What happened to A7A5 after the collapse of Grinex: figures, structure, compliance?

After the hack of Grinex, two opposing versions formed around A7A5. According to the first, it is a large, actively working instrument for circumventing Russian sanctions. According to the second, sanctions have effectively destroyed the project. However, blockchain data confirms neither of these versions.

What is the ruble-pegged stablecoin A7A5 and who is behind it?

A7A5 is a stablecoin whose value is pegged to the Russian ruble. The first tokens were issued in December 2024, and in February 2025 A7A5 appeared on the Ethereum and Tron networks. The issuer is Old Vector, a company registered in Kyrgyzstan, whose co-owners are the Moldovan-Russian oligarch Ilan Shor and the Russian state-owned Promsvyazbank (PSB).

The mechanics of A7A5 follow the principle of ordinary fiat-backed stablecoins: one A7A5 token corresponds to one ruble that must be held in a bank account in Kyrgyzstan. However, just a few months after launch, the token itself and the structures associated with it came under sanctions from the US, the UK and the European Union.

It was precisely the set of individuals connected to the project that made A7A5 especially notable.

• Ilan Shor was convicted of fraud in absentia by Moldova's Court of Appeal in April 2023. He is widely linked to the disappearance of around $1 billion from a Moldovan bank he ran in 2014. He is also considered a person who acted as an intermediary between the Russian authorities and various structures.
• Petr Fradkov, CEO of the Russian state-owned PSB, which serves the Russian defense and military sector, is connected to holding A7A5's ruble reserves. He is also linked to the leadership of Russian intelligence.
• Oleg Ogienko publicly represents the project, emphasizing the company's registration in Kyrgyzstan as proof of its non-Russian legal nature, and also promoting a claimed yield of 13%.
• Leonid Shumakov, who came under EU sanctions in July 2026, is the officially listed director of the A7A5 project. Through him, a link can be traced between Old Vector, Grinex and PSB.
• Finally, Sergey Mendeleev, under OFAC sanctions since August 2025, connects A7A5 with Garantex and Grinex.

Then came the collapse of Grinex — one of the few venues where A7A5 could be converted back into rubles at all. In mid-April 2026, Grinex was hacked for around $14M and ceased operations. A7A5's activity went down almost immediately.

What does the concentration of A7A5's supply show after the collapse of Grinex?

A7A5's market cap still stands at around $470M. It is largely this figure that publications claiming the asset is «still strong» rely on. However, in this case it is the least informative figure of all available.

When specialists analyzed where the token's supply actually is on the blockchain, the picture turned out to be completely different.

The 29,715 addresses that hold A7A5 and whose number regularly appears in publications control roughly the remaining one percent of the supply. This mostly involves small balances, so-called «dust». The current main wallet was created on May 18, a few weeks after Grinex stopped, by the same operators who controlled the previous balances. Funds were transferred there and have barely moved since.

The net volume of transfers in April fell by roughly half and has remained significantly below previous values every month since. The token's supply itself has been preserved. But its movement has practically stopped.

Is A7A5's trading volume real or is it wash trading?

If you look only at A7A5's gross operation volume over the past three months, you can find several billion dollars. This is the figure most likely to be cited as evidence of the token's activity. However, analysis showed that a significant part of this volume is the constant movement of funds between the same operator addresses.

After excluding such movements, it turns out that roughly 19 cents of every dollar corresponds to activity that at least resembles genuine user operations.

The trading data shows the same thing. Throughout A7A5's entire history, trading was almost entirely reduced to operations with wrapped A7A5 against USDT. At the same time, at least $14.7M of this volume is wash trading — fictitious trades in which the same addresses repeatedly trade with each other within the same blocks. One address accounts for 46% of the entire historical trading volume, and seven addresses for more than 80%.

The remaining activity turns out to be small and quite specific. About half of the current transfer volume is cyclical movement of funds between operator nodes. At the same time, roughly 250 addresses over the past 30 days show behavior consistent with real users. Their median transfer size is $12,000. This means roughly $6M in real flows per month — only about 1.3% of the token's total supply.

Trading volume on decentralized exchanges is less than $1M per month and continues to decline. At the same time, a small group of users continues to trade A7A5 throughout the entire period, not having stopped their activity after the April events. They convert A7A5 into USDT and then transfer the resulting funds to centralized exchanges for withdrawal.

A7A5 also generates income through a yield-accrual mechanism, so holding most of the supply creates almost no additional cost for the operators. Thus, this is not a fully functioning market, but also not a completely frozen asset.

Where are A7A5's users actually located — in Moscow or East Asia?

To determine the geography of activity, one can use not only address information but also the time transactions are made. This approach makes it possible to analyze the daily rhythm of operations of addresses that resemble people in their behavior, and to determine the corresponding UTC time zone, without trying to directly identify a specific country.

When this method is applied to A7A5's entire history, the activity groups clearly concentrate around the Moscow time zone.

A visual analysis of human activity on the blockchain does not confirm the claim that A7A5 is used as a cross-border payment system for trade in East Asia. At the same time, such an analysis in itself does not make it possible to fully rule out the presence of A7A5 users in East Asia.

In addition, the declared transaction volumes differ significantly from what the blockchain shows. Against the backdrop of a declared turnover of $190 billion and PSB's August 10 claim of $140 billion in turnover, the available data does not confirm such a scale. The analysis also shows no signs that the token is used for settlements for oil, drone components or other sanctioned goods. The data does not indicate a significant user base in East Asia and does not demonstrate a substantial presence in the BRICS countries.

At the same time, regional concentration in itself is not an alarming sign. For example, the cNGN stablecoin in Nigeria and stablecoins backed by the Brazilian real should, by definition, be used predominantly in the corresponding regions. The problem arises when an asset's declared purpose implies broad international use, while the actual temporal profile of activity shows a completely different picture.

Why does changing wallets break static sanctions control?

An important starting point is that a token does not become illegal simply because it exists. To assess A7A5, one must take into account everything surrounding the asset: who issued it, who owns it, and how its ownership structure has changed.

Sanctioning the product itself, rather than a person, organization or jurisdiction, has virtually no full historical precedent. From this follows an important conclusion: products and services require the same attention as KYC procedures, KYB and enhanced due diligence (EDD).

Screening already-known sanctioned addresses is a mandatory basic requirement, but in itself does not constitute full control. After sanctions are imposed, an operator can withdraw funds from identified wallets, create new addresses for collecting and distributing funds, change counterparties, move to another blockchain network, or form a new conversion route.

New wallets may have no negative history. But the absence of history does not yet mean that a new wallet is not connected to a former operator.

Therefore, attention must be paid to the continuity between old and new infrastructure. Such signs include funding new wallets from previously identified addresses, coordinated wallet creation, rapid withdrawal of funds, the use of common sources for paying blockchain fees, and identical transaction timing.

None of these signs on its own proves common ownership or control. But a combination of several signs can provide sufficient grounds to assume that infrastructure was migrated rather than disappeared.

Thus, the unit of risk is not an individual address.

How does sanctions vulnerability persist at the conversion level?

Sanctions vulnerability can be divided into four categories, each requiring a separate approach.

• The first is direct ownership of A7A5 or its direct conversion.
• The second is direct conversion, in which USDT arrives immediately after the exchange.
• The third is a cluster link, when a new wallet shows a behavioral connection with previously identified infrastructure.
• The fourth is an indirect link through intermediaries.

These situations do not necessarily have the same legal significance. Therefore, the response to them must be proportionate to the level of risk and take into account the legislation of the specific jurisdiction.

In a practical example, the movement of funds looks as follows: A7A5 is on a wallet not controlled by the user, then it is converted into USDT through a decentralized exchange, sent to a card account, turned into fiat currency, after which the money is spent at a merchant or withdrawn from an ATM.

Each participant in this chain sees only a separate fragment. For the merchant, it is an ordinary bank-card payment. For the acquirer, a standard fiat settlement. For the card program, an incoming USDT. None of them may even know that the USDT was obtained directly as a result of converting A7A5.

The very fact of conversion changes the asset but does not change its origin. A decentralized exchange is not in itself a suspicious instrument, but when it is used there is no intermediary that would carry out customer due diligence. Therefore, financial organizations have to reconstruct the entire chain themselves: which token came in, through which liquidity pool and router the exchange passed, which token was received at the output, and to which address it was then sent.

Does the inactivity of a sanctioned cluster mean its activity has been successfully stopped?

One of the key differences between the crypto sphere and traditional finance lies in what inactivity means.

In the traditional financial sector, a company that has come under sanctions, as a rule, cannot simply continue to exist in its previous form. In the crypto sphere, an inactive cluster may mean only a temporary pause.

An operator that has stopped using its old infrastructure can preserve the funds, create new wallets, test new conversion routes, move to another blockchain network, and prepare to return through intermediaries, OTC services or payment cards.

Therefore, monitoring must switch from already-known addresses to signs of migration. Newly funded wallets, replacement token contracts, shared counterparties and new liquidity pools should become grounds for enhanced verification, not grounds for closing the case.

Obligations at the issuer level also matter. For example, stablecoin issuers in the EU have required a MiCA license since the end of June 2024.

If a DEX removes a token from its interface, do wrapped tokens still need to be checked?

Another problem arises, especially relevant after the recent FATF study on decentralized exchanges and DeFi.

A permissionless DEX allows anyone to list almost any token. Therefore, a specific platform's interface may remove a token from the list of available assets, while the underlying protocol itself continues to enable trading in that token.

In the case of A7A5, its wrapped variant — wrapped A7A5 — was traded. This was a different contract address and effectively a different asset identifier. A company that checked only A7A5 itself could completely miss operations with its wrapped version.

A7A5 in this respect is a relatively simple example. It is publicly denominated in rubles, publicly linked to Russian structures, and surrounded by well-known figures. Much more complex will be cases in which there are no such obvious signs.

That is exactly why detecting such schemes requires working at the conversion level, not only at the level of the token itself.

At the same time, A7A5 ultimately failed to realize its own original concept. The project was created as the opposite of private dollar-backed stablecoins, but ended up dependent on one of those very instruments.