Russia Built a $100 Billion Shadow Bank. It Runs on Ethereum.
A ruble-backed stablecoin that's called A7A5 processed $100 billion in under a year, backed by a sanctioned Russian defense bank, built by a convicted fraudster, and blessed by Vladimir Putin.
August 15, 2025
On August 14th, the US Treasury sanctioned the wallets.
By August 15th, the network had already responded.
A function ran in the smart contract. Its name was destroyBlackFunds. It classified $405 million in tokens as “dirtyShares” and burned them off the ledger. The same value was immediately re-minted to a brand new wallet, with no transaction history and no traceable link to the sanctioned addresses.
The new wallet was called TNpJj. It has since processed $6.1 billion.
The system did not break. It adapted, overnight, with precision. The operators had studied every previous enforcement action, including the takedown of Garantex, a sanctioned Russian exchange, six months earlier. They had watched how Tether froze wallets. They had built the workaround into the code before sanctions ever landed.
This is A7A5. Russia’s shadow bank. Built on Ethereum and TRON. Blessed by Vladimir Putin. Run by a convicted fraudster and a defense intelligence dynasty. Past $100 billion in transactions in under a year.
The US, UK, and EU have all sanctioned its core infrastructure. It is still running.
The Architecture
A7A5 is a ruble-backed stablecoin. It launched in January 2025. In under a year, it processed over $100 billion in transactions, becoming the largest non-US dollar stablecoin in the world by market cap at its peak.
It runs on Ethereum and TRON, public blockchains visible to anyone. It is formally issued by a Kyrgyzstan company called Old Vector LLC, registered December 2024. According to corporate registry documents obtained from the Kyrgyz Justice Ministry by RFE/RL, the registered address of Old Vector was a small ramshackle house on the outskirts of Bishkek. The actual infrastructure is somewhere else entirely.
The company behind A7A5 is A7 LLC, registered in Moscow in September 2024. A7 was built for one purpose: to move money for Russian businesses cut off from the global financial system by Western sanctions after the 2022 invasion of Ukraine. Mastercard and Visa had suspended operations. Russian banks had been excluded from SWIFT. Cross-border payments that previously took days were taking months or not happening at all.
A7 is 51% owned by Ilan Shor. Shor is a Moldovan oligarch convicted in 2017 for the $1 billion theft from three Moldovan banks, a scandal known as “the theft of the century.” He is sanctioned by the US, UK, and EU for using cryptocurrency to fund Russian election interference in Moldova. He appeared at the St. Petersburg International Economic Forum in June 2025 in his capacity as CEO of A7. He lives in Moscow as a fugitive.
The other 49% is owned by Promsvyazbank, known as PSB. PSB is a Russian state-owned bank, nationalized by the Kremlin in 2018 and repurposed specifically to finance Russia’s defense-industrial sector. Sanctioned by the US, UK, and EU since 2022. Every single A7A5 token is backed 1:1 by rubles sitting in PSB accounts. PSB’s stake in A7 has been pledged to VEB.RF, Russia’s state development corporation, as collateral for loans made to A7. The Russian state is not adjacent to this project. It is funding it.
The co-executive at A7 is Pyotr Fradkov. He has headed PSB since 2018. His father is Mikhail Fradkov, Putin’s Prime Minister from 2004 to 2007, and then Director of Russia’s Foreign Intelligence Service for nine years after that.
This is not a startup. This is state infrastructure with intelligence pedigree at the top of the ownership chain.
If you have read my piece on the CIA and Bitcoin’s origins, the pattern here is familiar. You can find that here. State-adjacent financial infrastructure does not always announce itself clearly.
The Exchange Infrastructure
A7A5 launched on Garantex, a Moscow exchange operating out of Federation Tower. The same building A7 calls home. The same building where multiple companies linked to ransomware operations had previously been registered.
In March 2025, the US Secret Service seized Garantex. Tether froze $28 million in USDT from its wallets. The exchange went offline. This was a coordinated Western enforcement action. It was supposed to send a message.
The day after Garantex went offline, users began migrating to a new exchange called Grinex. Grinex had been registered in Kyrgyzstan in December 2024, three months before Garantex’s takedown. Chainalysis confirmed it was accepting transfers from Garantex immediately after shutdown. An unnamed Grinex staff member told blockchain analysts that Garantex customers were physically visiting Grinex’s Moscow office to move funds between the two platforms.
Garantex customers walked from one floor to another in the same building.
Grinex had been built to receive exactly this traffic. Prior to the Garantex seizure, Shor’s representatives had met with Garantex administrators specifically to set up A7A5 trading infrastructure. Chainalysis confirmed this in its 2026 Crypto Crime Report.
In August 2025, OFAC sanctioned Grinex and Old Vector. The following day, destroyBlackFunds ran.
The new TNpJj wallet shared 11 counterparties with the old sanctioned wallets and conducted the majority of its transactions during Moscow working hours, 10am to 8pm. The operational signature was identical. Only the address had changed.
The Exit Ramp
Chainalysis identified a service called the A7A5 Instant Swapper. It converts A7A5 directly into USD-pegged stablecoins, primarily USDT, with few or no KYC checks. Over $2.2 billion has moved through it.
The route is straightforward. Rubles sit in sanctioned PSB accounts. They back A7A5 tokens. Those tokens pass through the Instant Swapper. They emerge as USDT in the broader crypto economy, with no visible chain back to the sanctioned origin.
This is the context that makes the Circle wallet freeze worth revisiting. I covered what Circle did here. Circle froze 16 legitimate business wallets by mistake, based on a faulty civil case request. The CLARITY Act debate, which I broke down here, centers substantially on whether Circle and Tether have adequate compliance infrastructure.
Meanwhile, a purpose-built sanctioned network moved $2.2 billion through a no-KYC converter without the industry naming it in a single major conference panel.
The stablecoin conversation in Western policy circles is about reserves and oversight. The stablecoin conversation that matters is happening somewhere else entirely.
destroyBlackFunds to burn $405 million in tokens labeled "dirtyShares" and re-mint them to a clean address, severing the on-chain trail overnight.The IRGC Layer
Russia is not the only state actor building on this infrastructure.
According to Chainalysis, in Q4 2025, IRGC-linked addresses accounted for over 50% of all value received by Iranian entities. Over $3 billion moved to regional militia networks, oil sales, and procurement of dual-use equipment. That includes Hezbollah, Hamas, and the Houthis.
Iran does not primarily use A7A5. Iran routes overwhelmingly through Tether on TRON. The same blockchain A7A5 runs on. Two parallel state-level financial systems, different tools, same infrastructure layer.
For ordinary Iranians during the January 2026 internet blackout, the story was different. Chainalysis recorded a surge in withdrawals from Iranian exchanges to personal Bitcoin wallets. Civilians were moving to self-custody. The state was using stablecoins for settlement. Citizens were using Bitcoin for survival.
Two completely different use cases, on the same network, at the same time.
I covered how Tether sits inside all of this in more depth here.
The Leak
In September 2025, a cyberattack on A7 systems resulted in a cache of internal documents being published online.
Elliptic analyzed the leak. It was extensive. Leaked internal chats showed A7 employees coordinating market-making campaigns, with A7 wallets sending at least $2 billion in USDT to exchanges to artificially create liquidity for A7A5 and drive adoption. The documents also revealed something that extended far beyond sanctions evasion.
Shor had used cryptocurrency to fund political interference operations in Moldova. The leaked chats referenced links to the Kremlin and the FSB. There was an app called “Taito” used to manage and pay a network of political activists on the ground.
The network was not just moving trade payments. It was funding the Kremlin’s broader operational agenda.
This connects to a pattern I have written about before. The Nikolai Mushegian case, which you can read here, sits in the same broader geography. Intelligence services, financial infrastructure, and cryptocurrency are not separate conversations.
Putin Attended the Opening
On September 4, 2025, Vladimir Putin attended a virtual ribbon-cutting for A7’s new office in Vladivostok. The Far Eastern International Financial Settlement Center.
Putin does not attend branch openings. He attends battleship launches and Kremlin medal ceremonies. He attended this one.
Ilan Shor stood at the podium, visibly nervous by multiple accounts, and told Putin that A7 had processed 7.5 trillion rubles in cross-border transactions in ten months. Roughly 12 percent of all Russian foreign trade. By December 2025, A7 accounted for approximately 19% of foreign trade transactions of Russian enterprises.
At one point, observers calculated A7’s transaction volume was approaching the scale of Russia’s entire trade with China, its largest trading partner.
Standing alongside Shor was Pyotr Fradkov. The co-executive whose father ran Russian foreign intelligence for nearly a decade.
The Kremlin did not distance itself from any of this. It hosted the ceremony via video link.
Made Legal, Then Sanctioned, Still Running
In October 2025, Russia officially recognized A7A5 as a digital financial asset. Russian exporters and importers can now officially settle cross-border transactions through it via Promsvyazbank. This is not gray market. This is state policy.
The EU responded the same month with its 19th sanctions package. Transaction ban on A7A5. Sanctions on the developer, the Kyrgyz issuer, a Paraguay-based exchange, eight additional banks across Tajikistan, Kyrgyzstan, the UAE, and Hong Kong. Five additional Russian banks.
The US, UK, and EU have now all sanctioned the core infrastructure of this network. Russia legalized it the same week.
A7A5 is still running.
The Token2049 Test
In October 2025, A7A5 was a platinum sponsor at TOKEN2049 in Singapore. One of the largest crypto conferences in the world. More than 25,000 attendees. Branded booth. Staff in A7A5 shirts. A scheduled speaking slot on stage where A7A5’s director stated the token held 44% of the non-USD stablecoin market.
Donald Trump Jr. spoke at the same event. So did senior executives from major crypto companies.
A7A5’s director said on the sidelines to Reuters: “We were sanctioned several times.”
After Reuters contacted TOKEN2049 for comment, every reference to A7A5 was removed from the event website within hours. A7A5 continued advertising its participation on social media afterward, including the conference massage room it had sponsored.
Singapore’s financial regulator later confirmed no rules had been broken. Sanctions in Singapore bind licensed financial institutions, not conference organizers. The event was organized by a company registered in Hong Kong, which has no Russia sanctions. Three lawyers told Reuters that the US has no jurisdiction where no US persons are involved.
The point is not that it was illegal. The point is that a sanctioned Russian financial network, backed by a defense bank with an intelligence pedigree, walked into the world’s biggest crypto conference and bought a platinum sponsorship. And the industry’s response was to quietly delete the record when a journalist asked about it.
The Expansion
A7A5 now has physical offices in Moscow, Vladivostok, Lagos, and Harare. It plans to reach Latin America and 20 countries within two years. PSB cardholders can buy A7A5 directly with their bank cards.
The DarkSword iOS exploit I reported on here specifically targeted crypto wallet apps including Coinbase, Binance, MetaMask, and Ledger. State actors building parallel financial infrastructure and state actors targeting financial infrastructure on personal devices are part of the same geopolitical posture.
A7 also issues physical promissory notes. They are designed to look like banknotes, featuring stylized Russian city silhouettes. They can be worth up to $5,000. Holders scratch off a silver film to reveal a QR code, send it to a Telegram bot, and redeem the value for rubles or A7A5 at A7 offices anywhere in the world. As of early 2026, 2,300 notes had been redeemed for a total of $8.6 million.
This is no longer purely digital infrastructure. It is a parallel financial system with physical branches, bearer instruments, state backing, and continental expansion plans.
What $100 Billion Means
Total illicit crypto volume in 2025 hit $154 billion, the highest ever recorded. Sanctioned entities received $104 billion of that, up 690% from 2024. A7A5 alone accounted for 77% of all illicit stablecoin activity in 2025, according to TRM Labs.
For context: that 77% is not a rounding error in an otherwise diverse illicit ecosystem. It is one network, one token, one ruble-backed stablecoin registered in a small house in Kyrgyzstan, dominating the category.
The GENIUS Act is moving through Congress right now. It frames stablecoins as an American-led innovation requiring American regulatory oversight. Circle and Tether would both operate under a federal framework. The bill’s supporters argue it will strengthen American dominance in digital finance.
A7A5 does not care about American regulatory frameworks. It runs on Ethereum and TRON. It is registered in Kyrgyzstan. Its operators burned and reissued 80% of the token supply the day after sanctions hit, and kept running. Its co-owning bank’s co-executive is the son of Russia’s former intelligence chief.
The stablecoin the US Treasury cannot freeze processed $100 billion in under a year. It has Kremlin backing, an intelligence dynasty in its ownership chain, offices on four continents, and a bearer instrument redeemable at offices from Moscow to Lagos.
This is not a gap in the sanctions regime. This is Russia building the replacement for the sanctions regime.
It built it on public blockchains. In plain sight. Sponsored a massage room at the world’s biggest crypto conference. Reported the numbers directly to Vladimir Putin.
And it is still running.
Strident Citizen is independent and reader funded. No ads. No institutional backing. Every article is free to read. If this kind of investigative journalism matters to you, a paid subscription is the most direct way to keep it going.
If this piece was useful to you, share it with someone who thinks stablecoin regulation is just about Circle and Tether.
This publication runs on reader support. No institutional backing, no advertisers. If independent investigative journalism on the intersection of crypto, power, and state actors matters to you, a paid subscription keeps it going.
The US, UK, and EU have all sanctioned A7A5’s core infrastructure. Russia legalized it in the same week. How long before other sanctioned states build their own version?