TRM Labs, in collaboration with the Open Source Centre (OSC), investigated the A7 network—a state-backed financial architecture created by Russia’s Promsvyazbank and fugitive oligarch Ilan Shor to facilitate cross-border payments for sanctioned Russian entities. The probe analyzed tens of thousands of leaked documents and found that A7’s on-chain cryptocurrency volume exceeded $166 billion, linking to some of the world’s most heavily sanctioned actors: Iran’s Islamic Revolutionary Guard Corps (IRGC), North Korean state hackers, Hamas, and designated financial facilitators. TRM identified two key crypto roles within A7: domestic liquidity conversion, where USDT is traded for rubles at Moscow cash markets and routed to foreign treasuries; and internal accounting via the ruble-backed stablecoin A7A5, used for book-settling. Notably, A7A5 served as a migration vehicle after the Garantex exchange seizure, moving frozen balances to a successor platform. The network also facilitated transactions with Iranian and North Korean entities, with $176.6 million in exposure to designated groups. The findings reveal a network that selectively uses crypto to bypass sanctions and maintain operational resilience, despite Shor’s public minimization of crypto’s role.

Key facts

• A7 network processed over $166 billion in on-chain crypto volume.
• Connections found to IRGC, North Korean hackers, Hamas, and designated financial facilitators.
• Crypto used for domestic liquidity conversion and internal accounting via stablecoin A7A5.
• A7A5 helped migrate frozen Garantex balances after enforcement action.
• Ilan Shor minimized crypto's role at SPIEF 2025, but analysis contradicts this.