Moldovan authorities expose crypto election interference
Moldova’s National Anticorruption Center says it has uncovered what appears to be a significant cryptocurrency scheme aimed at influencing the country’s upcoming 2025 parliamentary elections. According to the agency’s director, Alexandr Pinzari, the operation involved illegal financing of political parties with the specific goal of swaying election results in favor of certain candidates.
The scheme worked through a somewhat complex process. Virtual assets were transferred to an intermediary in Moldova, who then converted them into cash through their network. From there, the funds were distributed to local activists. Pinzari explained that the money was ultimately used to pay people promoting certain candidates, bribe voters to secure support, and even mobilize participants for rallies or protests.
The scale of the operation
What’s striking about this case is the sheer amount of money involved. The CNA identified what they called a “complex transaction scheme” using non-custodial cryptocurrency wallets. One particular wallet saw transfers exceeding $107 million in the stablecoin USDT between 2023 and 2025. Just in 2025 alone, $43 million moved through that single wallet.
The origin of these funds, according to investigators, traces back to two centralized crypto platforms in Russia and Kyrgyzstan. Pinzari noted that the crime ring created its own virtual currency, which was then converted through exchanges into USDT to facilitate integration into Moldova’s economic system.
International connections and sanctions
Wallets and accounts linked to this scheme have apparently been subjected to international sanctions. The funding came through transfers from accounts opened in the names of citizens from several countries including Turkey, Israel, Kyrgyzstan, Russia, Azerbaijan, and Moldova.
Blockchain analysis firm TRM Labs connected this campaign to what they describe as a “Russia-backed foreign influence operation InfoLider.” With help from a Moldovan investigative journalist who received cryptocurrency payments as part of an undercover report, TRM Labs identified Russia-linked Kyrgyzstani crypto exchange TokenSpot as the likely source of one transaction.
Chris Keegan, a senior blockchain intelligence analyst at TRM Labs, told Decrypt that while they observed several similar transactions sent to an Asia-based exchange around the same time, the funds sent to the Moldovan journalist most likely originated from TokenSpot. This conclusion came from TokenSpot’s close association with A7 and the Russian government.
Larger sanctions evasion ecosystem
TRM Labs has previously identified TokenSpot as a likely front company for the sanctioned Russian crypto exchange Garantex. Keegan pointed to similar transaction patterns and other on-chain features as evidence. He added that TokenSpot connects to a larger Russian sanctions evasion ecosystem that includes Garantex, the sanctioned Kyrgyzstani exchange Grinex, and the ruble-backed stablecoin A7A5.
“The Garantex-related entities, which include TokenSpot, have been heavily integrated into the larger Kremlin-backed sanctions evasion environment,” Keegan said. Based on shareholder information and leaks from late last year, both Garantex and A7 appear to be “likely Kremlin-run projects.”
TokenSpot’s website shows that legal entities must complete a verification form to unlock all platform features. This form requires disclosure of client identification processes, customer due diligence measures, and information about any sanctions applied against the entity. Individual traders must upload government-issued IDs.
TRM Labs reports that illicit entities received about $141 billion via stablecoin wallets in 2025, with the A7A5 token accounting for $72 billion of that total. Last month, the European Commission reportedly considered a bloc-wide ban on all crypto transactions with Russian counterparties to clamp down on sanctions evasion.
I think this case highlights how cryptocurrency can be used in political interference operations. The scale is concerning, but perhaps what’s more troubling is the apparent sophistication of the scheme. Using non-custodial wallets, creating custom virtual currencies, and leveraging international exchanges shows a level of planning that goes beyond simple money laundering.
The Moldovan authorities haven’t commented further, and TokenSpot hasn’t responded to requests for comment either. But this investigation seems to be ongoing, and I suspect we’ll hear more about it as the 2025 elections approach.
