EXCLUSIVE: UK helped detect Russian tycoon’s $107M crypto war chest linked to Moldovan election interference

The move helped Moldova’s pro-EU side stem election interference by the Kremlin and the research obtained is being used in at least four ongoing prosecutions, reporter.london and it partners can reveal.

CITY OF LONDON–A discreet Moldovan-British government operation exposed and disrupted a $107 million stablecoin slush fund used for election interference ahead of Moldova’s make-or-break 2025 election, it can be revealed.

Moldova’s future as a pro-EU democracy hung in the balance last summer, and the joint government operation is thought to have slowed down a vote-buying and propaganda campaign targeting the country. 

The atmosphere in the region was febrile. As war raged in neighbouring Ukraine, Romania, Moldova’s other neighbour and close partner of president Maia Sandu, had itself been through a major political crisis. In December 2024, the Romanian Supreme Court blocked a pro-Russian candidate from running for president, and cancelled the entire election ahead of the second round. Moldova, meanwhile, was facing a potential Russia-backed coup led by mercenaries specially trained in Serbia.

But the most important front in this geopolitical battle turned out to be in the crypto markets, which Russia has weaponised in the wake of Western sanctions over Ukraine. 

Moscow’s point man for the job was Ilan Shor, a Moldovan-Israeli politician and businessman who, amid the chaos unleashed by Russia’s war, has climbed the Kremlin’s slippery, sometimes fatal power vertical to run one of the key organisations enabling sanctions violations and foreign meddling. Sanctioned internationally in 2022, Shor was convicted in absentia for fraud and money-laundering offences in Moldova after defrauding three of the country’s top banks in the mid-2010s. 

The UK-Moldovan effort against this election subversion in 2025, revealed here for the first time, involved government financial crime experts from both countries working together to stop the crypto funding – which allegedly originated, in part, from Kremlin stablecoin A7A5 – to influence Moldova’s election in favour of Russia.

Experts believe that Moldova, sitting between Romania and Ukraine, was at the time a priority target for the Kremlin. 

According to pro-EU Moldovan politicians, Russia has funnelled hundreds of millions of euros into boosting pro-Russian parties to swing the country back under Russian influence amid the war on Ukraine, while president Sandu has proposed that Moldova joins the European Union by 2030.

Rumours of the joint operation, which is thought to have helped Moldova snatch its democracy back from the Kremlin’s grip, have been circulating for months, but can only now be confirmed. 

“The op was largely Moldovan-led,” a British official told reporter.london, adding that the UK side provided “tools” and expertise in analysing the flows of cryptocurrency in wallets linked to Shor. 

The National Anti-Corruption Centre (CNA) in Chișinău, which led the Moldovan side of the operation, confirmed the British involvement and the sending of a freezing order against a Tether stablecoin wallet, according to a written response to questions sent by Rise Moldova. 

“As part of the investigations, the Asset Recovery Agency interacted with representatives from the United Kingdom of Great Britain and Northern Ireland, who were also investigating transactions carried out through cryptocurrency trading platforms involving the same electronic wallets,” the CNA said. 

“An online conference was held and information was exchanged on these events. At the same time, as part of the investigations, a freezing order was also issued to the company that creates and manages the USDT digital tokens and requested that it suspend any operations in relation to virtual assets,” the CNA continued. In a subsequent reply, the CNA said the freezing order could not be executed due to technical reasons.

Tether declined to comment.

A Moldovan official who investigated the wallet confirmed that it was not frozen because it was already nearly empty of funds when the freeze request was sent to Tether. The same person, who requested anonymity because they are not authorised to talk to the press, confirmed that it was the $107 million wallet identified by the other sources. In total, journalists spoke to more than 20 people to clarify the details of this case.

Despite the ultimate failure of the operation to freeze the money, it is still considered a success by experts because it provides a turning point in the ability of Western authorities to collaborate on combatting election interference by hostile states.

Reporters from partner outlet Rise.md discovered that at least four of 15 prosecutions announced by Moldovan law enforcement in 2025 for illegal financing of an election campaign were connected to this wallet. Two of the three people charged in direct connection to transactions with the wallet are former Moldovan state officials, and the prosecutors allege that the wallet was controlled by Shor directly, who was giving instructions about crypto transactions. One of the people charged was a sitting official while handling crypto on Shor’s behalf, prosecutors allege.

“Without the UK’s assistance and the funding I don’t think the Moldovan authorities would have 100% been able to identify the funds,” said a European expert with knowledge of the matter.

Speaking to the Moldovan parliament in March 2026, the head of Moldova’s Anti-Corruption Agency said that law enforcement had identified a wallet with transfers “totaling over 107 million USDT” between 2023 and 2025, including 43m USDT in 2025. 

A portion of these funds, anti-corruption chief Alexandr Pinzari stated, later made their way to Moldova for vote-buying, protests and disinformation. 

Diagrams presented by Pinzari suggest that some of the funds were originally held in A7A5, a ruble stablecoin launched by Shor in January 2025, before being swapped into USDT. 

Chainanalysis confirmed to reporter.london that a specific wallet associated with Shor had received $107 million USDT between November 2022 and September 2025. 

Shor and A7 did not reply to multiple requests for comment.

Ukraine-based blockchain investigator Richard Sanders told reporter.london that he worked with Moldovan authorities in their 2025 effort to trace crypto payments. His research revealed wallets linked to Russian disinformation, as well as cash desks where USDT was cashed out in Moldova as part of the Russian influence campaign, Sanders said.

Officials are still reluctant to discuss some of the specifics around individuals and companies involved for fear of Russian retaliation. Anonymity was also granted to official sources due to the sensitivity of the matter.

This article is the third instalment in a series with our partners Context.ro covering Ilan Shor’s new role as the Kremlin’s pointman on Moldova – as leader of a new political organisation, Victory Block – and the inner workings of his billion-dollar stablecoin operation, A7A5. This article is also being published in partnership with FACT and Rise.md.

Context.ro and reporter.london revealed in December that Shor’s A7 had advertised the use of a Hungarian company as a payment agent. The Hungarian company has since closed.

INSIDE A7’s ELECTORAL UNIT

According to leaked files from Shor’s IT division, seen by reporters, Shor appears to have built a fully-fledged organisation in Moscow to interfere in the Moldovan elections ahead of the September 2025 ballot. 

That effort spanned an online recruitment and data collection service for Shor-linked “activists” and “sympathisers” in Moldova, a propaganda TV channel targeting Moldovan viewers with pro-Russian messaging, and payments for hundreds of Shor affiliates in the country, according to the documents. 

This was combined with a large-scale social media operation targeting Moldovan users, according to research by Alliance4Europe, a counter-disinformation organisation based in Germany.

“Shor set up entire operations of paid operators who worked to systematically republish content from Shor and the Victory Block onto a wide set of other social media platforms through covert social media pages,” Saman Nazari, lead researcher at Alliance4Europe, told reporter.london.

“We managed to track these [operators] by detecting a Telegram bot that Shor promoted […] for registering for paid demonstrations,” Nazari continued. “By tracking the spread of this content, we could identify inauthentic networks that were systematically working to amplify him.”

Although Shor’s election interference campaign was ultimately unsuccessful, leaked data shows a technically sophisticated coordination system – which was run on the same IT infrastructure as his A7A5 stablecoin. 

For example, in order to register as “volunteers” for Shor’s Victory Bloc organisation – which was actively organising events in the run-up to the election – Moldovan citizens had to upload photographs of official identity documents to a Telegram-based “KYC bot”, according to leaked materials.  

This bot then linked to a communication app called Taito, and allowed coordinators back in Moscow to review their influence networks in real time on an online map of the country. Distinct territorial units – villages and towns – were “overseen” by activists, who reported the names and phone numbers of local sympathisers to Moscow. 

Moldovan law enforcement warned the public in August 2025 that Russia was organising new methods of vote-buying in the country via Taito, after investigating several individuals who had allegedly received payments from Shor via the sanctioned Russian Promsvyazbank (PSB). The bank is Shor’s main partner in the shareholding of A7.

Indeed, the leaks contain granular details – monthly payment amounts, tax numbers, transfer methods and bank accounts – about Moldovan citizens who reportedly received bank transfers from Shor’s organisation as part of his campaign to bring Moldova back under Kremlin control. One payment file in the leak shows, for example, nearly 140 names of Moldovan citizens with sums of money attached.

Moldovan citizens who participated in the Kremlin’s propaganda effort – by writing posts in line with Russian messaging on Facebook and TikTok – also received payment via USDT, according to an undercover investigation by Moldovan investigative outlet Ziaurul de Garda. 

In September 2025, Moldova’s National Anti-Corruption Centre detained 15 people allegedly connected to the Shor network as part of a criminal investigation into election financing offences, which included the use of USDT to “disguise the illicit origin of the money”. 

Victory Bloc, the pro-Russian political organisation backed by Shor, has claimed that the leaked data made available online in September 2025 was false. “Fabricated conversations have appeared on the Internet, which are presented as communications from the bloc’s team,” it said at the time. 

Our publishing partners Rise Moldova uncovered the money flow that fuelled the A7-Shor scheme. Shor was the one who would task his accountant to send the funds. The accountant would transfer the crypto to local operators, who would convert it into euros and dollars, then into the local currency. Rise.md identified that the next step would be for the funds to reach a former member of parliament and a former customs official, and then trickle down to a larger group tasked with electoral interference and corruption.  

JUST THE START?

The UK Parliament’s Foreign Affairs Committee held an official meeting with the Moldovan President a month after the election. “President Maia Sandu emphasized the importance of the close cooperation with the United Kingdom in such areas as cybersecurity, combating disinformation and illicit financing,” the press release stated.

Emily Thornberry MP, chair of the Foreign Affairs committee, who met with President Sandu, raised the issue of state-backed disinformation in Parliament earlier this year, warning that “if it happened in Moldova, it can happen in the UK.” 

Speaking at a media conference in London on March 6, Thornberry acknowledged that the UK had worked closely with the Moldovan government to combat disinformation ahead of the 2025 election, noting she “can’t repeat” the details.

Thornberry and representatives for the Foreign Affairs Committee did not reply to requests to comment.

“We don’t comment on claims related to individual cases,” the UK’s Foreign, Commonwealth and Development Office said in reply to a request for comment, which was echoed by the UK Embassy in Moldova. 

“The UK works closely with Moldovan authorities to strengthen democratic resilience, the rule of law, and the ability of institutions to counter corruption and illicit finance,” the spokesperson for the Foreign, Commonwealth and Development Office added. 

”The UK’s support focuses on building capacity, improving legal and institutional frameworks, and supporting international cooperation to address complex financial crime, including in the digital and cryptocurrency space.”

Russia’s lost crypto campaign to block Moldova’s democracy “could also offer a model for today,” said experts at the European Council on Foreign Relations, a Brussels think tank, in a paper from March 2026, suggesting the lessons learnt by the Kremlin in this episode are likely to be applied in other countries. Among the recommendations of the paper, co-authored by ex-Moldovan foreign minister Nicu Popescu, was for law enforcement in countries targeted by Russian election operations to conduct highly visible campaigns against actors “involved in illicit finance, vote-buying or crypto-based payment schemes.”

“Europe should aim to progressively introduce grit into the system through measures such as tax probes and state-sanctioned cyber operations against crypto wallets and other infrastructure used to fund disruptive actions,” the paper said.

The UK official who spoke on condition of anonymity warned: “Looks like [the] Kremlin is going to keep using crypto as a means to fund election interference overseas – Moldova will not be the end of the story.”

Thomas Rowley is a journalist and editor specialising in Eastern Europe, Central Asia and South Caucasus. His work has appeared in outlets such as the International Consortium of Investigative Journalists, Byline Times, Moscow Times and Private Eye. Between 2015 and 2024, he was lead editor for the post-Soviet space at openDemocracy. He can be contacted on LinkedIn here.

Marcela Zamosteanu is an investigative journalist with Rise.md.

Thanks, as usual, to B.M. who cast an editor’s eye on this article before publication.