When a cache of internal files from firms tied to fugitive Moldovan oligarch Ilan Shor hit the internet earlier this month, analysts saw more than business secrets exposed—they saw the architecture of a crypto-powered geopolitical machine.
According to a new report from blockchain forensics firm Elliptic, the leak uncovers how Russia and its partners have been using cryptocurrency to skirt sanctions and influence elections in Moldova.
At the heart of the leak is A7, a network of companies founded and allegedly controlled by Shor and deeply intertwined with Russia’s financial apparatus. Elliptic’s analysis connects A7 and its associated firms to at least $8 billion in stablecoin transactions over the past 18 months.
The flow of those funds—traced through wallets, internal contracts, and settlement schemes—suggests crypto is no longer an auxiliary tool in Russia’s financial toolkit but a deliberate channel for power projection.
Here’s how it purportedly works: A7 specializes in “sanctions evasion as a service,” facilitating cross-border transactions for Russian actors blocked from mainstream finance. Nearly half of A7 is reportedly owned by Russia’s state-owned Promsvyazbank, already under sanctions for its role in defense financing. Elliptic ties A7’s wallet network to political infrastructure in Moldova—such as apps paying activists—and to systems designed to sway public opinion.
A7 also appears to have launched its own stablecoin, A7A5, pegged to the Russian ruble and registered in Kyrgyzstan. Its purpose: reduce reliance on U.S.-based stablecoins like Tether, which are susceptible to regulatory freezes. Internal chat logs from the leak discuss multi-million-dollar USDT transfers used to build liquidity for A7A5, and engineers evidently worked to make it harder for Western regulators to choke off access.
Treasury Sanctions Crypto IT Scam Spanning North Korea, Russia, and China
The leak also reveals a path: funds routed through Kyrgyz companies, with settlements layered using a mixture of traditional finance (promissory notes, cash) and crypto. At least one persona, Maria Albot, a former Moldovan politician sanctioned by the EU, appears in chat logs requesting USDT transfers tied to a wallet that saw massive inflows.
On the political side, Elliptic connects these funds to infrastructure used during elections. A smartphone app named Taito is cited as paying local activists. A “Callcenter” system is flagged as operating illicit polling, and a Telegram bot is named for distributing payments after rudimentary identity checks.
Story Continues