In brief
- Moldova's National Anticorruption Center has identified an election-influence scheme that saw some $107 million used to promote candidates and bribe voters.
- The "complex transaction scheme" could be traced back to two centralized crypto platforms in Russia and Kyrgyzstan, the CNA said.
- Blockchain analysis firm TRM Labs identified Kyrgyzstani crypto exchange TokenSpot as being connected to a "larger Russian sanctions evasion ecosystem."
Moldova’s National Anticorruption Center has uncovered a scheme to influence the country’s 2025 parliamentary elections that used crypto to channel funds to activists and bribe voters.
According to CNA director Alexandr Pinzari, cited in local media reports, the scheme involved the “illegal financing of certain political parties, with the aim of influencing the elections’ results in favor of specific electoral contenders.”
The scheme involved the transfer of virtual assets to an intermediary in Moldova, who converted them into cash through their network, before the funds were distributed to local activists, Pinzari said. “Ultimately, the funds were used to remunerate people involved in promoting the image of certain electoral contenders, to bribe voters in order to secure support for a particular candidate, as well as to mobilize participants for rallies or protests.”
The CNA claimed to have identified a “complex transaction scheme” leveraging non-custodial cryptocurrency wallets. One wallet singled out as part of the scheme saw transfers of over $107 million in the stablecoin USDT between 2023 and 2025, with $43 million transferred in 2025 alone.
According to the CNA, the origin of the funds in the wallets could be traced back to two centralized crypto platforms in Russia and Kyrgyzstan. “It was established that the crime ring created its own virtual currency,” said Pinzari, noting that the funds were converted through the exchanges into USDT to facilitate “the integration of the funds into the economic circuit of Moldova.”
Pinzari added that wallets and accounts linked to the scheme were later subjected to international sanctions, and had been funded through transfers from accounts opened in the names of citizens of Turkey, Israel, Kyrgyzstan, Russia, Azerbaijan, and Moldova.
Speaking to Decrypt, blockchain analysis firm TRM Labs linked the campaign to “Russia-backed foreign influence operation InfoLider.”
With the help of an investigative journalist from Moldovan independent newspaper Ziarul de Gardă, who received two payments in cryptocurrency as part of their involvement in the undercover report, TRM Labs was able to identify Russia-linked Kyrgyzstani crypto exchange TokenSpot as the likely source of one of the transactions involved.
“While TRM observed several other transactions of a similar amount sent around the same time to an Asia-based exchange, the exchange used to send the funds to the Moldovan journalist, it seems most likely to originate from TokenSpot, given its close association with A7 and the Russian government,” TRM Labs Senior Blockchain intelligence Analyst Chris Keegan told Decrypt. He added that the firm was unable to locate the source of the second payment linked to the undercover journalist.
TRM Labs has previously identified TokenSpot as a likely front company for the sanctioned Russian crypto exchange Garantex, through “a similar TRX-sharing pattern, among other on-chain features,” Keegan said. He added that TokenSpot is connected to a “larger Russian sanctions evasion ecosystem” that includes Garantex, the sanctioned Kyrgyzstani exchange Grinex and the ruble-backed stablecoin A7A5.
“The Garantex-related entities, which include TokenSpot, have been heavily integrated into the larger Kremlin-backed sanctions evasion environment,” Keegan told Decrypt, adding that Garantex and A7 are both “likely Kremlin-run projects,” based on shareholder information and leaks late last year.
According to TokenSpot's website, in order to "unlock all of the platform's features" legal entities must verify themselves through completing a form that requires disclosure of "established processes for identifying clients" and "established customer due diligence (CDD) measures." The form also requires entities to disclose "Information on the application of restrictive measures (sanctions) of any state/organization against the legal entity." Individuals wishing to trade on the platform are required to conduct an identity check involving uploading a government-issued ID.
According to TRM Labs, illicit entities received some $141 billion via stablecoin wallets in 2025, with the A7A5 token accounting for $72 billion. Last month, the European Commission reportedly mulled a bloc-wide ban on all crypto transactions with Russian counterparties, in order to clamp down on sanctions evasion.
Decrypt has reached out to the CNA and TokenSpot for comment and will update this article should they respond.