Moldova's National Anticorruption Center (CNA) has exposed a sophisticated cryptocurrency scheme designed to illegally influence the country's 2025 parliamentary elections, involving over $107 million in funds. According to CNA director Alexandr Pinzari, the operation involved the "illegal financing of certain political parties, with the aim of influencing the elections’ results in favor of specific electoral contenders."
The scheme functioned by transferring virtual assets to a Moldovan intermediary, who converted them into cash through a local network. These funds were then distributed to activists to "remunerate people involved in promoting the image of certain electoral contenders, to bribe voters in order to secure support for a particular candidate, as well as to mobilize participants for rallies or protests," Pinzari stated.
Investigators identified a "complex transaction scheme" leveraging non-custodial cryptocurrency wallets. One specific wallet saw transfers exceeding $107 million in the stablecoin USDT between 2023 and 2025, with $43 million moved in 2025 alone. The CNA traced the origin of these funds to two centralized crypto platforms located in Russia and Kyrgyzstan. Pinzari noted the crime ring created its own virtual currency, which was converted into USDT via exchanges to facilitate "the integration of the funds into the economic circuit of Moldova."
Blockchain analysis firm TRM Labs linked the campaign to a "Russia-backed foreign influence operation InfoLider." With assistance from a Moldovan investigative journalist who received cryptocurrency payments as part of an undercover report, TRM Labs identified the Kyrgyzstani crypto exchange TokenSpot—closely associated with the Russian government—as the likely source of one transaction.
TRM Labs Senior Blockchain Intelligence Analyst Chris Keegan explained that TokenSpot is a likely front company for the sanctioned Russian exchange Garantex and is connected to a "larger Russian sanctions evasion ecosystem" that includes the sanctioned Kyrgyzstani exchange Grinex and the ruble-backed stablecoin A7A5. "The Garantex-related entities, which include TokenSpot, have been heavily integrated into the larger Kremlin-backed sanctions evasion environment," Keegan said, adding that Garantex and A7 are both "likely Kremlin-run projects."
Wallets and accounts linked to the scheme have been subjected to international sanctions and were funded through accounts opened in the names of citizens from Turkey, Israel, Kyrgyzstan, Russia, Azerbaijan, and Moldova. TRM Labs reported that illicit entities received some $141 billion via stablecoin wallets in 2025, with the A7A5 token alone accounting for $72 billion. This case emerges as the European Commission recently considered a bloc-wide ban on all crypto transactions with Russian counterparties to clamp down on sanctions evasion.
