecoins. This move aligns with a broader objective to insulate illicit financial flows from potential regulatory intervention. The deep integration with Promsvyazbank underscores a state-aligned strategy to circumvent economic penalties, utilizing the anonymity and speed of cryptocurrency transactions to fund political influence operations and maintain economic lifelines despite sanctions.
Market Implications
The revelations are expected to intensify global regulatory scrutiny on the cryptocurrency market, particularly on platforms facilitating stablecoin and cross-border transactions. Authorities are likely to increase demands for robust Know Your Customer (KYC) and Anti-Money Laundering (AML) protocols to identify and mitigate illicit financial activities. This could lead to further sanctions against crypto entities found to be complicit in evasion schemes. The incident also highlights the ongoing development of sophisticated on-chain surveillance tools by regulatory bodies, and conversely, may spur the creation of more decentralized alternatives by those seeking to avoid such oversight. The broader market may experience increased geopolitical risk perception, potentially leading to a fracturing of the global crypto ecosystem and a heightened focus on jurisdictional compliance.
Blockchain forensics firm Elliptic's analysis, based on the leaked documents, has been instrumental in uncovering the operational specifics of the A7 network. Their report not only provides new wallet addresses for monitoring by enforcement agencies but also raises questions regarding the precise attribution of funds and the extent of direct Kremlin control over such networks. This ongoing investigation underscores the challenges in tracing complex illicit financial flows within the crypto domain, even with significant data leaks.
Broader Context
This incident provides a tangible example of how cryptocurrencies, particularly stablecoins, are being leveraged for geopolitical objectives, including sanctions evasion and interference in democratic processes. It reinforces the urgent need for comprehensive and harmonized global regulatory frameworks to govern digital assets. The U.S. regulatory landscape, including the Bank Secrecy Act (BSA) and recent measures like the Genius Act in July 2025 (requiring 100% reserve backing for stablecoins and AML programs), is continuously evolving to address such challenges. The ongoing nature of private litigation against crypto exchanges and issuers also indicates that, even with fluctuating federal enforcement, civil actions contribute to industry oversight. This episode is likely to shape discussions around the balance between fostering innovation in Web3 and ensuring financial security and compliance.
source:[1] Leaked Documents Expose $8 Billion Crypto Web Behind Russia's Sanctions Evasion - Decrypt (https://decrypt.co/341957/leaked-documents-ex ...)[2] The A7 leaks: The role of crypto in Russian sanctions evasion and election interference (https://vertexaisearch.cloud.google.com/groun ...)[3] Recent Developments Raise Significant Questions about the Future of Regulation and Enforcement of Cryptocurrency | Money Laundering Watch (https://vertexaisearch.cloud.google.com/groun ...)