- Category
- Latest news
Moldova’s Fugitive Oligarch Ilan Shor Exposed Running $8 Billion Crypto Network to Fund Russian Elections Interference
- Authors
![Photo of Maryna Kulakova]( "Photo of Maryna Kulakova")
A major leak of data from companies tied to Ilan Shor, the sanctioned Moldovan fugitive and Putin ally, reveals how Russia uses cryptocurrency to evade sanctions and interfere in Moldova’s upcoming parliamentary elections, according to Elliptic on September 26.
Elliptic’s analysis shows that wallets linked to Shor’s A7 group and associated businesses processed $8 billion in stablecoin transactions over the past 18 months. The funds were used to build infrastructure for Shor’s initiatives, including an app that paid a network of political activists in Moldova.
Shor, convicted in 2017 over the $1 billion theft from Moldovan banks, fled to Russia after gaining citizenship. Sanctioned by the US in 2022 for aiding Moscow’s election meddling, he launched A7 in 2024 to move Russian funds abroad. Nearly half-owned by the state-run Promsvyazbank, already sanctioned for financing the defense sector, A7 itself was blacklisted by Washington in August 2025.
-01d02dc01535117120d2e1505d298539.png)
Elliptic’s analysis of the leaked files shows wallets tied to A7 processed at least $8 billion in stablecoin transactions since early 2024, mostly through Tether’s USDT and A7’s own ruble-backed token, A7A5. A leaked “internal settlement scheme” slide shows payments funneled through Kyrgyz companies, alongside evidence of Shor’s links to Kyrgyz President Sadyr Japarov, including the gift of a luxury jet.
Chat logs highlight USDT transfers for treasury management, including a $2 million request tied to Maria Albot, a Shor ally sanctioned by the EU. Elliptic traced multiple wallets used by A7, some restructured after the August 2025 breach, and tracked at least $2 billion in USDT pushed to exchanges to support A7A5 adoption.
The leaks also connect crypto flows directly to interference campaigns in Moldova. Apps such as Taito were used to pay activists, while Callcenter was tied to illicit polling. A Telegram bot distributed Toncoin payments after basic KYC checks. Infrastructure for these projects was paid in USDT, allowing operations to continue despite sanctions.
Elliptic concludes the leaks expose how Shor’s companies combine crypto and proxies to fund Kremlin-backed interference and sanctions evasion, providing investigators with new tools to enforce measures against him and A7.
Previously, Moldovan President Maia Sandu has accused Russia of expanding its interference in the country’s upcoming parliamentary elections, scheduled for September 28, by targeting voters living abroad. She made the remarks in an interview with the Financial Times on September 14.
