Share via:
- Updated on: August 21, 2026
Parked, not gone: what the A7A5 stablecoin did after Grinex collapsed
In our latest webinar, we took A7A5 apart – not the narrative around it, but the on-chain record: where the supply sits, who moves it, whether the trading is real, and what a compliance team should do when a sanctioned asset stops behaving like a market.
Key Takeaways
A7A5’s $470M supply never left after Grinex collapsed – 99% consolidated into four wallets. Market capitalization alone says nothing about whether an asset is actually moving.
Gross volume is not circulation. Of the sliver of supply circulating, net out the operator churn and wash trading and roughly 19 cents in every A7A5 dollar represents genuine, human-scale activity.
Screening known addresses is a baseline, not a control. Operators rotate infrastructure after designation, and wrapped tokens trade under contract addresses that your list never covered.
Exposure survives in the funding chain, not the payment record. Dormancy is where monitoring should change shape – from known addresses to emerging migration patterns.
The session was led by Nick Smart, Chief Intelligence Officer at Crystal, joined by Hannah Curtis, who leads our stablecoin market intelligence product Crystal Foresight, and Irina Gorbach, our Compliance Advisory Manager.
Several revealing audience polls were conducted during the discussion as well:
Poll #1
With almost two-thirds of the room being acutely invested in the subject and not a single journalist present, this was a practitioner audience drawn less by the A7A5 story than by the screening gap it quietly exposes. Source: Crystal Intelligence.
Two narratives have formed around A7A5 since Grinex went was hacked. One says it is a large, thriving instrument of Russian sanctions evasion. The other says sanctions killed it. The data support neither.
What is the A7A5 ruble-backed stablecoin, and who is behind it?
A7A5 is a ruble-pegged stablecoin. The first tokens were issued in December 2024, and it launched on Ethereum and Tron in February 2025. It is issued by Old Vector, a company registered in Kyrgyzstan, and co-owned by the Moldovan-Russian oligarch Ilan Shor and the Russian state defense bank PSB.
The design is that of any conventional fiat-backed stablecoin – one A7A5 token against one ruble deposit that is held in a Kyrgyz bank. Within months of launch, the token and the entities around it were under designation in the US, the UK and the EU.
Listen to Nick’s dissection of A7A5 here.
The cast is what made A7A5 stand out:
Ilan Shor, convicted of fraud in absentia by the Moldovan Appellate Court in April, 2023, is widely associated with the disappearance of roughly a billion dollars from a Moldovan bank he managed in 2014 and believed to have acted as a Kremlin intermediary.
Petr Fradkov, CEO of Russian state-owned PSB bank, which supports Russia’s defense and military sectors, holds the ruble reserves, is connected to Russian intelligence leadership.
Oleg Ogienko publicly fronts the project, pitching Kyrgyz registration as evidence of non-Russian legitimacy alongside a 13% yield.
Leonid Shumakov, sanctioned by the EU in July 2026, is the named A7A5 project director, linking Old Vector, Grinex, and PSB, and, finally,
Sergey Mendeleev, sanctioned by OFAC since August 2025, ties it to Garantex and Grinex.
Let Nick introduce you to the full cast of characters here.
Then Grinex – one of only a handful of venues where A7A5 could be redeemed into rubles at all – was hacked for roughly $14M and suspended operations in mid-April 2026. Activity fell away almost immediately.
Above: Infographic tracing Grinex’s ~$14M hack via Crystal Expert’s flow chart, mapping stolen funds through wallets, swaps, and bridges alongside eight sanctions actions across six jurisdictions. Source: Crystal Expert.
What does A7A5’s supply concentration show after Grinex collapsed?
A7A5 still carries a market capitalization of around $470M. It is the basis for most of the “still strong” reporting, and the least informative number available.
When Hannah looked at where the on-chain supply actually sits, the picture changed. 94.5% of the Tron supply – and most of the total is on Tron, with a smaller share on Ethereum – is held in a single operator wallet. Just over 99% of the total supply is held in four wallets: the operator wallets and the wallet belonging to the Grinex hacker.
The 29,715 addresses that hold the token, a number that appears regularly in reporting, account for roughly the remaining one percent, mostly dust. The current vault was created on May 18, weeks after Grinex halted, by the same operators who held the previous balances. The funds were swept in and have sat there since.
Net transfer volumes were cut by about half in April and have been far lower in every month since. The supply is intact. The movement is not.
Is A7A5’s trading volume real, or is it wash trading?
Look only at gross on-chain volume over the last three months, and you will find a few billion dollars – the number most likely to be quoted back at you. So the team tested whether it was real. It is churn: the same operator addresses the moving of funds back and forth between accounts. Net out the churn, and roughly 19 cents in every dollar represents anything resembling genuine human activity.
The trading data says the same thing. Across A7A5’s history, trading was almost entirely wrapped A7A5 against USDT, and at least $14.7M of that is wash trading – the same addresses trading against each other within the same blocks, thousands of times over. One address accounts for 46% of lifetime trading volume, while seven account for more than 80%.
What remains is small and specific. About half of the current transfer volume is operator hub-to-hub cycling, and around 250 addresses in the last 30 days look human in scale, with a median transfer of $12,000 – roughly $6M a month in genuine flows, or 1.3% of total supply. DEX volume is under $1M a month and still dropping. A small group of users has traded throughout, unaffected by April, converting A7A5 into USDT and moving on to centralized exchanges to cash out.
A7A5 is also yield-bearing, so parking the supply incurs no cost to the operators. Not a real market, then, but not a frozen asset either.
Where are A7A5’s users actually located, Moscow or East Asia?
Crystal is rolling out a new line of analysis that reads the clock rhythm of on-chain activity, mapping when human-scale addresses transact to infer a UTC offset rather than a country. Applied across A7A5’s history, the activity groups clearly fall around the Moscow time zone.
Above: A visual depiction of where human online activity takes place, measured against the world clock, does not support the claim that A7A5 functions as a cross-border payment system for East Asian trade. However, this doesn’t rule out the possibility that A7 overall lacks an East Asian user base. Source: Crystal Foresight.
Nick added that, against claimed transaction volumes of $190B – and PSB’s claim on August 10 of $140B in turnover – the data does not support the story, and nothing in it suggests the token is settling oil, drone components, or any other trade in sanctioned goods. The data show no East Asian user base and do not meaningfully reach the BRICS countries either.
Hannah noted that regional concentration is not itself a red flag – CNGN in Nigeria and real-backed stablecoins in Brazil are meant to circulate in their own regions. It becomes a finding when the stated purpose is broad reach, and the clock says otherwise.
Poll #2
A clear majority already suspected dormancy rather than death before the data arrived, and the 41% who could not say are being honest: without supply and conversion analysis, dormancy and disruption look identical from outside. Source: Crystal Intelligence.
Listen to and watch Hannah’s insightful, data-driven presentation on what the data tells us as opposed to the headlines here.
Why does wallet rotation defeat static crypto sanctions screening?
Irina’s starting point was that no token is illegal by virtue of existing. What makes A7A5 assessable is everything around it: who issued it, who owns it and what its ownership history is. A product being sanctioned – rather than a person, an entity or a jurisdiction – has effectively no precedent, and the implication is direct: products and services need the same scrutiny as know-your-customer (KYC), know-your-business (KYB) and enhanced due diligence (EDD).
Screening known sanctioned addresses is a baseline requirement, not a control in itself. After designation, an operator can empty identified wallets, create new collection and distribution addresses, change counterparties, move to another chain, and establish a new conversion route. New wallets have no adverse history, but an empty history does not demonstrate independence.
What teams should look for is continuity between old and new infrastructure: funding from previously attributed wallets, coordinated wallet creation, rapid balance sweeps, common gas funding sources and identical transaction timing.
No single indicator proves common control, but together they can provide reasonable grounds to conclude that the infrastructure has migrated rather than disappeared. The unit of risk is not the address – it is the designated entity, ownership and control, the cluster, and the service and its counterparties.
How does sanctions exposure survive at the conversion layer?
Irina separated exposure into four classes that require different handling:
Direct holding or conversion of A7A5;
Immediate conversion, where USDT arrives straight out of a swap;
Cluster, where a new wallet is behaviorally connected to identified infrastructure; and
Indirectly, through intermediaries.
They are not automatically legally equivalent, so the response should be proportionate and jurisdiction-specific.
Her worked example follows the value all the way through:
A7A5 in an unhosted wallet, converted to USDT through a DEX, sent to a card account, converted to fiat, spent at a merchant or withdrawn at an ATM.
Each participant sees one fragment: the merchant an ordinary card payment, the acquirer a fiat settlement, the card program a USDT deposit, and none of them knows that the USDT came straight out of an A7A5 conversion.
Conversion changes the asset, not its provenance. A DEX is not inherently suspicious, but it removes the intermediary doing customer due diligence (CDD), so institutions must reconstruct the leg themselves: token in, liquidity pool and router, token out, destination wallet.
Above: Infographic showing how sanctioned wallet exposure (A7A5) disappears across the funding chain – wallet, DEX swap, USDT, card, fiat – leaving issuers and merchants blind unless full-chain screening occurs. Source: Crystal Intelligence.
Is a dormant sanctioned cluster the same as successful disruption?
The largest departure from traditional finance is what dormancy means. A company sanctioned in TradFi generally cannot continue to exist. In crypto, a dormant cluster may simply be a pause.
A dormant operator can park funds, create replacement wallets, test new conversion routes, move to another chain, and prepare to re-enter through intermediaries, OTC services or payment cards. Monitoring should shift from known addresses to migration patterns: newly funded wallets, replacement token contracts, common counterparties and new liquidity pools should trigger EDD, not a closed file. Issuer-level obligations matter too – EU stablecoin issuers have needed a MiCA license since the end of June 2024.
Poll #3
Only 27% could confirm they screen for this, while 55% could not say, so uncertainty rather than absence is the real gap here, and wrapped A7A5 is exactly the instrument that would slip through it. Source: Crystal Intelligence.
Listen to and watch Irina’s presentation on what is required to avoid this compliance blindspot here.
If a DEX delists a token, is screening for wrapped tokens still needed?
Nick raised a related problem, timely given the Financial Action Task Force’s (FATF) recent paper on DEXs and DeFi: a permissionless DEX lets anyone list anything, so a front end can delist a token and the back end will still trade it. In A7A5’s case, the traded instrument was wrapped A7A5, a different contract address under a different name – a firm screening only for A7A5 would have missed it entirely.
A7A5 is, as Nick put it, an easy case: publicly ruble-denominated, publicly Russian-associated, surrounded by notorious people. The harder cases carry none of those markers, and finding them means working at the conversion layer rather than at the token level. A7A5 also failed on its own terms, setting out to be the opposite of the private dollar-backed stablecoins and ending up dependent on one.
Frequently asked questions
If alerts on designated clusters go quiet, does it mean they’re gone?
Not necessarily, as the subject might’ve simply moved, since dormancy frequently precedes migration.
How do compliance teams know if a new wallet belongs to the same operator?
By looking for continuity: prior-wallet funding, coordinated creation, rapid sweeps, shared gas sources and identical timing. Several together could evidence migration.
If compliance teams screen for A7A5, are they covered?
Not necessarily. Wrapped A7A5 is a separate contract address under a different name. Coverage should span addresses, chains, and time.
Is remote historical exposure treated the same as a direct conversion?
No. Weigh proximity, timing, value, direction, ownership and economic purpose. Responses should be proportionate and jurisdiction-specific, not uniform.
Closing remarks
On permissionless DEXs, Hannah noted that a front-end can delist a token while the back-end keeps trading it. In A7A5’s case, the traded instrument was wrapped A7A5, a different contract address under a different name, so a firm screening only for A7A5 misses it. Stablecoins arrive in bundles, including yield-bearing and staked versions, and coverage has to span contract addresses, chains and time, since all three change.
Nick drew this back to Crystal’s data philosophy: a million new tokens can be minted tomorrow; what matters is the conversion layer, where A7A5 becomes USDT and USDT becomes something spendable. Decentralized venues lack a centralized exchange’s listing checks. That is not inherently wrong, but it leaves them exposed. The compliance officer of 2026 needs more than a narrow set of indicators: they need the whole ecosystem around a token.
Irina’s closing takeaway was that high-risk tokens are rarely identified by a single red flag. Assess who controls the asset, how concentrated the supply is, whether trading is genuine, what backs the reserve, and where value converts or cashes out. Dormancy is not disappearance.
‘Parked, not gone’ is aptly put: both halves are true, and the second one is the compliance problem.
Watch the full webinar here.
DISCLAIMER: The insights provided by the panelists, while informed by their professional expertise, reflect their personal views and don’t constitute formal legal advice.
CTA
A dormant cluster is not a closed case. See how Crystal traces supply concentration, wrapped tokens and conversion routes across chains, before parked value re-enters through new infrastructure. Book a call with our intelligence team to find out more.
