A major data leak from companies controlled by fugitive Moldovan oligarch and Putin ally Ilan Shor revealed how Russia used cryptocurrency to bypass sanctions and interfere in Moldova’s parliamentary elections held this past weekend, as reported by Elliptic.
Analysis of the leaked information by Elliptic showed that wallets controlled by the A7 group of companies and its subsidiaries received stablecoin transactions totaling around $8 billion over the past 18 months. These funds were used to acquire infrastructure for Shor’s initiatives, including the Taito app to manage a network of political activists and pay for their work, as well as the Callcenter app for conducting political surveys.
In 2017, Shor was convicted of embezzling $1 billion from three Moldovan banks and, after fleeing, obtained Russian citizenship. In 2022, the U.S. imposed sanctions on him for assisting Russia in undermining democratic elections in Moldova. According to the investigation, Shor funded vote-buying for pro-Russian candidates and disinformation campaigns against the pro-European government, aiming to ensure a pro-Russian parliament and maintain Moscow’s influence in the region.
In 2024, Shor established the A7 group of companies in Russia, specializing in cross-border payments and sanctions evasion for Russian businesses. 49% of the company is owned by the Russian Promsvyazbank (PSB), which was also sanctioned for financing the defense sector and participating in vote-buying for pro-Russian candidates in Moldova in 2024. A7 itself was added to U.S. sanctions lists in August 2025.
Leaks revealed that A7 payments flowed through companies primarily in Kyrgyzstan and highlighted Shor’s close ties with Kyrgyz President Sadyr Japarov. To evade sanctions, cash, promissory notes, and cryptocurrencies were used. The main instruments were the USDT stablecoin from Tether and the ruble-pegged A7A5 stablecoin created by A7. Over $677 million flowed through A7 wallets, and total A7A5 transactions reached $68 billion. A7A5 is backed by ruble deposits in PSB and issued by the Kyrgyz company LLC Old Vector.
The leaks also showed that A7 employees engaged in market-making on crypto exchanges, converting billions of USDT into A7A5 to encourage adoption of the ruble-backed cryptocurrency and ensure liquidity. Additionally, the group developed a Telegram bot to facilitate payments in Toncoin, a cryptocurrency integrated with Telegram, allowing users to easily transfer funds and bypass sanctions.
Documents and correspondence revealed that servers and infrastructure for the Taito and Callcenter projects were paid for in U.S. dollars, enabling operations despite sanctions. In August 2025, Moldovan police recorded the use of these apps for illegal election financing and voter bribery.
Experts note that blockchain transparency allows tracking of illicit financial flows. Data from the A7 leaks enabled identification of the company’s crypto addresses, opening opportunities for sanctions against Shor, A7, and affiliated entities, and helping prevent sanctions evasion and interference in democratic processes.
