A7 Leak and Iran Shoal: Codes for sanctions avoidance and elections in Moldova. Elliptic shares a survey that allegedly reveals the entire infrastructure in which cryptocurrency plays a key role in avoiding Russian sanctions and fundraising interference in Moldova’s parliamentary elections this weekend. Their analysis links A7 to infrastructure procurement and funding for SHOR initiatives, including crypto wallets for affiliated entities, $800 million stubcoin payments since the beginning of 2024, and the formation of an app for activist management and payments, as well as address pools for subsequent standard enforcement actions.
Estimated to be the A7 network and the Stablecoin layer
At the heart of the investigation is the internal documents that are likely related to Shor’s activities. He was convicted in 2017 in a case involving theft of three Moldovan banks, and later acquired Russian citizenship. In 2022, the US imposed sanctions on SHOR for supporting Russia’s attempts to undermine the democratic process in Moldova. In 2024, in Russia, Shoal created an A7 business group, specializing in helping Russian companies avoid sanctions and promote cross-border payments.
The A7 is 49% owned by the state-owned bank Promsvyazbank and serves the defense sector. The PSB was approved for funding the defense industry and helping to avoid sanctions, with the A7 itself being under US sanctions in August 2025. The use of cryptocurrency here serves as an important component of the infrastructure.
Shor’s company employee chats have also been scrutinized, indicating Tether’s operational dependency on USDT. So they are discussing the transfer of payments with the Ministry of Finance. In particular, a user named Athena1098 will request a 2m USDT transfer to a marked Treasury address. The A7 Group wallet was then identified, with over $677 million going on.
According to the documents, Athena1098 is Maria Albot, a former Moldovan politician and close ally of Shor, and said it was approved by the EU for its actions that “destabilize, intimidate, or undermine Moldova’s independence and sovereignty.” In total, several crypto wallets and associated entities linked to A7 have received $8 billion since the beginning of 2024. These values are specified as lower bounds, as some addresses may remain unidentified.
Further investigations are said to have reconstructed the funnels for all payments from Russia, primarily through various companies located in Kyrgyzstan. Here we look at the economic and political ties between Russia and this jurisdiction, and its proximity to Kyrgyzstan’s president, Sadar Japarov.
A7A5: Louvre Stab Coin for Sanctions Resilience
But perhaps the most notable here is the A7A5, a ruble stub coin developed by the A7. Unlike USDTs, which are centralized and subject to freezing on demand by regulatory and law enforcement agencies, the A7A5 is not subject to the risk of freezing by Western authorities. Judging from the survey, the 41.6B A7A5 totaled $496 million, with the total amount of all A7A5 transactions reaching 68B. The A7A5 is published through the Kyrgyz Company Old Vector LLC and contains 1:1 support from Ruble Deposits in your PSB account. In the April 2025 chat, employees will discuss the need for market creation on crypto exchanges to provide liquidity to the A7A5/USDT pair. Additionally, it has been recorded that the A7 wallet has sold to the A7A5 and sent at least $20 billion in USDT to exchange to stimulate its adoption.
Impact infrastructure is still active
The investigation also shows that the infrastructure is active and is not limited to the fact that Shor and his businesses funded Moldova’s political and electoral initiatives with connections with the Kremlin and the FSB. In the chat, developers will discuss other ongoing projects, such as the “Taito” app for managing a network of political activists and payments. In August 2025, Moldova police warned of the use of Taito for illegal campaign funding and voter bribery. CallCenter also appears as a tool for political voting with indications of violations. The communications show that server infrastructure and related services were paid in USDT and the initiative can now be operated despite sanctions. There is also the development of telegram bots using KYC, which allows you to send toncoins, redirect funds between users and exchange them for other assets.
The infrastructure is adaptable and the wallet system has been changed
Another interesting aspect of the research is an indicator of changes in Shor’s business crypto wallet infrastructure in August 2025. There could have been a loss of encryption keys that control many addresses, and the additional markers are unusual activity of the wallet associated with the A7A5 around August 14th, matching the mass conversion of the wallet that manages Shor’s assets. Taken together, this probably shows that the A7 cryptocurrency layer is managed as an independent payment and settlement infrastructure with a lever of resilience distributed between established stubcoins and their own ruble issuance.
Beyond daily market news, onboarding incentives continue to be a stable feature of the exchange landscape. BTCC’s current campaign includes 10% deposit bonuses for new users and access to additional community-based rewards. Explore offers directly Here at BTCC.
The vague use of cryptocurrency, not cybercrime
The A7 leak probably represents a service model for avoiding sanctions using cryptocurrency and funding for political activity. From USDT financial operations and liquidity in the A7A5 market to route Kyrgyzstan companies and paying for infrastructure for Moldova’s election projects.
Of course, this is a questionable precedent, but it is a kind of further evidence of the incredible possibility of decentralization and the functionality of cryptocurrency. Clearly, we have witnessed a fundamental financial transition, still very different and often unpredictable scenarios. Stay tuned for the latest updates and opportunities in the development of new economies, crypto industry and blockchains.