A new report reveals details of a major sanctions evasion scheme for Russian top business executives and oligarchs, based on a cryptocurrency issued by payments company A7.

The findings of an investigation by independent outlet Proyekt uncovered the scale of use of A7's A7A5 stablecoin in an extensive payment scheme aimed at circumventing sanctions slapped on Russia in the wake of its February 2022 invasion of Ukraine.

Rapid rise
A7 was founded in 2024 by Ilan Shor, an oligarch wanted in his home country of Moldova for involvement in a large-scale bank embezzlement scheme more than a decade ago. Shor's founding partner was Promsvyazbank (PSB), a defence-oriented Moscow-based lender whose CEO is the son of Mikhail Fradkov, the former Russian prime minister and head of the intelligence service. In less than a year, A7 turned into a major payments company with around 2,000 employees and offices in several countries, accounting for around 15% of all of Russia's cross-border financial transactions.

A7's senior management is largely composed of former officials from Russian lender VEB, which also allegedly acted as a guarantor for loans and co-owns certain legal entities within the broader A7 structure, reinforcing its central role in supporting the business.

Murky ownership structure, top users

Officially, A7 is owned by Shor, who holds a controlling 51% stake, and PSB, which owns 49%. However, Proyekt reported that Russian entrepreneur Viktor Kharitonin, as well as lender VEB, are also involved.

Meanwhile, according to Proyekt, the list of A7's users features prominent names, including billionaire Roman Abramovich, former FSB director Nikolai Patrushev and entities linked to Novatek boss Leonid Mikhelson, construction developer Arkady Rotenberg, who has ties to the Kremlin, and Vladimir Yevtushenkov, who controls the Sistema conglomerate.

A7A5 – a crypto pegged to the ruble

One explanation for A7's rapid rise as a major payments company is that it provides an option to circumvent Western sanctions against Russia through legal entities registered in Kyrgyzstan and the A7A5 cryptocurrency, which is positioned to be the world’s first stablecoin pegged to the Russian ruble and backed by deposits at PSB Bank.

Since its launch in early 2025, A7A5 has recorded a substantial volume of transactions, which, according to anti-money laundering experts quoted by Proyekt, is likely to be a clear sign of circumventing Western sanctions imposed on Russia.

Garantex rebranded to Grinex

One of the entities involved in the issuance of A7A5 was Kyrgyzstan-registered crypto exchange Grinex - whose name sounds similar to that of Garantex, a Russian crypto exchange that was hit by Western sanctions and shut down in 2025.
Founded in 2019, Garantex specialised in converting rubles into crypto and facilitating cross-border transfers, and it became widely known for its alleged role in money laundering, ransomware payments and sanctions evasion.

TRM Labs, a cybersecurity firm specialising in the cryptocurrency sector, reported that the A7A5 token had been announced on Telegram two weeks before Garantex’s liquidation, and suggested that Grinex is essentially a rebranding of Garantex, allowing the exchange to continue operating.

According to TRM Labs' analysis, crypto addresses linked to Garantex began transferring funds to A7A5 as early as January 2025, indicating premeditated attempts to create a sanctions-resistant asset. The token promised holders daily profit distributions and was advertised as a way for Garantex users to recover frozen assets.

TRM Labs recorded transactions involving this asset in January 2025, including significant volumes of transfers between Garantex addresses in the weeks leading up to the operation against the exchange.

According to data from Kyrgyzstan, A7A5 was launched by Vector, a Kyrgyz company registered on 13 December 2024. On the same day and at the same address - a residential building on the outskirts of Bishkek, the Kyrgyz capital, where numerous shell companies are registered - another entity, Trust Corporation, was registered. This, according to TRM Labs, raises further questions about the opaque network behind A7A5.

Providing a way around sanctions

Although A7 has been hit by the US and the European Union, most of its affiliated entities remain unaffected, which allowed the payments scheme involving the cryptocurrency A7A5 to continue, Proyekt reported. This fragmented structure appears to be a deliberate strategy to maintain access to the global financial system despite formal restrictions.

A7's operational model relies heavily on international linkages, particularly in Kyrgyzstan, where Shor has maintained business interests for years. The Kyrgyz Republic Trading Company, established by the local government, appears to function as a key intermediary in transactions facilitated by A7.

Its role became especially significant after sanctions were imposed on Russian lender Gazprombank in late 2024, complicating traditional payment channels for Russian energy exports.
A7 reportedly helped to design a system for processing payments for Russian gas supplied to Turkey. Under this arrangement, Turkish buyers transfer funds to accounts linked to Gazprom’s subsidiaries in Turkish state banks.

These funds are then routed through the Kyrgyz Republic Trading Company before being redistributed via a network of offshore entities, eventually reaching Russian recipients. While some payments are reportedly directed toward legitimate projects, such as nuclear energy construction, a substantial portion is believed to flow back into Russia through opaque channels.

The scale of these transactions is difficult to determine precisely, but estimates suggest that Turkey’s annual payments for Russian gas range from $3bn to $10bn. Even partial control over such flows would represent a significant financial channel for circumventing sanctions.

Proyekt's analysis of A7’s client base identified at least 25 Russian companies under US and EU sanctions. Among them are several firms involved in the production and supply of military equipment, including combat drones used in the war in Ukraine. This raises further concerns among Western policymakers about the role of alternative financial infrastructures in sustaining sanctioned sectors of the Russian economy.

Attack from an unlikely direction

Meanwhile, what Western countries were unable to achieve was achieved by anonymous hackers who recently dealt a serious blow to Grinex.

In mid-April, Grinex announced the suspension of its operations following the theft of $13mn in a cyberattack. In a statement on its website, Grinex noted that the attack was "characterised by a high level of coordination and technical sophistication."

"The digital traces and nature of the attack point to an unprecedented level of resources and technology available exclusively to entities from unfriendly states," Grinex said in a statement. "According to preliminary data, the attack was coordinated with the aim of inflicting direct damage on Russia’s financial sovereignty."

No proof of involvement of "unfriendly states" was presented.

The suspension of trading blocked users' access to their funds. On its website, Grinex published a list of 54 affected wallet addresses and the amounts of funds stolen. However, it is impossible to link crypto wallet addresses to specific entities.