Moldovan authorities denounce electoral interference in cryptocurrencies
Moldova’s National Anti-Corruption Center said it had uncovered what appears to be a major cryptocurrency scheme aimed at influencing the country’s upcoming parliamentary elections in 2025. According to the agency’s director, Alexandr Pinzari, it was an operation to illegally finance political parties with the specific aim of influencing election results in favor of certain candidates.
The project operated through a somewhat complex process. The virtual assets were transferred to an intermediary in Moldova, who then converted them into cash through its network. From there, the funds were distributed to local activists. Pinzari said the money was ultimately used to pay people promoting certain candidates, bribe voters for support and even mobilize participants in rallies or protests.
The scale of the operation
What is striking about this case is the considerable amount of money involved. The CNA identified what it called a “complex transaction pattern” using non-custodial cryptocurrency wallets. One particular wallet saw transfers exceeding $107 million in the stablecoin USDT between 2023 and 2025. In 2025 alone, $43 million was transferred through this single wallet.
The origin of these funds, according to investigators, dates back to two centralized crypto platforms in Russia and Kyrgyzstan. Pinzari noted that the criminal network created its own virtual currency, which was then converted through exchanges to USDT to facilitate integration into the Moldovan economic system.
International connections and sanctions
Wallets and accounts linked to this system have apparently been subject to international sanctions. The funding came from transfers from accounts opened in the names of citizens of several countries, including Turkey, Israel, Kyrgyzstan, Russia, Azerbaijan and Moldova.
Blockchain analytics firm TRM Labs has linked this campaign to what it describes as a “Russian-backed foreign influence operation, InfoLider.” With the help of a Moldovan investigative journalist who received cryptocurrency payments as part of an undercover report, TRM Labs identified TokenSpot, the Kyrgyz cryptocurrency exchange linked to Russia, as the likely source of a transaction.
Chris Keegan, senior blockchain intelligence analyst at TRM Labs, told Decrypt that while they observed several similar transactions sent to an Asia-based exchange around the same time, the funds sent to the Moldovan journalist most likely came from TokenSpot. This conclusion stems from TokenSpot’s close association with A7 and the Russian government.
A broader sanctions evasion ecosystem
TRM Labs has already identified TokenSpot as a likely front company for sanctioned Russian crypto exchange Garantex. Keegan pointed to similar transaction patterns and other on-chain features as evidence. He added that TokenSpot connects to a broader Russian sanctions evasion ecosystem that includes Garantex, the sanctioned Kyrgyz exchange Grinex and the ruble-backed stablecoin A7A5.
“Garantex-related entities, including TokenSpot, have been heavily integrated into the broader Kremlin-backed sanctions evasion environment,” Keegan said. Based on shareholder information and leaks from late last year, Garantex and A7 appear to be “likely Kremlin-run projects.”
The TokenSpot website shows that legal entities must complete a verification form to unlock the full functionality of the platform. This form requires disclosure of customer identification processes, customer due diligence measures and information on sanctions applied against the entity. Sole traders must upload government-issued identification documents.
TRM Labs reports that illicit entities received approximately $141 billion through stablecoin wallets in 2025, with the A7A5 token accounting for $72 billion of that total. Last month, the European Commission reportedly considered a bloc-wide ban on all crypto transactions with Russian counterparties in an effort to combat sanctions evasion.
I think this case highlights how cryptocurrency can be used for political interference. The scale is worrying, but what is perhaps more disturbing is the apparent sophistication of the project. The use of non-custodial wallets, the creation of personalized virtual currencies, and the exploitation of international exchanges demonstrate a level of planning that goes beyond simple money laundering.
Moldovan authorities did not provide additional comment, nor did TokenSpot respond to requests for comment. But this investigation appears to be ongoing, and I think we’ll hear more about it as the 2025 election approaches.
