Moldova’s Anticorruption Center Alleges $107M Crypto Scheme to Influence Elections

Moldova’s National Anti-Corruption Center has uncovered a scheme to influence the country’s 2025 parliamentary elections that used crypto to funnel funds to activists and bribe voters.

According to CNA director Alexandr Pinzari, quoted in local media, the scheme involved the “illegal financing of certain political parties, with the aim of influencing the election results in favor of certain electoral candidates.”

The scheme involved the transfer of virtual assets to an intermediary in Moldova, who converted them into cash through its network, before the funds were distributed to local activists, Pinzari explained. “Ultimately, the funds were used to pay people involved in promoting the image of certain candidates in elections, to bribe voters to gain support for a particular candidate, as well as to mobilize participants in rallies or demonstrations. »

The CNA claimed to have identified a “complex transaction pattern” leveraging non-custodial cryptocurrency. wallets. A portfolio selected under the program generated transfers of more than $107 million in the stable coin USDT between 2023 and 2025, with $43 million transferred in 2025 alone.

According to CNA, the origin of the funds in the wallets could be traced back to two centralized crypto platforms in Russia and Kyrgyzstan. “It was established that the criminal network created its own virtual currency,” Pinzari said, emphasizing that funds were converted through exchanges into USDT to facilitate “the integration of funds into the economic circuit of Moldova.”

Pinzari added that wallets and accounts linked to the system were subsequently subject to international sanctions and were funded by transfers from accounts opened in the names of citizens of Turkey, Israel, Kyrgyzstan, Russia, Azerbaijan and Moldova.

Talk to Decryptblockchain analytics firm TRM Labs linked the campaign to the “Russian-backed foreign influence operation InfoLider.”

With the help of an investigative journalist from the independent Moldovan newspaper Ziarul of Gardawho received two payments in cryptocurrency As part of their involvement in the undercover report, TRM Labs was able to identify TokenSpot, the Kyrgyz crypto exchange linked to Russia, as the likely source of one of the transactions involved.

“While TRM observed several other transactions of a similar amount sent around the same time to an Asia-based exchange, the exchange used to send the funds to the Moldovan journalist, it seems more likely that it came from TokenSpot, given its close association with A7 and the Russian government,” said Chris Keegan, Senior Blockchain Intelligence Analyst at TRM Labs. Decrypt. He added that the company was unable to locate the source of the second payment linked to the undercover reporter.

TRM Labs previously identified TokenSpot as a likely front company for sanctioned Russian crypto exchange Garantex, thanks to “a similar TRX sharing model, among other on-chain features,” Keegan said. He added that TokenSpot is connected to a “broader Russian sanctions evasion ecosystem” that includes Garantex, the sanctioned Kyrgyz exchange Grinex and the ruble-backed stablecoin A7A5.

“Entities linked to Garantex, including TokenSpot, have been heavily integrated into a broader environment of sanctions evasion supported by the Kremlin,” Keegan said. Decryptadding that Garantex and A7 are both “likely Kremlin-run projects,” based on shareholder information and leaks from late last year.

According to the TokenSpot website, in order to “unlock the full functionality of the platform,” legal entities must verify themselves by completing a form that requires disclosure of “established processes for customer identification” and “established customer due diligence (CDD) measures.” The form also requires entities to disclose “information on the application of restrictive measures (sanctions) of any state/organization against the legal entity.” Individuals wishing to transact on the platform are required to complete an identity check involving uploading a government-issued ID.

Leaked documents reveal $8 billion crypto network behind Russian sanctions evasion

According to TRM Labs, illicit entities received some $141 billion through stablecoin wallets in 2025, with the A7A5 token accounting for $72 billion. Last month, the European Commission reportedly considered a bloc-wide ban on all crypto transactions with Russian counterparties, in an effort to combat sanctions evasion.

Decrypt has contacted CNA and TokenSpot for comment and will update this article if they respond.