Leaked Documents Expose $8 Billion Crypto Web Behind Russia’s Sanctions Evasion

When a cache of internal files from firms tied to fugitive Moldovan oligarch Ilan Shor hit the internet earlier this month, analysts saw more than business secrets exposed—they saw the architecture of a crypto-powered geopolitical machine.

According to a new report from blockchain forensics firm Elliptic, the leak uncovers how Russia and its partners have been using cryptocurrency to skirt sanctions and influence elections in Moldova.

At the heart of the leak is A7, a network of companies founded and allegedly controlled by Shor and deeply intertwined with Russia’s financial apparatus. Elliptic’s analysis connects A7 and its associated firms to at least $8 billion in stablecoin transactions over the past 18 months.

The flow of those funds—traced through wallets, internal contracts, and settlement schemes—suggests crypto is no longer an auxiliary tool in Russia’s financial toolkit but a deliberate channel for power projection.

A crypto ecosystem for influence

Here’s how it purportedly works: A7 specializes in “sanctions evasion as a service,” facilitating cross-border transactions for Russian actors blocked from mainstream finance. Nearly half of A7 is reportedly owned by Russia’s state-owned Promsvyazbank, already under sanctions for its role in defense financing. Elliptic ties A7’s wallet network to political infrastructure in Moldova—such as apps paying activists—and to systems designed to sway public opinion.

A7 also appears to have launched its own stablecoin, A7A5, pegged to the Russian ruble and registered in Kyrgyzstan. Its purpose: reduce reliance on U.S.-based stablecoins like Tether, which are susceptible to regulatory freezes. Internal chat logs from the leak discuss multi-million-dollar USDT transfers used to build liquidity for A7A5, and engineers evidently worked to make it harder for Western regulators to choke off access.

The leak also reveals a path: funds routed through Kyrgyz companies, with settlements layered using a mixture of traditional finance (promissory notes, cash) and crypto. At least one persona, Maria Albot, a former Moldovan politician sanctioned by the EU, appears in chat logs requesting USDT transfers tied to a wallet that saw massive inflows.

On the political side, Elliptic connects these funds to infrastructure used during elections. A smartphone app named Taito is cited as paying local activists. A “Callcenter” system is flagged as operating illicit polling, and a Telegram bot is named for distributing payments after rudimentary identity checks.

A disturbing trend

As compelling as it sounds, the Elliptic report bears careful scrutiny. Leak-based revelations are inherently imperfect: there’s the prospect of tampering, misattribution, or selective editing. Elliptic’s core claim—$8 billion of stablecoin flows—is based on matching wallet addresses to entities and inferring ownership. That method is widely used in blockchain forensics, but is rarely infallible.

Also, while A7’s ownership by Promsvyazbank is plausible, the degree of state control or direction is harder to confirm independently. PSB’s sanction status is real, and its reputation as a financial arm of Russia’s defense sector is documented by Elliptic. But whether every transaction through A7 was Kremlin-driven or merely opportunistic is less certain.

In a broader context, the A7 leak follows a trend: Russia and allied actors are increasingly turning to ruble-backed or domestically issued stablecoins. A Reuters report noted that A7A5 transactions had already passed $40 billion in total volume as of July, driven by rushes to escape Western financial constraints.

Financial commentators view A7A5 as a high-stakes bet: If you can’t use Western rails, then build your own rails—and switch to crypto to move value at scale.

Implications on the ground

For Western regulators, the leak is a double boon: It provides new wallet addresses to monitor, and it affirms what many have suspected—that crypto is central to modernized sanction evasion. If the attributions hold, then financial watchdogs may have more levers to freeze or blacklist infrastructure.

For Moldova, the revelations are politically incendiary. The parliamentary elections were imminent when the leak published, and accusations of digital interference and vote buying escalate the urgency. If A7’s crypto flows were indeed paying activists or influencing polling, then it’s a new frontier of hybrid warfare—one that blends money, software, identity, and persuasion.

Still, a leaked document is not a conviction. The identities behind wallets, the intentions of transactions, and the nexus between money and politics all require further investigation—by law enforcement, intelligence agencies, and forensic auditors.

In sum: The Elliptic report, if accurate in its core assertions, sketches a chilling playbook. It portrays a sophisticated bridge between sanctioned states and political influence operations, all powered by crypto. The biggest question is not whether the architecture is possible—it already seems built—but whether Western institutions can build countermeasures fast enough.