A7 leaks expose $8b crypto pipeline fueling Russia’s shadow politics

A massive leak of internal documents from a Putin ally’s firm details a sophisticated financial network. It reveals how $8 billion in crypto became the lifeblood for sanctions evasion and political manipulation in Moldova.

On Sept. 26, blockchain analytics firm Elliptic flagged a trove of leaked data from businesses controlled by Ilan Shor, the sanctioned Moldovan oligarch and Kremlin ally. The files, leaked earlier this month, provide an unprecedented look inside the A7 group, a Russia-based operation specializing in “sanctions evasion-as-a-service.”

Elliptic’s analysis of the data identifies crypto wallets that have processed a staggering $8 billion in stablecoin transactions over the past 18 months, tracing the digital money flow from Russian entities to political operations in Moldova just as the country holds its parliamentary elections.

How Shor built A7 into a sanctions-busting hub

Shor’s pivot to crypto was a strategic evolution born of necessity. After being convicted in 2017 for his role in the theft of $1 billion from Moldovan banks, he fled to Israel and later Russia, which granted him citizenship.

The United States sanctioned him in 2022 for his efforts to undermine Moldovan democracy. From this position as a sanctioned fugitive, Shor founded the A7 group in 2024, creating a formalized structure for the expertise he had cultivated.

According to Elliptic, the company is partially owned by Russia’s state-owned Promsvyazbank (PSB), a bank itself sanctioned for financing Russia’s defense industry, cementing A7’s role as a de facto arm of the state’s financial warfare apparatus.

The scale of that operation is staggering. In a speech to Vladimir Putin in early September, Shor boasted that A7 had facilitated 7.5 trillion rubles, equivalent to roughly $89 billion, in cross-border transactions for Russian businesses in just ten months.

While the mechanisms were opaque, the A7 leaks now provide the blueprint. They reveal a complex settlement scheme funneling payments through a network of companies, primarily in Kyrgyzstan, a country with close political and financial ties to Moscow.

The scheme blends traditional tools like cash and promissory notes with a heavy reliance on cryptocurrency, particularly Tether’s USDT, to move value across borders outside the controlled traditional financial system.

A7 in action

This dependence on crypto is laid bare in internal chat logs where employees casually discuss multimillion-dollar USDT transfers for treasury management. In one exchange, a user named “athena1098” requests two million USDT for “treasury,” a transaction that alone identified a wallet with more than $677 million in flow. The leaks reveal that “athena1098” is Maria Albot, a sanctioned former Moldovan politician and close Shor ally, demonstrating how digital assets enable continued financial operations despite sanctions on individuals.

Recognizing the vulnerability of relying on a USDT stablecoin that could be frozen by its issuer, A7 developed its own alternative: A7A5, a ruble-backed stablecoin. With 41.6 billion tokens in circulation valued at nearly $500 million, A7A5 was engineered to be sanctions-proof.

Leaked chats from April 2025 show employees discussing a concerted market-making effort, with A7 wallets sending at least $2 billion in USDT to exchanges to buy A7A5 and build liquidity, creating a self-contained financial ecosystem insulated from Western pressure.