The Financial Architecture of Election Interference

How A7A5, Crypto Markets, and USDT Enable Political Operations in Moldova

Moldova’s recent elections have highlighted a familiar challenge in a new form: the growing role of financial infrastructure in enabling political interference. While attention has largely focused on disinformation, vote buying and the activities of networks linked to fugitive oligarch Ilan Shor, less scrutiny has been given to the systems that make these operations possible at scale.

This report examines the intersection of three elements that, taken together, form a coherent operational architecture: political organizations such as Evrazia, financial platforms such as A7 and cryptocurrency-based payment systems. These components do not operate independently - they form an integrated system designed to move money across borders, obscure its origins and deliver it efficiently to actors engaged in political and hybrid warfare activity.

At the center of this system is A7A5, a ruble-backed stablecoin linked to Promsvyazbank (PSB) and developed within Russia’s emerging sanctions-resistant financial ecosystem. At first glance, A7A5 appears to be part of a broader effort to create alternatives to Western financial infrastructure. However, its role is more complex. Rather than serving as a destination asset, A7A5 appears to function as a bridge - facilitating the movement of funds from the Russian financial system into more liquid and widely usable cryptocurrencies.

This distinction is critical. Evidence from Moldovan investigations suggests that election-related payments were not conducted in A7A5, but in widely accepted stablecoins such as USDT. This raises a key question: if A7A5 is not the end point, what role does it play?

The answer lies in liquidity. This report argues that A7A5 and the broader A7 system are best understood not as standalone financial products, but as components of a larger mechanism designed to convert constrained, sanctioned capital into globally usable digital assets. In this context, cryptocurrency is not simply a tool of convenience - it is an enabling layer for political operations.

By tracing how funds move from Russian financial institutions through intermediary systems and into operational use in Moldova, this report aims to clarify how financial innovation is reshaping the landscape of election interference.

Today I’m sharing a report I authored on the financial architecture and use of cryptocurrency in election interference as well as the broader Shor network. The whole report is shared below with Moldova Matters readers, but you can also access it on the Watchdog site at this link.

The Shor Network

Ilan Shor is a fugitive Moldovan oligarch best known as the mastermind of the “Theft of the Billion” for which he was convicted in absentia in 2023 and sentenced to 15 years in prison. Since fleeing Moldova for Israel in 2019, and later to Russia, Shor has built up a broad network that mixes financial crime with functions promoting Russian foreign policy including sanctions evasion and hybrid warfare.

Three core elements of this network are as follows:

• Political Parties - Following the dissolution of the Shor Party in 2023, the network has relied on the unregistered “Pobeda” (Victory) Bloc. This bloc was formed in Moscow and acts as a political center for Shor’s various candidates and splinter parties operating in Moldova.

• NGO “Evrazia” - This Russia-based NGO that functions as a parallel political infrastructure. They distribute funds - including voter bribery efforts, payments to co-opted priests, “social support” payments to communities and more. Evrazia organized trips for young “activists” for trainings in Russia, which led to follow on trainings on weapons use and violent tactics in Bosnia and Herzegovina and Serbia. The NGO sits at the core of influence operations including efforts targeting populations outside of Moldova. It also hires staff for the command and control infrastructure that operates as “managers of pro-Russian party campaigners“ - overseeing political strategy and operations for pro-Russian parties in Moldova.

• A7 - A Moscow-linked financial structure associated with Ilan Shor and his network, identified by EU sanctions as being involved in efforts to influence Moldova’s elections and political processes. It functions as a financial and operational platform - enabling the movement of funds, including through digital or crypto-based tools - to support pro-Șor political activities, sanctions evasion efforts and broader destabilization efforts.

These elements of the Shor network do not operate as distinct entities and have been reported to share office space. They work together towards a goal of creating new captured states under Russian control.

The US, UK and EU have targeted elements and individuals of the Shor network for their role in trying to subvert Moldova’s elections. But the network is not only operating in Moldova. Evrazia is actively involved in Kyrgyzstan where they work to prop up the government with a familiar toolkit. They train journalists, have launched a TV station and Evrazia funded the creation of “Eurasia Park” in Bishkek similar to OrheiLand and GagauziaLand parks in Moldova. RISE Moldova has also reported that the President of Kyrgyzstan Sadyr Japarov uses a plane that has been painted with the name and symbols Kyrgyz Republic but is owned by Ilan Shor.

The financial services company A7 acts as a facilitator for the network’s political operations as well as for sanctions evasion. It has grown to be the part of the network with the largest international footprint with operations inside and outside of Russia including in the Middle East and Africa.

How A7 Works

In October 2024 investigative journalists at RISE Moldova reported that Ilan Shor had begun registering a new network of companies in Russia. The main company in this cluster is called A7, and there are more companies with varying names such as A7-Agent, A71 and more. While it wasn’t initially known what the purpose of these companies was, it was notable who Shor’s business partner was - Russian state owned Promsvyazbank (PSB). Shor owns 51% of A7, while the sanctioned bank owns the other 49%. PSB is sanctioned by the US, EU, Canada, UK, and other nations as a “core bank for Russia’s defense sector.” It is nominally cut off from global financial flows via the SWIFT network. PSB was also one of the primary partners in Shor’s voter bribery schemes during the 2024 Moldovan elections.

Subsequent reporting showed that the purpose of the A7 network of companies is to facilitate cross border payments and currency trades between Russia and the rest of the world. A7 created the crypto stablecoin A7A5 as one of their key tools in this effort¹.

A7 was sanctioned by the UK in May 2025, the EU in July 2025 and the US in August 2025.

A7A5 as a Financial Bridge

While most cryptocurrencies’ values fluctuate according to market speculation, “stablecoins” are pegged to fiat currencies 1:1. The most famous of them is USDT (US Dollar Tether). For every $1 of USDT purchased, a real $1 of USD is held by the company behind USDT. A7A5 is the first ruble-backed stablecoin. Purchases of A7A5 are (allegedly) 1:1 pegged with ruble deposits in PSB bank.

The stablecoin is technically registered in Bishkek Kyrgyzstan and operates under that country’s pro-crypto regulatory structure. Since it was launched in January 2025 the currency has seen rapid adoption, with the Blockchain analysis company Elliptic estimating aggregate volume of transactions around $100 billion in 2025².

Initially A7A5 launched on the sanctioned Moscow based crypto exchange called Garantex. In March 2025 an operation by the US Secret Service, in partnership with German and Finnish law enforcement, forced the exchange offline and froze wallets holding USDT. Elliptic aided in this operation and subsequently tracked the transfer of A7A5 and other crypto assets out of Garantex to a new, Bishkek based, crypto exchange called Grinex. According to a spokesperson from Elliptic, they found pictures of Garantex offices with the company logo and A7A5 logo displayed prominently suggesting a connection between the entities.

The main purpose of A7A5 is as a facilitator for the purchase of USDT. Election interference operations and sanctions evasion require hard currency such as USDT that can easily be converted to fiat currencies. At the same time, the centralized nature of USDT means that the issuing company, Tether, can freeze wallets due to sanctions violations. One use of A7A5 is as a safe storage location for funds when they are not being moved. When it’s time to make a transaction, the user buys USDT with their A7A5 on a decentralized exchange, makes a transfer and the receiver gets the money and quickly changes it back to A7A5 or into hard currency. Since the USDT never sits in a wallet it is very hard for the authorities to freeze it.

While there are lots of stablecoins in the world, A7A5 is unique as the first state-supported example. In October 2025 the Russian Central Bank recognized A7A5 as a “digital financial asset” - the first of any kind in Russia. This legalized it for foreign trade. In February 2026 Vladimir Putin joined a ribbon cutting ceremony at the opening of an A7 branch in Vladivostok via video link. A7A5 and the wider A7 network have been positioned as a major part of Russia’s financial infrastructure.

A7A5’s Liquidity Issues

The main purpose of A7A5 is to provide a ruble safe harbor for people who want to use USDT for global commerce but do not want to leave their money in USDT for fear of sanctions. After 1 year of operations A7A5 passed $100 billion dollars in aggregate transactions - but growth was slowed by a lack of liquidity. In July 2025 the issuing company behind A7A5 was injecting $150 million dollars of liquidity into their own decentralized exchange each day. These numbers fell off significantly by November and totaled $2.3 billion USD by the end of the year.

The problem is that users want to use A7A5 as either a bridge to USDT or as a temporary safe harbor. They don’t want to end up with rubles or A7A5. The issuer of the coin was injecting this liquidity in order to spur demand and build up a self-sustaining market. At the same time, they introduced another innovation that they hoped would attract more outside crypto investors to A7A5 - a rate of return. Due to the war, Russia’s Central Bank has maintained high interest rates in order to combat inflation. A7A5 and PSB promised holders of the coin a 50% share in the interest generated by the rubles backing their coins in the PSB bank. Back in June 2025 interest rates were near 20% so end users could get a healthy rate of return.

Even with these incentives, A7A5 did not develop an organic liquidity pool and mostly functioned as a clearing house rather than a true stablecoin. This was largely due to sanctions keeping them off all but their own distributed exchange and exchanges operating out of Kyrgyzstan.

In the later half of 2025 and early 2026 A7A5 has tried various tactics to address this liquidity problem and draw more people to the platform. Here are some of the key initiatives:

• PSB Card Purchases - From August 2025 holders of PSB bank cards were able to directly buy A7A5 with their cards. This resulted in the purchase of $26 million dollars of A7A5 through the end of the year.

• Stablepay - A7A5 launched a virtual debit card called “Stablepay” that allows users to top-up with A7A5 and spend it on overseas services such as Netflix and ChatGPT. Elliptic has reported trouble with uptake and unreliable service.

• Increasing Rate of Return - The APR split for holders of A7A5 was reallocated in early 2026 with the bank retaining 1% return and the rest going to the coin holder. As of March 2026 A7A5 advertises a 14% rate of return for holders.

• Digital “Veksels” - A7 created a set of off-blockchain paper promissory notes that we will look at in more depth below.

The Veksel Mechanism

Another financial product advertised by A7 is a promissory note (Veksel in Russian) that acts similarly to a traditional bearer bond. The notes, which come in a variety of denominations, are printed on security paper and have the appearance of private money.

Caption: Photo source Moskvichka/Telegram

On the A7A5 website you can see example bills with descriptions of how they work.

The bills have a scratch off feature similar to a lottery ticket that covers up QR codes A and C. Here are their functions:

• QR Code A: Takes you to a dedicated page for this note that allows you to confirm the balance.

• QR Code B: Scratching off the cover of one of these 3 QR codes will allow you to verify the transfer of the note to another person. Each note can be transferred like this up to 3 times.

• QR Code C: Scratching off the cover of this code allows you to redeem the note. It will take you to a Telegram bot that gives you redemption options.

Redeeming the note takes place fully outside of the banking system and is explicitly advertised as occurring outside of SWIFT. Holders have multiple options for redeeming the note:

• At an A7 Office - The company is expanding offices in Russia to “every major city” and has at least 2 offices in Africa. Note holders can withdraw rubles through these branches.

• Via A7A5 - The note can be redeemed for A7A5 deposited digitally into the holder’s wallet.

• In Foreign Currency (Cash) - A7 will send an agent with cash to the holder in select foreign cities. They claim redemption options in Dubai, Istanbul and parts of China. In China A7 claims to be able to deliver cash in less than 4 hours.

The Elliptic spokesperson who commented for this report called this system innovative, noting that they have never heard of similar bearer-bond-like instruments using crypto.

A7’s promissory note scheme is designed to further evade attempts at freezing crypto wallets and enforcing sanctions. They function as an off-blockchain IOU for companies in Russia seeking to make purchases in China and elsewhere.

The Shor network’s financial operations are extensive and expensive. They represent major investments into infrastructure and are not simply a short-term workaround. A7A5 and their other tools are part of an effort to bypass the SWIFT system and create long term options for evading American and European financial sanctions.

Investing in Election Interference

Shor’s network has many parts but all of them seek to promote 2 goals - profit for Shor and furthering the Kremlin’s political goals. Given that, it appears that A7 / A7A5 have 3 primary purposes:

1. To facilitate sanctions evasion, cross border financial transactions and to acquire USD outside of the traditional banking system.

2. To make a profit for Mr. Shor and PSB

3. To create a slush-fund to support Shor’s political manipulations in Moldova (and elsewhere)

While we can’t see into A7 or Evrazia’s books, there is strong precedent for this type of arrangement by the Russian security services. Russia has used smugglers, money launderers, hackers and all manner of criminals in support of their efforts to destabilize other countries and conduct hybrid operations. In exchange, their criminal activities are tolerated or even protected by the state. Russia’s operations targeting Moldova’s elections required substantial amounts of money and utilized USDT and crypto for many transactions. It’s highly likely that, while Shor’s network is making money for him, the cost of doing business is self-financing hybrid attacks against Moldova (and elsewhere).

How Crypto was Used in the Moldovan Elections

During the 2024 and 2025 Moldovan elections the Shor network spent large sums of money attempting to subvert the vote and overthrow Moldova’s democracy. This involved voter bribery schemes as well as mass information operations. In 2024 journalists from Ziarul de Gardă (ZdG) went undercover and infiltrated Shor network operations. In their reporting they found that most network “activists” were being paid via accounts set up with Russia’s PSB bank. This proved cumbersome as the money could only be withdrawn in Transnistria. In many other situations the Shor network relied on cash smuggled across the borders to bribe voters and fund their operations.

By 2025 a new ZdG undercover investigation showed a change - “activists” were offered payments in crypto now. In their investigation titled “The Kremlin’s Digital Army” the ZdG journalist was paid in crypto for participating in the “InfoLider” disinformation network. They also offered payments via PSB or in Euros as cash.

None of this crypto was A7A5 and the network relied on USDT and other mature cryptocurrencies as the primary vehicle for financing election interference operations. In a speech made by President Maia Sandu on the occasion of the 35th anniversary of the Venice Commission in October 2025 she highlighted an example saying:

“As our law enforcement agencies blocked conventional channels, the operation shifted to crypto. One wallet alone, uncovered by the anticorruption agency, held over €100 million — funds used for troll farms, fake media, protests, and vote buying.”

In a prior speech made at the European Parliament in Strasbourg, President Sandu called out “crypto, shell companies, prepaid cards” as well as smuggled cash as major sources of illicit election financing. She estimated that “Russia spent the equivalent of 1% of Moldova’s GDP, to influence the 2024 elections.”

President Sandu and others in the Moldovan government have clearly warned that Russia is testing these capabilities in Moldova but will not stop there. The subsequent growth of the Shor network in Kyrgyzstan as well as their innovations in creating new illicit financial instruments since the elections has shown that the network is learning and adapting. These tools are being leveraged both for evading sanctions and to create mechanisms for financing hybrid warfare operations around Europe. Thomas Rowley at Reporter.London reported in December 2025 about a Hungarian subsidiary of a Kyrgyz company operating as a clearing house for A7 in Budapest. Following the Moldovan elections this network has shown signs of growth rather than retrenchment.

Conclusion

The evidence presented in this report suggests that the financial architecture surrounding A7 and A7A5 is not designed to create a parallel monetary system in the traditional sense. Instead, it functions as a conversion and distribution mechanism - one that transforms restricted forms of capital into assets that can be deployed quickly, discreetly and at scale.

In this system, A7A5 plays an important but limited role. It is not widely used as a store of value, nor does it appear to be the currency in which political operations are conducted. Rather, it serves as an intermediary layer: a bridge between the Russian financial system and the broader cryptocurrency ecosystem.

Operational evidence from Moldova indicates that crypto payments tied to political activity - whether framed as “activism,” mobilization, or direct voter incentives - are overwhelmingly conducted in highly liquid stablecoins, most notable USDT. This reflects a basic reality of the cryptocurrency ecosystem: liquidity and acceptance matter more than origin. USDT offers both. It is stable, widely recognized, and easily convertible into cash or goods across jurisdictions.

This dynamic helps explain both the structure and the limitations of the A7/A7A5 system. While it can facilitate the initial movement of funds out of sanctioned or controlled environments, it ultimately depends on access to deeper pools of liquidity in order to function. Without the ability to convert into assets like USDT, its utility would be sharply constrained.

Seen in this light, the system is less about replacing existing financial infrastructure and more about exploiting its edges. It leverages gaps between jurisdictions, regulatory regimes, and technological systems to move value in ways that are difficult to track and even harder to disrupt.

At the same time, A7/A7A5 continues to create innovative new products aimed at building the liquidity required to become an asset in itself. Sanctions enforcement has so far limited this kleptocratic startup to more transient usages. But the ambition of the project and the long term investment in sanctions-proof financial rails means that this is an ongoing challenge for policymakers in the United States and Europe.

For now, if A7A5 represents the entry point into this system, USDT and similar coins represent its exit - and, in practical terms, its point of effectiveness.

Moldova’s 2024-2025 experience has shown that it is difficult to defend national borders in an international financial system - even with ardent sanctions enforcement. The Kremlin’s hybrid attacks against Moldova are helping them sharpen tactics and build new capabilities that are not, and were never meant to be solely about Moldova. The use of cryptocurrencies in financing hybrid operations is likely to grow in significance as the Shor network and other Kremlin actors build ever more sophisticated capabilities and deploy them at scale.

1. Officially the team behind A7A5 claim that there are no ongoing connections between the cryptocurrency and Ilan Shor and A7. This is almost certainly not true, as the coin shares ample digital infrastructure with the Shor network.

2. This represents the total amount moved in transactions, not the total value held in A7A5. As this paper will show, A7A5 is not used as a store of value but as a short term transit stop in the crypto ecosystem.