The financing of hybrid and sabotage activity in Europe increasingly relies on mechanisms that obscure the links between Russian state structures, intermediaries, and direct operatives. Traditional channels based on diplomatic and intelligence cover are being supplemented by a more fragmented system of remote coordination, in which funds can be transferred through virtual assets and different stages of an operation distributed among separate participants.
These mechanisms have become particularly important as sanctions against the Russian financial system and the expulsion of Russian intelligence personnel from European countries have made traditional infrastructure more difficult to use. Russian state agencies, particularly the Main Directorate of the General Staff of the Russian Armed Forces (GU, historically known as the GRU), and affiliated networks have gained an additional incentive to use digital currencies to finance operations abroad.
Within this system, cryptocurrency primarily serves an operational purpose. Small transfers can be used to pay for recruitment, individual assignments, and compensation to local operatives without relying on conventional banking channels. This model also separates financing, coordination, and direct execution, making it more difficult to establish a direct connection between organisers and operatives. Local agents may be recruited for arson, sabotage, and other attacks against transport, logistics, and critical infrastructure across Europe.
At the same time, Russia is developing a much broader financial infrastructure capable of supporting transactions outside the Western banking system. One of the most prominent examples is the A7 cross-border payment network and its rouble-pegged A7A5 stablecoin. This system differs in both scale and purpose from small cryptocurrency payments to individual operatives. Its primary function is to create alternative financial channels that reduce dependence on financial infrastructure under Western jurisdiction and can support Russian activity abroad.
Documented Cryptocurrency Payments in Sabotage Operations in Europe
In cases of sabotage against European infrastructure where financial transactions could be traced, available evidence points to the systematic use of cryptocurrency by Russian intelligence-linked structures to compensate recruited operatives. According to the Royal United Services Institute (RUSI), digital assets were the most common mechanism for cross-border payments in the proxy cases it examined. These transfers were typically simple and short, without complex mixing schemes or privacy-focused cryptocurrencies.
In the United Kingdom, Dylan Earl was convicted under the National Security Act 2023 for the arson attack on a commercial warehouse in Leyton, London, on 20 March 2024. The warehouse contained humanitarian aid and Starlink equipment. Court records and expert assessments showed that Earl received cryptocurrency worth approximately EUR 5,000 from handlers linked to the Wagner Group. Communication with the handlers took place through the Telegram account Privet Bot. A subsequent digital forensic examination also identified more than GBP 58,000 in assets in his personal cryptocurrency wallet.
Cryptocurrency payments also featured in the sabotage operation targeting air cargo shipments between 19 and 22 July 2024. Parcels containing explosive-incendiary devices, sent from Vilnius, ignited at DHL and DPD facilities in Leipzig, Birmingham, and Poland. According to Lithuanian prosecutors and the Eurojust joint investigation team, couriers and logistics intermediaries were recruited remotely through Telegram and promised payment in cryptocurrency.
Polish national security authorities have also reported that members of a large sabotage network, which the Internal Security Agency (ABW) linked to the Russian General Staff’s Main Directorate, were predominantly paid in cryptocurrency. Individual cases analysed by RUSI illustrate how the mechanism worked at the operational level. In one case, three operatives in Europe tasked with hostile surveillance received approximately USD 1,000 each in USDT. All three payments came directly from a single intermediary cryptocurrency wallet.
In documented cases involving physical attacks or preparations for them, funds typically moved through short transaction chains in Bitcoin or USDT. The cryptocurrency was then converted into cash through informal OTC exchangers with weak compliance controls or through P2P platforms. This model does not require sophisticated financial infrastructure. Its main advantages are the speed of cross-border transfers, the ability to settle payments remotely, and the separation of direct operatives from those financing and coordinating the operation.
Digital Assets in Political Interference and Support for Paramilitary Structures
The use of cryptocurrency by Russian state and state-linked structures is not limited to payments for individual sabotage operations. Digital assets also provide channels for financing political interference, information campaigns, and the material support of paramilitary formations. The common feature of these mechanisms is their ability to move funds outside the traditional banking system while reducing the visibility of links between state structures, financial intermediaries, and final recipients.
Moldova represents the most extensively documented example of the use of Russian state-linked digital assets in political interference. Moldovan law enforcement authorities established that a network associated with Ilan Shor and the sanctioned Russian state-owned Promsvyazbank (PSB) was used to move substantial amounts of money into the country before and during the autumn 2024 election period. According to investigative materials, participants in the political network received payments through the TAITO mobile application. Rouble-denominated funds held at PSB were converted into the A7A5 stablecoin, exchanged into more liquid digital assets, and ultimately converted into Moldovan lei.
In March 2026, Moldova’s anti-corruption authorities told parliament that a single monitored cryptocurrency wallet had processed more than 107 million USDT between 2023 and 2025. Moldovan authorities assessed that tens of millions of dollars from these flows were linked to interference in electoral processes, the organisation of street protests, and illegal payments to participants in political networks.
Digital asset tracing also points to their use in Russian information operations. The Doppelgänger campaign has been linked to Ilya Gambashidze of the Social Design Agency and Nikolai Tupikin of Structura. According to Western authorities, the campaign operated under the supervision of the Russian Presidential Administration. Two identified TRON addresses linked to Gambashidze received more than USD 200,000 in USDT. A substantial share of these funds came directly from the sanctioned Russian cryptocurrency exchange Garantex.
Another area in which digital assets have been used is the support of paramilitary formations operating in Russia’s interests. According to the US Treasury’s Office of Foreign Assets Control (OFAC) and TRM Labs, eleven cryptocurrency wallets were linked to Task Force Rusich. Between March and September 2022, these wallets collected approximately USD 138,000. The funds were used to purchase thermal sights, body armour, drone components, and tactical communications equipment.
Unlike the more centralised financial mechanisms associated with A7, these cryptocurrency fundraising campaigns functioned as an autonomous procurement channel. Wallet analysis found no shared infrastructure with Garantex, Grinex, or A7 corporate entities. This indicates that the use of digital assets in Russian operations abroad does not depend on a single centralised financial network. Instead, several parallel models coexist, ranging from small payments to individual operatives and financing for political networks to centralised payment systems and public cryptocurrency fundraising for military and paramilitary needs.
The A7 Network and the Role of the A7A5 Stablecoin
The A7 network was established in Russia in 2024 as a cross-border settlement system designed to reduce dependence on Western correspondent banks and facilitate payments outside traditional financial infrastructure. The project received institutional backing from Promsvyazbank and the state corporation VEB.RF. A7 LLC is owned 51 per cent by Ilan Shor and 49 per cent by PSB.
The scale of the network extends far beyond transactions processed directly through A7 LLC. According to the US Department of the Treasury, by January 2026 A7 itself claimed to be processing more than 2,000 transactions per day, with cumulative turnover exceeding RUB 7.5 trillion, or approximately USD 91.5 billion. FinCEN separately established that intermediary companies within the network processed more than USD 17 billion in transactions between January 2025 and June 2026.
Paper promissory notes and modified trade documentation remain central to A7 operations. At the same time, digital assets play an important role in moving and balancing liquidity across different parts of the system. In particular, the network converts USDT into roubles through major wholesale markets in Moscow, including Sadovod and Food City. The resulting funds and digital reserves are then redistributed among counterparties and financial channels in Kyrgyzstan, China, Egypt, Türkiye, and the United Arab Emirates.
The digital component of this settlement infrastructure is the A7A5 stablecoin, issued by Kyrgyzstan-registered Old Vector LLC. Its value is pegged to the Russian rouble at a 1:1 ratio, with reserves backed by deposits at PSB. However, the reserve attestation published by Kreston Bishkek on 31 March 2025 did not constitute an independent audit of the company’s balance sheet and relied heavily on information provided by management.
To encourage holders to retain A7A5, the token used an automated mechanism that increased balances on business days. Initially, holders received the equivalent of 50 per cent of the interest income generated by the underlying deposits. From 9 February 2026, the formula was changed, with returns calculated on the basis of the Bank of Russia’s key interest rate minus one percentage point.
Headline turnover figures for A7A5 grew rapidly. According to Elliptic, cumulative transfers exceeded USD 100 billion by January 2026, while TRM Labs recorded more than USD 166 billion by June 2026. However, a substantial share of this turnover did not represent genuine economic activity. Approximately USD 35 billion consisted of automated circular transfers between accounts controlled by the system’s own operators.
From mid-2025, sanctions, tighter compliance screening by major cryptocurrency exchanges, and address freezes by Tether substantially constrained A7A5. Average daily transaction volume fell by approximately 96 per cent, from around USD 600 million in July 2025 to USD 24.3 million in June 2026. Excluding internal circular transfers, monthly genuine transaction volume fell to approximately USD 6 million.
No new principal A7A5 tokens have been minted since July 2025. The remaining token supply is estimated at approximately USD 468–470 million. More than 99 per cent of the total supply is concentrated in just four wallets. At the same time, 94.5 per cent of A7A5 tokens on TRON are held in an operator-controlled vault created on 18 May 2026, together with assets linked to the operator of Grinex.
Analysis by Crystal Intelligence further highlights the gap between headline A7A5 turnover and genuine economic activity. According to the platform, only around 19 cents of every dollar in turnover represents transactions with real economic substance. The remainder largely reflects internal liquidity movements or funds that are effectively dormant. This suggests that after a period of rapid expansion, actual use of A7A5 declined sharply under the combined pressure of sanctions, asset freezes, and reduced access to external cryptocurrency infrastructure.
Conversion Platforms, Successor Networks, and Alternative Channels
Russian sanctions-evasion and covert-financing mechanisms depend not only on digital assets themselves, but also on infrastructure that allows them to be converted into fiat currency, transferred across jurisdictions, and reintroduced into commercial circulation. Sanctions did not eliminate this infrastructure. Instead, activity shifted between centralised cryptocurrency platforms, informal exchangers, and specialised settlement services.
For a considerable period, the Moscow-based cryptocurrency exchange Garantex served as a central node in this system. Before law enforcement intervention, it processed at least USD 96 billion in gross transaction volume. On 6 March 2025, law enforcement agencies from several Western countries seized its web domains, confiscated servers in Germany and Finland, and froze approximately USD 26 million in assets.
Following the disruption of Garantex, the Kyrgyzstan-registered platform Grinex became one of the main alternative channels. Established in December 2024, it processed approximately USD 16.5 billion over its period of operation, including roughly USD 9.25 billion after sanctions were imposed. Grinex ceased operations on 16 April 2026 following reports of the theft of around RUB 1 billion, equivalent at the time to approximately USD 14 million.
Smaller conversion venues continued to operate in parallel. Meer, operated in Bishkek by CJSC TengriCoin, processed approximately USD 305 million in A7A5/USDT trading pairs during 2025. The broader infrastructure also included Rapira, ABCeX, and Aifory Pro. These platforms helped maintain liquidity and redirect transactions after access to larger exchanges became restricted.
A separate mechanism was developed through Exved, a platform founded by Garantex co-founder Sergey Mendeleev. It was used for foreign-trade settlements under a model in which a Russian importer deposited roubles domestically while the foreign supplier received USDT offshore. As a result, the cryptocurrency component of the transaction did not appear directly in banking records, allowing the parties to bypass restrictions within the traditional payment system.
Regulatory pressure and tighter private-sector compliance procedures gradually constrained these channels as well. In August 2026, Binance introduced phased restrictions against sixteen platforms, including Rapira, Aifory Pro, ABCeX, HTX, and EXMO. This further complicated their access to global cryptocurrency liquidity.
New data from US financial authorities show that this infrastructure is used for more than Russian sanctions evasion. According to FinCEN, A7 intermediary companies were used by entities linked to the Central Bank of Iran, the Islamic Revolutionary Guard Corps, and Iranian schemes involving oil sales and arms procurement. One A7 intermediary and a related company received nearly USD 140 million from entities involved in circumventing sanctions on Iran. OFAC has also linked the network to the Iranian cryptocurrency exchange Nobitex and to transactions connected with North Korean cyberattacks against cryptocurrency platforms.
After A7A5 came under significant pressure, Russian state and state-linked structures began developing alternative settlement mechanisms. The most prominent has been Rosveksel, registered on 4 May 2026. A7 owns 85 per cent of the company, while the Russian Ministry of Finance holds the remaining 15 per cent. In May 2026, Rosveksel launched an online platform for settlement using physical gold, and in July began selling digital certificates.
Regulatory attention has also expanded to regional digital assets capable of performing similar functions. One example is USDKG, a Kyrgyzstan-linked stablecoin with claimed gold backing. Its issuer, Virtual Asset Issuer OJSC, was sanctioned by the United Kingdom on 26 May 2026.
Similar mechanisms are also emerging within the conventional banking sector. In July 2026, Alfa-Bank launched its own cross-border settlement service using digital assets. At the same time, A7 has continued to expand geographically through A7 Africa, A7 Nigeria, and partnerships with payment processors, including Zimbabwe-based PilotFinance.
Taken together, these examples demonstrate the adaptability of Russia’s alternative financial infrastructure. The closure of a single exchange or the blocking of a particular token does not stop activity entirely. Instead, operations move to other platforms, jurisdictions, and financial instruments. The result is a decentralised network of interchangeable channels combining cryptocurrency exchanges, trading platforms, informal exchangers, banking services, and alternative assets.
International Sanctions Architecture and Legal Constraints
The European Union, the United Kingdom, and the United States have progressively expanded sanctions against Russia’s alternative financial infrastructure. As settlement activity moves away from traditional banks and towards cryptocurrency platforms, stablecoins, and intermediaries in third countries, sanctions policy is also shifting from blocking individual Russian entities to restricting the broader infrastructure that supports such transactions. At the same time, differences between jurisdictions and the legal characteristics of digital assets continue to leave room for activity to migrate to new platforms.
The European Union has progressively broadened this approach. Under the 19th sanctions package adopted on 23 October 2025, the EU imposed restrictions on the developer of A7A5, the token’s Kyrgyz issuer, and a platform through which substantial volumes of A7A5 trading were conducted. The EU also prohibited transactions involving the A7A5 stablecoin.
The 20th sanctions package, adopted on 23 April 2026, further expanded restrictions on the cryptocurrency sector. The EU banned transactions involving RUBx, restricted support for the development of the digital rouble, and introduced sectoral restrictions against Russian platforms providing crypto-asset transfer or exchange services. The package also marked the first use of the EU’s anti-circumvention mechanism against Kyrgyzstan, restricting exports of selected categories of goods identified as carrying a high risk of re-export to Russia.
The 21st package, adopted on 23 July 2026, further expanded the sanctions framework around digital assets. The EU extended transaction bans to 14 cryptocurrency service providers in third countries. It also created a legal mechanism allowing European operators to be prohibited entirely from dealing with crypto-asset providers in jurisdictions used to circumvent sanctions against Russia. This reflects a gradual shift from sanctions against individual companies towards the ability to restrict entire external channels of access to cryptocurrency infrastructure.
The United Kingdom has followed a similar approach through the progressive expansion of its sanctions lists. Following initial restrictions against A7-related entities in 2025, the British government introduced a new package on 26 May 2026 targeting cryptocurrency and financial intermediaries linked to the Russian financial sector. Those designated included Rapira, Aifory, EXMO, BitPapa, HTX, and other entities, as well as Sergey Mendeleev. For several companies, the measures include asset freezes and restrictions on correspondent banking relationships and payment processing.
In the United States, the Office of Foreign Assets Control remains the principal sanctions authority in this area. In August 2025, OFAC reimposed sanctions on Garantex and designated its successor Grinex, together with related entities in Russia and Kyrgyzstan. The US approach has remained comparatively targeted, focusing primarily on identifiable legal entities, operators, executives, and financial infrastructure that can be legally defined and controlled.
This distinction became particularly important following the ruling of the US Court of Appeals for the Fifth Circuit in Van Loon v. Department of the Treasury. The court held that immutable smart contracts that are not owned or controlled by a particular person do not constitute “property” under the International Emergency Economic Powers Act (IEEPA). Sanctions authorities therefore cannot block autonomous software code in the same way they can block a bank account, company, or other controlled asset. In practice, this shifts enforcement towards legal entities, developers, operators, administrators, and other parts of the system subject to actual control.
The US GENIUS Act, adopted on 18 July 2025, is also relevant because it establishes a federal regulatory framework for payment stablecoins. The legislation becomes effective on the earlier of two dates: 18 months after enactment, on 18 January 2027, or 120 days after federal regulators adopt final implementing rules. As of the end of September 2026, the Federal Reserve had only published draft rules, meaning the new regime was not yet fully operational.
On 1 October 2026, the United States significantly expanded its approach to A7. OFAC designated A7 Network as a significant transnational criminal organisation. Unlike previous measures targeting individual legal entities, including A7 LLC and Old Vector LLC, the new designation encompasses a broader network of intermediary companies through which A7 conducts international settlements.
At the same time, the Financial Crimes Enforcement Network (FinCEN) proposed prohibiting US financial institutions from processing transfers linked to these A7 intermediaries and issued separate indicators for identifying related transactions. The US approach is therefore also shifting from sanctions against individual companies towards restricting the access of the wider A7-linked network to the US financial system.
As a result, sanctions are increasingly targeting not only individual exchanges or tokens but the entire chain through which they are used, including issuers, trading platforms, financial intermediaries, and conversion infrastructure. Completely closing these channels, however, remains difficult. Operations can move between jurisdictions, platforms, and new legal entities, while decentralised technologies create additional legal constraints on the direct application of traditional sanctions mechanisms.
Policy Conclusions and Targeted Recommendations
Available evidence does not indicate the existence of a single digital financial system through which the Russian state centrally supports all covert activity abroad. Instead, digital assets are systematically used to address different operational and financial requirements. Small sabotage networks are paid primarily in Bitcoin and USDT, while larger sanctions-evasion mechanisms combine stablecoins, modified trade documentation, intermediaries, and secondary cryptocurrency platforms.
Despite their differences, these models share a common vulnerability: they depend on the conversion of digital assets, the movement of liquidity across jurisdictions, and interaction with financial intermediaries. These transition points between cryptocurrency and the conventional financial system remain the most accessible targets for law enforcement and regulatory authorities. The primary focus of disruption should therefore be exchanges, brokers, OTC cash desks, banks, payment infrastructure operators, and the individuals who control these services, rather than autonomous blockchain protocols.
Integrate Cryptocurrency Transaction Analysis into Sabotage Investigations
European security services and financial intelligence units should systematically incorporate digital asset analysis into investigations of sabotage and other hostile activity. Cryptocurrency wallet addresses, transaction hashes, and intermediary data identified during investigations should be preserved in standardised formats and shared between relevant agencies through existing multilateral mechanisms, including Europol SIENA and the European Financial Intelligence Public-Private Partnership (EFIPPP).
This is particularly important for small proxy networks. As the cases examined above demonstrate, payments to operatives often move through short transaction chains and shared financial intermediaries. Identifying and freezing a single broker wallet can disrupt the financing of several connected operational cells at the same time.
At the same time, such information sharing must comply with statutory requirements governing the confidentiality of Suspicious Transaction Reports (STRs), restrictions on the use of personal and financial data, and rules ensuring the evidentiary integrity of material for subsequent judicial proceedings.
Focus Sanctions Pressure on Conversion Points
A second priority should be the infrastructure through which digital assets are converted into fiat currency or moved between different financial systems. Particular attention should be paid to cryptocurrency brokers with weak compliance controls, OTC cash desks, and regional banking hubs in transit jurisdictions, including Kyrgyzstan, the United Arab Emirates, Georgia, and Türkiye.
Secondary platforms where allied sanctions regimes remain only partially aligned also warrant separate assessment. These include Rapira, ABCeX, Aifory Pro, and TengriCoin. Closer coordination between the United States, the European Union, and the United Kingdom could reduce opportunities to shift activity from one jurisdiction to another after sanctions are imposed.
Sanctions should primarily target legal entities, beneficial owners, operators, and controllable elements of digital infrastructure. Immutable autonomous smart-contract code has a different legal status and cannot always be subjected to the same blocking mechanisms as companies, accounts, or assets under the effective control of identifiable individuals.
Track Successor Networks and the Movement of Dormant Reserves
A separate analytical effort should focus on new payment mechanisms that emerge after existing infrastructure is disrupted. The experience of A7, Garantex, and Grinex shows that sanctions often do not eliminate a financial channel entirely. Instead, they encourage its migration to a new legal entity, platform, or jurisdiction.
Authorities should therefore monitor not only active transactions but also large reserves of digital assets that are currently dormant. Particular attention should be paid to the operator wallet created on 18 May 2026, which holds the majority of A7A5 tokens on TRON. Any substantial movement of these assets could indicate the reactivation or restructuring of the settlement system.
Monitoring should also cover emerging mechanisms, including Rosveksel, the USDKG stablecoin, digital-asset services provided by commercial banks, and the geographic expansion of A7-linked structures in Africa. The registration of new companies, domains, or payment services connected to known participants in these networks should trigger rapid reviews of beneficial ownership, technical infrastructure, and financial links.
Integrate Banking, Customs, and Blockchain Data
A persistent challenge is the separation between the fiat and digital components of sanctions-evasion schemes. A Russian importer may make a rouble payment domestically, while a foreign supplier receives cryptocurrency through a separate intermediary abroad. In such a model, an individual bank sees only one part of the transaction and cannot independently reconstruct the full payment chain.
Financial monitoring systems should therefore combine banking transactions with customs declarations, shipping records, trade invoices, and blockchain analytics. Particular attention should be paid to transactions involving dual-use goods and items classified as Common High Priority Items.
Higher-risk indicators may include newly incorporated companies with disproportionately high turnover, payments between companies with no obvious commercial relationship, altered invoices concealing sensitive technologies, and the use of foreign VPN addresses inconsistent with a client’s normal profile.
Accelerate Cooperation with Cryptocurrency Platforms and Issuers
Financial intelligence units and law enforcement agencies also need standardised mechanisms for rapid engagement with major centralised cryptocurrency exchanges and stablecoin issuers. This would allow legally grounded requests to be transmitted more quickly, transaction data to be obtained faster, and, where permitted by law, addresses or associated assets to be frozen.
European and US regulators should also work towards greater alignment of technical and administrative standards for stablecoins ahead of the full implementation of the new US regulatory regime.
Finally, structured information sharing with Ukrainian law enforcement agencies, security services, and financial intelligence units should remain an important component of this effort. Ukrainian authorities may have early visibility into recruitment platforms, Russia-linked handlers, and financial routes that are later used in operations elsewhere in Europe. Rapid exchange of such information can improve the chances of identifying operational networks before they move from preparation to physical attacks.
