A recent investigation by the London-based blockchain analytics firm Elliptic has unveiled a leak of documents linked to Ilan Shor, a Moldovan fugitive and ally of Vladimir Putin. The data sheds light on Shor’s alleged involvement in using crypto to evade sanctions and influence the upcoming parliamentary elections in Moldova.
Ilan Shor’s Business Operations Exposed
Earlier this month, documents detailing Shor’s business operations were made public. Convicted in 2017 for his role in the $1 billion theft from three Moldovan banks, Shor fled to Israel and later to Russia, where he was granted citizenship.
In 2022, he was sanctioned by the United States for his alleged efforts to disrupt democratic processes in Moldova. Per the report, Shor has been behind extensive vote-buying schemes for pro-Russian candidates and orchestrating disinformation campaigns aimed at discrediting the pro-European government.
Shor’s recent activities have centered around the A7 group of companies, which he founded in 2024 to help Russian businesses navigate sanctions and engage in cross-border transactions.
A7 is partly owned by Promsvyazbank (PSB), a state-owned bank implicated in financing Russia’s defense sector and facilitating election interference in Moldova. The US sanctioned A7 in August 2025, further complicating its operations.
In a speech to Putin, Shor claimed that A7 facilitated 7.5 trillion rubles ($89 billion) in cross-border transactions over ten months, with a significant portion linked to Asian markets.
Crypto Fueling Election Interference In Moldova?
One of the key revelations from the leak is a slide titled “Internal Settlement Scheme of Group A7,” which illustrates how payments are routed through various companies, primarily in Kyrgyzstan—a country with strong financial ties to Russia.
The leaks further highlight the critical role of crypto in Shor’s operations. Conversations among A7 employees reveal their reliance on Tether’s USDT stablecoin for treasury management and payments.
For instance, an employee identified as “athena1098” requested a transfer of two million USDT for treasury purposes, linking back to a wallet that has processed over $677 million.
The documents indicate that A7 companies have received around $8 billion in crypto since early 2024, although Elliptic asserts that this figure is likely a conservative estimate due to the potential existence of undisclosed wallets.
Another aspect of the leaks is the introduction of A7A5, a Ruble-backed crypto designed to avoid Western sanctions. Issued through a Kyrgyz company, A7A5 has seen substantial adoption, with 41.6 billion A7A5 tokens currently in circulation.
The leaks detail how A7 has sent at least $2 billion in USDT to exchanges to promote A7A5’s liquidity and usage. Furthermore, the leaked chats discuss the development of various applications, including “Taito,” used for managing payments to political activists and for illegal electoral financing.
According to Elliptic’s findings, Moldovan police have already issued warnings about Taito’s role in voter bribery. Other initiatives mentioned in the documents include projects for political polling and a Telegram bot designed to facilitate crypto payments.
Featured image from DALL-E, chart from TradingView.com
