Blockchain analytics firm Elliptic has flagged a cache of leaked data from businesses controlled by sanctioned Moldovan oligarch and Kremlin ally Ilan Shor. The files, leaked earlier this month, provide a detailed look inside the A7 group, an operation based in Russia, operating a specialized “sanctions evasion-as-a-service.” Elliptic’s analysis of the data shows that several crypto wallets have processed stablecoin transactions worth $8 billion over the past 18 months, tracing the digital money flow from Russian-affiliated entities to political operations in Moldova as the country prepares to hold its parliamentary elections. Reports mentioned that Shor’s switch to digital assets was necessary because of his controversial past. A7 document leaks show Russia’s influence using crypto According to several reports, Shor fled Israel after he was convicted in 2017 for his role in the theft of $1 billion from Moldovan banks. Shor ended up in Russia, with the country granting him citizenship. The United States later sanctioned him in 2022, accusing him of making efforts to undermine democracy in Moldova. From his position as a fugitive, Shor started the A7 group in 2024, creating a structured connection for the expertise he had cultivated. In the report released by Elliptic, it claimed that A7 group is partly owned by Russia’s state-owned Promsvyazbank (PSB), a bank that has been sanctioned for financing Russia’s defense industry, tying A7 as a de facto arm of the country’s financial warfare apparatus. The scale of the operation is quite big, with Shor reportedly boasting to Vladimir Putin in a statement earlier this month that A7 had carried out transactions worth 7.5 trillion rubles, which is approximately $89 billion, for Russian businesses in ten months. While the mechanisms of operations were not clear to people at the time, the A7 leaks now provide a detailed look into the blueprint of operations. They reveal a complex settlement network built to move payments through a group of companies, primarily located in Kyrgyzstan , a country that shares close political and financial ties with Russia. The scheme also combines the use of traditional tools like cash and promissory notes with a heavy reliance on digital assets like USDT to move funds across borders outside the controlled traditional finance system. Creation of A7A5 eliminated reliance on USDT This dependence on crypto is revealed in internal chat logs where employees discuss multi-million dollar USDT transfers for treasury management. In one exchange, a user named athena1098 requested two million USDT for “treasury,” a transaction that was connected to a wallet that had seen more than $677 million in inflows. The leak revealed that the user is Maria Albot, a former Moldovan politician who was also sanctioned. Albot also shares close ties to Shor. The leaks also showed how sanctioned individuals continued to carry out large-scale financial operations and transactions using digital assets. In the leaked file, A7 noted that there is a vulnerability in relying on USDT, in the sense that it could be frozen by its issuer, Tether. The company then moved to develop its alternative, A7A5, a stablecoin backed by the Russian ruble. With about 41.6 billion tokens in circulation, the stablecoin is currently valued at $500 million. In addition, reports claim that A7A5 was engineered to be sanctions-proof. Leaked chats from April 2025 show employees discussing concerted market-making efforts, which led A7 wallets to send $2 billion in USDT to exchanges to purchase A7A5 and build liquidity, creating a self-contained financial ecosystem insulated from Western pressure. Notably, the stablecoin was also used on Garantex, an exchange that has since been brought down for several sanctions violations. Get up to $30,050 in trading rewards when you join Bybit today
