A recent collaborative probe has shed new light on Russia’s sophisticated sanctions-evasion strategies, highlighting the role of digital assets in a financial setup known as the A7 network. Blockchain intelligence firm TRM Labs joined forces with the Open Source Centre to scrutinize this system, drawing from thousands of internal documents that reveal extensive cryptocurrency involvement despite the public downplaying by key figures.
The A7 network, backed by Russia’s Promsvyazbank—a lender tied to the defense sector—and Moldovan businessman Ilan Shor, was designed to help Russian entities sidelined by Western restrictions conduct international payments.
It operates primarily through traditional mechanisms like bills of exchange, routing funds via intermediaries, often in Kyrgyzstan, to settle in major currencies.
Yet on-chain data tells a more complex story, with total cryptocurrency activity surpassing $166 billion, bridging conventional banking and blockchain intermediaries worldwide.
TRM Labs’ on-chain examination uncovered how digital currencies enable dealings with some of the globe’s most restricted parties.
Despite Shor’s assertion at a 2025 economic forum that the network was “not a crypto mechanism,” evidence shows otherwise.
Cryptocurrency fills critical gaps that fiat channels cannot address, facilitating links to Iran’s Islamic Revolutionary Guard Corps (IRGC), North Korean state-linked hackers, Hamas, and various designated facilitators.
Analysis of associated addresses points to roughly $176.6 million in exposure involving Iranian or Iran-aligned groups, including the IRGC, Hamas, Houthis, exchange Nobitex, and individual Alireza Derakhshan.
Direct flows stand out: one wallet received over $65 million from an IRGC-linked address, while another took in about $5 million from Hamas.
North Korean connections include at least $590,000 in proceeds from breaches at BTCTurk and Woo X exchanges, funneled through middlemen before landing in A7-controlled wallets and likely converted to cash.
Wallets tied to Igor Himici, a sanctioned Moldovan politician aligned with Shor, interacted with a web of high-risk actors.
These include Derakhshan (linked to IRGC oil deals), Sa’id al-Jamal (involved in Houthi financing), and Jorge Figueira (facing charges in a massive Venezuelan crypto laundering scheme).
Mainland Chinese electronics suppliers also utilized A7 channels for payments, with some setups predating the network’s formal start, indicating integration of existing conduits.
TRM Labs identified two primary uses for crypto within A7. For domestic liquidity, teams converted USDT into rubles via Moscow’s cash-heavy wholesale hubs like Sadovod and Food City.
Proceeds then fed into overseas reserves across locations such as Kyrgyzstan, China, Egypt, Turkey, and Dubai.
Internally, the ruble-pegged stablecoin A7A5—issued by Kyrgyz entity Old Vector—handled accounting through circular transfers among controlled addresses.
This method, inflating reported volumes (with about one-third of A7A5’s activity being internal loops), helped balance ledgers without new token issuance or external vulnerabilities.
A7A5 proved especially useful after law enforcement targeted the sanctioned exchange Garantex in March 2025.
It acted as a bridge, crediting users’ frozen balances on the successor platform Grinex, allowing seamless asset relocation.
Later activity spikes followed similar non-minting patterns, showcasing resilience against disruptions.
The leaks portray A7 as a selective hybrid system. That being, traditional rails for routine commerce and crypto for high-risk or restricted counterparties, liquidity management, and post-enforcement continuity.
For compliance professionals, this underscores the need for multifaceted monitoring—beyond single labels—to spot patterns involving opaque structures, sanctioned profiles, and stablecoin flows.
Expanded wallet tracking by firms like TRM Labs now supports risk detection independent of direct token ties.
TRM Labs has now concluded that as global geopolitical pressures mount, such networks illustrate how state-linked actors adapt, blending legacy / tradtional finance with blockchain to sustain operations amid isolation.