A massive leak of internal documents has exposed how Ilan Shor, a sanctioned Moldovan oligarch and close Kremlin ally, used cryptocurrency to build a sophisticated financial network. The leaks reveal that $8 billion in stablecoins became the backbone of an operation designed to evade sanctions and manipulate politics in Moldova.
Inside the A7 network
The documents, flagged by blockchain analytics firm Elliptic on September 26, came from Shor’s A7 group, a Russia-based business specializing in what analysts describe as “sanctions evasion-as-a-service.”
Over the past 18 months, crypto wallets linked to A7 processed more than $8 billion in stablecoin transactions, according to Elliptic. These funds moved from Russian entities into political operations in Moldova just as the country prepares for key parliamentary elections.
From banking fraud to crypto empire
Shor’s pivot to crypto followed years of scandal. After being convicted in 2017 for his role in the infamous $1 billion theft from Moldovan banks, he fled to Israel and later obtained Russian citizenship. The U.S. sanctioned him in 2022 for attempts to undermine Moldova’s democracy.
From exile, he founded A7 in 2024, turning his expertise in financial manipulation into a full-scale business. According to the leaks, the company is partially owned by Promsvyazbank (PSB) a Russian state-owned bank sanctioned for financing Moscow’s defense industry. That tie positioned A7 as part of Russia’s broader financial warfare strategy.
In fact, during a speech to Vladimir Putin earlier this year, Shor bragged that A7 had already facilitated 7.5 trillion rubles ($89 billion) in cross-border transactions for Russian businesses in just 10 months.
How the scheme worked
The leaked files show a complex payment structure designed to bypass Western restrictions. A7 funneled transactions through companies in Kyrgyzstan, a nation with strong ties to Moscow.
The system mixed traditional tools like cash and promissory notes with heavy use of cryptocurrency especially Tether’s USDT to move funds across borders without going through the regulated financial system.
Chat logs reveal employees casually discussing multimillion-dollar transfers. In one example, a user called “athena1098” requested 2 million USDT for “treasury.” Blockchain analysis tied that account to Maria Albot, a sanctioned Moldovan politician and Shor ally, and linked her wallet to over $677 million in transactions.
A7A5: building a sanctions-proof stablecoin
Fearing that reliance on USDT could expose them to asset freezes, A7 went a step further they built their own stablecoin. The leaks confirm the creation of A7A5, a ruble-backed stablecoin designed specifically to be sanctions-proof.
With 41.6 billion tokens in circulation (worth nearly $500 million), A7A5 quickly became central to the group’s financial ecosystem. Internal chats show A7 employees discussing market-making strategies, including sending $2 billion in USDT to exchanges to buy A7A5 and create liquidity.
This effectively allowed A7 to build a self-contained crypto economy one insulated from Western oversight and financial pressure.
Bottom line
The A7 leaks paint a clear picture: crypto has become a lifeline for sanctions evasion on a massive scale. By blending traditional finance with digital assets, Ilan Shor’s network moved billions, financed political influence in Moldova, and even created a new ruble-backed stablecoin to avoid scrutiny.
What emerges is not just a story of financial crime but a glimpse into how digital assets are increasingly being weaponized in geopolitical conflicts.
