The Ruble’s Digital Shadow
On a frigid February morning in 2025, as Moscow’s financial district stirred to life under layers of snow and sanctions, a new form of money began to circulate in the digital ether. It was called A7A5, and it would soon become the ruble’s most successful export since the Soviet Union fell. Unlike oil or gas, this export required no pipelines, no tankers, no infrastructure that Western powers could easily target or control. It needed only an Internet connection and a willingness to inhabit the gray spaces where law enforcement grows uncertain and jurisdictions blur.
The creation of A7A5 – a cryptocurrency pegged to the ruble – represented something more ambitious than mere sanctions evasion. It was an attempt to construct a parallel financial universe, one where Russian money could flow as freely as it had before the war in Ukraine transformed the country into a pariah state. That this universe would be built by a fugitive oligarch and a sanctioned defense bank seemed, in the context of post-invasion Russia, almost quaint in its predictability.
The Conjurer
Ilan Shor possesses the particular kind of criminal imagination that flourishes in the spaces between countries, between legal systems, between the moment when money disappears from one account and reappears in another. Born in 1987 to a middle-class family in Moldova- itself a country that exists in the spaces between larger powers – Shor discovered early that borders, rather than barriers, could be opportunities.
In 2014, when he was barely twenty-seven, Shor orchestrated what investigators would later call “the theft of the century”: the disappearance of one billion dollars from Moldova’s banking system, a sum equivalent to twelve per cent of the country’s entire gross domestic product. The mechanics were almost classical in their simplicity – a series of loans to shell companies, a web of offshore accounts, a careful dance of documents that transformed Moldovan deposits into untraceable assets scattered across multiple jurisdictions.
What distinguished Shor was not the scale of his theft – though that was remarkable – but his apparent belief that financial crime was merely another form of statecraft. When Moldovan courts sentenced him to seven and a half years in prison, in 2017, Shor treated the verdict as a temporary inconvenience. Two years later, while under house arrest, he simply left. His destination was Russia, where, by 2022, he had reinvented himself as a political operative, using social media and cryptocurrency to influence elections across Eastern Europe.
The sanctions that followed – from the United States, the United Kingdom, the European Union, Canada – had the unintended effect of clarifying Shor’s position. No longer could he pretend to operate in legitimate financial markets. Instead, he was free to pursue what he had always been best at: building systems that allowed money to move in ways that governments could not easily track or stop.
The Infrastructure
A7A5 was launched by A7 L.L.C., a Russian company that Shor had created in October, 2024, with a business model that was both simple and audacious: to provide “cross-border financial transfers for Russian clients facing Western sanctions.” The ownership structure revealed a partnership between the criminal and the state that would have been unthinkable in an earlier era. Shor held fifty-one per cent; the remaining forty-nine per cent belonged to Promsvyazbank, a Russian institution that the government had designated as the country’s official “defense bank,” responsible for handling financial transactions for the military-industrial complex.
Promsvyazbank was not merely under sanctions – it was the reason for some of them. When Western powers began targeting Russian financial institutions in February, 2022, the bank’s role in funding military operations made it an obvious target. By 2025, it had been severed from the international banking system entirely, its assets frozen, its correspondence with foreign banks terminated. For most financial institutions, such isolation would have meant the end of international operations. For Promsvyazbank, it became the beginning of a new kind of business.
The bank’s partnership with Shor was elegant in its logic. Shor possessed the technical expertise and criminal infrastructure necessary to move money across borders; Promsvyazbank provided the institutional backing and ruble reserves that gave A7A5 its claim to legitimacy. The stablecoin was purportedly backed one-to-one by rubles held in Promsvyazbank accounts- a promise that was both impossible to verify and difficult to refute.
The Exchange
The most audacious element of the A7A5 ecosystem was not the cryptocurrency itself but the exchange where it was traded. In March, 2025, law-enforcement agencies across the United States and Europe had finally shut down Garantex, a Russian cryptocurrency exchange that had processed more than a hundred billion dollars in transactions, eighty-two per cent of which investigators linked to sanctioned entities, ransomware groups, and other criminal organizations.
The closure of Garantex should have been a decisive victory for Western law enforcement. Instead, it became a case study in the inadequacy of traditional enforcement methods when applied to decentralized digital networks. Four days after Garantex’s domains were seized, a new exchange appeared online. It was called Grinex, and it operated from Kyrgyzstan, a Central Asian republic that had positioned itself as a cryptocurrency haven.
To anyone familiar with Garantex, Grinex was immediately recognizable. The user interface was nearly identical; the trading mechanisms were the same; even the color scheme remained unchanged. More tellingly, Garantex users discovered that they could access their account balances through Grinex, as if the March seizure had been merely a temporary server outage rather than a coordinated international law-enforcement operation.
The resurrection of Garantex as Grinex represented more than regulatory arbitrage – it was a demonstration of the limits of state power in the digital age. By establishing operations in Kyrgyzstan, the exchange’s operators had moved beyond the immediate reach of Western sanctions while remaining within Russia’s sphere of influence. Kyrgyzstan’s government, dependent on Russian economic support and home to a large Russian military base, was unlikely to cooperate enthusiastically with Western enforcement efforts.
The Volume
Since its launch, A7A5 has processed more than forty billion dollars in transactions. To put this figure in perspective, it represents more than the annual gross domestic product of most countries. The daily volume often exceeds one billion dollars, a figure that approaches the transaction volume of major national payment systems. Yet the cryptocurrency’s market capitalization – the total value of all A7A5 tokens in circulation – remains around five hundred million dollars.
This discrepancy between transaction volume and market capitalization suggests something that financial investigators recognize as a hallmark of money laundering: the same funds being moved repeatedly to create the appearance of legitimate commercial activity. In the cryptocurrency world, this practice is known as “wash trading,” and it serves multiple purposes. It inflates apparent demand for a token, making it seem more popular and valuable than it actually is. It provides cover for genuine money-laundering transactions, which become invisible amid the noise of artificial volume. And it creates a kind of financial perpetual-motion machine, where the act of moving money becomes indistinguishable from legitimate commerce.
Blockchain analysis firms have identified other patterns consistent with systematic money laundering. A small number of “whale” accounts control most of the A7A5 supply, suggesting centralized control rather than distributed ownership. High-frequency trading algorithms appear designed to maximize transaction volume rather than profit, indicating that the exchange’s primary purpose is not commercial but operational. And the geographic distribution of users, heavily concentrated in Russia and countries with weak anti-money-laundering enforcement, suggests that A7A5 has found its intended market.
The Politics
For Shor, A7A5 was never merely a financial instrument – it was a tool of political influence. In 2024, as Moldova prepared for presidential elections and a referendum on European Union membership, Moldovan police documented a massive vote-buying operation funded through cryptocurrency channels connected to Shor and Promsvyazbank. The scope was breathtaking: thirty-nine million dollars spent to influence the outcome, with individual voters receiving payments of up to two hundred euros.
The operation was notable not only for its scale – more than a hundred and thirty thousand Moldovans reportedly received payments – but for its integration of financial and digital infrastructure. The same networks that moved A7A5 across borders also distributed political payments to Moldovan bank accounts. The same websites that promoted the cryptocurrency also spread disinformation about European integration. Digital forensics revealed that A7A5 domains and Shor’s political websites shared Internet Protocol addresses, confirming what investigators had long suspected: that the cryptocurrency was merely one component of a broader influence operation.
The success of the Moldova operation provided a template that could be applied elsewhere. By combining cryptocurrency payments with social-media manipulation, foreign actors could potentially influence elections in any country with insufficient regulatory oversight and enforcement capacity. The technology that enabled A7A5 to evade financial sanctions could just as easily be used to evade campaign-finance laws, election-monitoring systems, and other democratic safeguards.
The Response
The international response to A7A5 has revealed both the potential and the limitations of traditional sanctions enforcement. In May, 2025, the United Kingdom designated A7 for its connections to the Russian government. In July, the European Union followed with sanctions targeting Shor and associated entities. The United States Treasury Department launched investigations and enforcement actions, working to map the network’s operations and identify additional targets.
Yet these measures, while symbolically important, have had limited practical impact on A7A5’s operations. The cryptocurrency continues to process billions of dollars in daily transactions. Grinex remains online and operational. New users continue to join the network, attracted by its promise of sanctions-resistant financial services. The fundamental challenge is structural: traditional sanctions target specific individuals, entities, and jurisdictions, but cryptocurrency networks can operate across multiple jurisdictions simultaneously, shifting operations as enforcement pressure increases.
The enforcement challenges extend beyond mere technical complexity to questions of legal authority and international cooperation. When a cryptocurrency operates from Kyrgyzstan, using Russian rubles, facilitating transactions between entities in multiple countries, which jurisdiction has the authority to shut it down? When the same technology that enables money laundering also enables privacy and financial freedom, how can enforcement agencies target criminal uses without undermining legitimate ones?
The Future
A7A5 represents something new in the history of financial crime: a state-sponsored money-laundering operation that operates openly, even proudly, advertising its services to anyone seeking to evade Western sanctions. Its success has implications that extend far beyond Russian sanctions evasion to the broader question of whether traditional tools of economic statecraft remain viable in an age of cryptocurrency and decentralized finance.
The numbers suggest that they may not. Forty billion dollars in transaction volume represents a significant portion of Russia’s international payments, enough to sustain critical imports and maintain economic relationships that Western powers had hoped to sever. If sanctions can be systematically evaded through cryptocurrency networks, then the entire architecture of economic pressure may require fundamental reconsideration.
Perhaps more troubling is the template that A7A5 provides for other sanctioned entities. The technical infrastructure is not particularly sophisticated; the operational model could be replicated by any actor with sufficient motivation and resources. If North Korea, Iran, or other sanctioned states were to create their own versions of A7A5, the result could be a parallel financial system that operates entirely outside Western control.
The case also raises questions about the role of technology companies and cryptocurrency platforms in enforcing international law. Most major platforms have policies against serving sanctioned entities, but these policies are only as effective as the platforms’ ability to identify and exclude bad actors. When sophisticated actors can create new platforms as easily as they can create new websites, the burden of enforcement becomes impossibly diffuse.
A7A5 may ultimately be remembered not as a particular cryptocurrency but as the moment when the international community realized that its most powerful tools of economic influence had been quietly, systematically rendered obsolete. The ruble’s digital shadow has grown long enough to reach anywhere in the world where someone has an Internet connection and a willingness to look the other way. In a world where money can flow as easily as information, the old barriers between nations may prove to be little more than lines on increasingly irrelevant maps.
Founder and Managing Partner of Skarbiec Law Firm, recognized by Dziennik Gazeta Prawna as one of the best tax advisory firms in Poland (2023, 2024). Legal advisor with 19 years of experience, serving Forbes-listed entrepreneurs and innovative start-ups. One of the most frequently quoted experts on commercial and tax law in the Polish media, regularly publishing in Rzeczpospolita, Gazeta Wyborcza, and Dziennik Gazeta Prawna. Author of the publication “AI Decoding Satoshi Nakamoto. Artificial Intelligence on the Trail of Bitcoin’s Creator” and co-author of the award-winning book “Bezpieczeństwo współczesnej firmy” (Security of a Modern Company). LinkedIn profile: 17,000 followers, 4 million views per year. Awards: 4-time winner of the European Medal, Golden Statuette of the Polish Business Leader, title of “International Tax Planning Law Firm of the Year in Poland.” He specializes in strategic legal consulting, tax planning, and crisis management for business.
