preferred on
Points of Focus
- More than 180 entities processed at least $179.1 billion in A7A5 transactions between February 2025 and June 2026, according to the Financial Crimes Enforcement Network.
- A7 used the ruble-backed token in a mirror payment system, pairing transfers inside Russia with fiat payments executed abroad through its network of sub-agents.
- A7-controlled sub-agents separately processed more than $17 billion in US dollar-denominated transactions, with Treasury linking the wider network to Iranian sanctions evasion and transactions associated with North Korean crypto exchange hacks.
US regulators took new action against Russia-linked A7 Network on Oct. 1 after the Financial Crimes Enforcement Network (FinCEN) found that more than 180 entities processed at least $179.1 billion in A7A5 transactions between February 2025 and June 2026.
The Office of Foreign Assets Control (OFAC) separately designated A7 Network as a significant transnational criminal organization.
A7A5 formed one side of A7’s mirror payment system
A7A5 is a ruble-backed token issued by Kyrgyzstan-based Old Vector on Ethereum and Tron. FinCEN describes it as an internal accounting mechanism within A7’s mirror payment system.
The token moves across internal addresses to maintain a balanced ledger, while A7-controlled sub-agents execute corresponding fiat payments abroad in US dollars, yuan, dirhams, and euros.
Historically, almost all identified A7A5 activity passed through sanctioned entities, including Garantex and Grinex. Following an alleged Grinex hack in April, A7A5 became increasingly concentrated in unhosted wallets, a shift FinCEN said may indicate A7 is moving away from sanctioned exchanges. Russia-linked crypto activity has also surfaced in scrutiny around Binance customer data and Russia-Ukraine transactions.
According to FinCEN, A7 has frequently used A7A5 as a bridge into more widely accepted assets such as Tether’s USDt (USDT), which can then be converted into fiat.
A7 sub-agents processed another $17 billion
FinCEN identified more than $17 billion in US dollar-denominated transactions processed by A7-controlled sub-agents between January 2025 and June 2026.
The Treasury reported that the companies used falsified trade documents and misleading goods descriptions to disguise sanctioned or illicit payments as ordinary commercial activity.
The $179.1-billion A7A5 figure and the $17-billion sub-agent figure cover different layers of the same payment system and should not be combined.
Treasury links A7 to Iran and North Korean hacks
FinCEN proposed a rule that would prohibit covered US financial institutions from transmitting funds involving A7 Network sub-agents.
The Treasury said one sub-agent transacted directly with entities involved in Iran’s shadow oil fleet. That company and a sister entity received nearly $140 million from parties involved in Iranian sanctions evasion, while another sub-agent transferred about $1.6 million to a company tied to weapons procurement and other sanctioned activity.
The action follows scrutiny of crypto flows tied to Iran, including a Senate report finding that 84% of 846 Iran-linked wallets used USDT and a separate US investigation into Binance transactions linked to Iran.
The Treasury also linked A7 Network to sanctioned Iranian exchange Nobitex and transactions associated with North Korean cryptocurrency exchange hacks amid scrutiny of possible North Korean involvement in breaches, including the $352-million Bitget hack.
A7A5 was already blocked through earlier sanctions on Old Vector. FinCEN’s proposed restriction is subject to a public comment period that will close 30 days after publication in the Federal Register.
Share
Most read articles
