One wallet now holds 94.5% of A7A5’s supply

Russia’s sanctions-proof ruble stablecoin lost its only trading venue in April. On-chain, the supply didn’t flee or redeem; it was swept into a single wallet and parked. What’s left looks less like a currency than an operator waiting. 

A7A5 was built to be the stablecoin sanctions couldn’t touch. It is pegged to the Russian ruble, issued in January 2025 from Kyrgyzstan by a company called Old Vector, acting on behalf of the Russian cross-border settlement firm A7 LLC. US authorities say A7 LLC is co-owned by Moldovan-Russian businessman Ilan Shor and backed by reserves at the sanctioned Russian state bank Promsvyazbank. It ships without a freeze function, so no issuer, regulator, or network can claw back a wallet. For most of a year, it was the settlement token of Grinex, the exchange that rose from the ashes of the sanctioned Garantex. The US, UK, and EU have sanctioned the network in overlapping waves since March 2025, without, until this spring, forcing a halt. 

Then, on April 16, 2026, Grinex reported a security breach, with roughly $13M to $15M in customer assets reported stolen, and halted operations. A7A5’s trading volumes collapsed with the exchange. A fresh round of sanctions followed within the week, a heavier blow than the network had faced at any single point since March 2025. On the surface, this looks like the moment enforcement finally worked. 

But a stablecoin is supply, not just volume, and the supply tells a different story. We resolved A7A5’s on-chain footprint across both chains it uses, Tron, where the supply sits, and Ethereum, where it trades, and traced what happened to the money after the exchange went dark. The token did not unwind. It consolidated: of the roughly $475M of A7A5 in existence, 94.5% of the Tron supply now sits in a single wallet that did not exist before the collapse, and the pattern of who controls it points to one operator holding its own float.  

Key findings 

• A7A5’s supply, about $475M across Tron and Ethereum, didn’t shrink after the collapse. It concentrated: 94.5% of the Tron supply now sits in one wallet created 18 days after the venue fell. 

• Position-changing transfer volume dropped from $65M a day to under $8M a day, a 97% fall from the March peak. Activity didn’t slow; it nearly stopped. 

• The top four addresses hold 99.2% of the Tron supply. Below them, roughly 29,700 addresses are almost all dust, most worth a few hundred dollars or less. There is no user base in the middle. 

• One of the four largest holders isn’t the operator’s at all. It’s the wallet tied to the April security breach (see below), holding about $4.4M that isn’t frozen (nothing on A7A5 can be) but has nowhere legitimate to go. 

• Its only public trading market, a single A7A5-to-USDT pair on a wrapped version of the token on Ethereum, is mostly wash trading (trading with itself to fake volume): one address alone accounts for ~46% of all volume. 

The reputation, and where it comes from 

Before reading the chain, it’s worth being precise about the numbers A7A5 carries, because the gap between them and the on-chain reality is the whole point. UK authorities and industry researchers have put A7A5’s cumulative on-chain volume above $100 billion, with one tracker counting the active holder base climbing from about 13,000 to 29,000 wallets between February 2025 and May 2026, a figure that squares with the roughly 29,700 addresses we resolve on-chain below. Independent analysts have separately flagged a steep decline in transaction volume since the start of 2026 and questioned how much of A7A5’s activity reflects genuine use rather than the issuer’s own operations. 

Our net-flow work below lands on the same side of that question and puts a number on exactly how narrow the real economic core is. 

Reading net flow, not headline volume

A7A5’s early reputation was built on volume. Headline transaction figures made it look like one of the busier ruble-denominated assets in crypto. But gross volume is the easiest number to inflate: send the same dollar back and forth and the total climbs while nothing actually moves. 

So we measure net flow instead: the position-changing movement left after the round-trips cancel out. It is a truer read of real economic activity, and it makes the collapse precise. Monthly net flow peaked at $2.37B in March and bottomed at $68M in June. The break falls exactly on the April shutdown, neither before nor after. A7A5’s economic life was Grinex; when Grinex stopped, so did the tokens. 

The 90 days before the halt averaged $65.2M/day of net flow; since, $7.8M/day, an 88% run-rate drop, bottoming ~97% below the March peak. Blue = pre-halt, red = post-halt. 

The same lens exposes how little of the remaining activity is real. In the three months since the collapse, A7A5 addresses received about $3.58B on a gross basis, but only $0.67B of that changed anyone’s net position. Even in its quiet phase, most of what looks like activity is noise. 

$0.67B of real, position-changing flow against $3.58B received gross: only ~19% of throughput moved anyone’s balance, the rest round-trips. 

The supply didn’t flee. It was gathered up. 

A dying token gets abandoned: holders redeem, balances scatter, supply shrinks. A7A5 did the opposite. Its supply held steady near $468M on Tron through the collapse, and rather than disperse, it converged into a single wallet that now holds 94.5% of it. 

 That wallet is new. It was created on May 4, 2026, eighteen days after Grinex went offline, with no history before then. It received its balance almost entirely from one counterparty, a high-throughput distribution wallet that has moved hundreds of millions across the network, and the wallets that fed it have since been emptied. The float wasn’t cashed out when the exchange fell. It was swept into a fresh wallet and parked.  

This isn’t the first time. After the US Treasury’s August 2025 action against Grinex-linked wallets, A7A5 reportedly destroyed and reissued more than 80% of its supply, using a smart-contract function reportedly named destroyBlackFunds that tagged the affected tokens as “dirtyShares” and pulled them from circulation before routing the funds through fresh wallets. What happened in May is the same behavior at larger scale and in slower motion: supply doesn’t leave, it gets re-gathered into new, history-free wallets. The operator has a rehearsed playbook for this. This is the second time it has run it. 

A single operator vault holds 94.5% of the ~$468M Tron supply; the top four addresses hold 99.2%. Everything else is a long dust tail. 

Whose wallets are these? 

The question isn’t whether this concentration is unusual. It clearly is. It’s whether it reflects an independent whale or a single hand. 

The timing answers it. We pulled the creation and last-activity timestamps for the core wallets, and they move in lockstep. Two of the operator’s earlier treasuries went dormant within 15 seconds of each other on the same day in September 2025. A large distribution wallet made its final transaction on the exact day two replacement wallets were created, 11 minutes apart, in December 2025. The current vault appeared 18 days after the collapse and calls the A7A5 token contract directly: operator behavior, not the behavior of someone who simply holds a balance. 

No independent set of users retires two wallets 15 seconds apart or hands off distribution duties in a single afternoon. The pattern is wallet rotation: every few months a treasury or distribution wallet is retired, emptied into its successor, and a fresh one takes over. The earlier wallets that once held the float sit empty today; their balances moved forward with each handoff, until almost the entire supply had gathered into one current wallet. The headline is self-custody, not distribution. 

The faded, earlier wallets hold nothing on-chain today; the current vault (yellow) holds almost the entire float. Coordinated timing across each handoff is the fingerprint of common control. 

The headline concentration isn’t a market crowding into a coin. It’s one operator holding its own float across a rotating set of wallets. 

The April breach, in brief 

Grinex’s reported breach on April 16 moved more than headline USDT. Crystal’s own tracing of the A7A5-specific leg shows pre-positioned gas, a three-second pull into a single wallet matching the reported drain time, then a fan-out-then-recombine structure that funnels back to one collection point: a layering shape, not a simple withdrawal. About $4.4M of what moved that day, the same wallet in the key findings above, has simply been left untouched since, an odd choice for a profit-motivated thief. We reconstruct the full sequence, hedged appropriately, in a companion piece. 

A barbell, not a user base 

If you bucket every address that holds A7A5, the token splits into two extremes with almost nothing between them. 

At one end are the four wallets identified above. At the other sits a long tail of roughly 29,700 addresses holding negligible value between them. In between, where a real user base would sit, there is almost nothing. The same shape shows up in the flows, where 32 wallet-to-wallet relationships account for 96% of all movement since the collapse. 

Almost every address is dust (top bar); almost all value is a single operator vault (bottom bar). The middle, where a genuine user base would sit, is a sliver in both. 

Not even all four big wallets belong to the operator: one, as noted above, holds funds tied to the April breach, transferable on-chain but unusable, since no compliant venue will turn a flagged, sanctioned balance into clean money. That’s a useful reminder of what “unfreezable” really means. It isn’t the same as usable. 

That aside, this is what infrastructure looks like on-chain: a handful of operator wallets and a long tail of near-empty addresses, not a market people participate in. 

What it’s actually for, and what it isn’t 

A7A5 is often described as a way for ruble holders to reach a dollar-backed asset. The on-chain market tells a narrower story. The only place it trades in any size on public markets is a wrapped version on Ethereum, and essentially all of that volume is a single pair: A7A5 against USDT. The token isn’t held as a destination; it’s swapped into and out of Tether, the signature of an intermediary. 

 The operator may have wanted to replace the dominance of USDT and, by extension, USD, but the reality is that A7A5 was more of an intermediary asset, allowing the exchange of a Ruble-backed asset for a Dollar one.  The failure of A7A5 does not spell the end of such schemes, rather a signal of things to come; similar projects already observed along the same mechanism include Zedexion, the Babak Zanjani-linked token, and Moricoin, a token claimed to be related to a self-proclaimed online drug lord. 

The 2025 launch peak (~$16.7M, August) was mostly bot and wash trading; it evaporated in September 2025, months before Grinex fell. Volume since has run in the low single digits of millions monthly and barely reacted to the halt (dashed line). 

 

Most of even that trading isn’t real. A single address accounts for roughly 46% of A7A5’s lifetime decentralized-exchange volume, and the top seven for about 84%. At least $14.7M is outright wash trading: two mirror-image addresses buying and selling identical amounts in the same Ethereum block roughly 1,500 times. Strip the bots out and the reputation outruns the reality; the genuine, non-wash market runs a couple of million dollars a month at most. 

One nuance worth keeping honest: beneath the bots sits a genuinely organic sliver, roughly a thousand small wallets converting modest amounts of A7A5 to USDT, some moving on to exchanges as a plausible small-scale ruble-to-dollar exit. It’s tiny, but it’s real. A7A5 has a small pulse; it just isn’t the pulse of a major currency. 

Idle by choice, and being paid to wait 

Two features explain why an operator would keep a token like this alive rather than wind it down. 

1. First, nothing is stopping them from moving it. That freeze-proof design cuts both ways: the parked float in the operator’s wallet is immobile by choice, not by force, and can be redeployed at any moment. 
2. Second, sitting still pays. A7A5 distributes a yield to holders automatically, reportedly the Russian central-bank key rate minus about a point, as freshly minted tokens, on the order of 1.1% a month, or 13% to 14% a year, with no staking or claim required. The parked float is not dead money; it earns a central-bank-rate return in place. The operator, holding almost all of that float, is effectively paid to wait. 

Who’s actually behind it 

Western enforcement agencies tie the network to one recurring name: Sergey Mendeleev, a Russian crypto entrepreneur who co-founded Garantex and ran the settlement firm Exved, sanctioned twice, by the US in 2025 and the UK in 2026, and who has publicly distanced himself from all three entities each time. That distancing sits awkwardly with on-chain behavior showing a single, actively managed operator vault. We examine the ownership question in full, and what the evidence does and doesn’t confirm, in a companion piece. 

The reality of A7A5 

A7A5 is not a meme token. By its own audits, it is backed, pegged, and yield-bearing, and it served a real purpose for a year. But it now behaves like infrastructure an operator is minding, not a market anyone participates in: value moves through it, briefly, on its way somewhere else. 

This isn’t what enforcement finally working looks like. A folding operator lets its float scatter and cashes out what it can. This operator gathered its float into a single, actively managed wallet within three weeks of the breach and kept paying itself yield on it, the same response it had to the first round of sanctions, run again at larger scale. That’s not the behavior of something winding down. It’s the behavior of something waiting.

None of this is visible from headline volume or a market cap ticker. It comes from resolving addresses correctly, reading net flow rather than gross, and reconstructing each wallet’s life from its own timestamps, all of which are checked against the token contract itself. That’s the difference between watching a number and understanding a network. 
 

Frequently asked questions 

Why can’t A7A5 be frozen if it’s sanctioned? A7A5 was built without a freeze function, so no issuer, regulator, or network can lock a wallet holding it. Sanctions restrict who is allowed to deal with a token or its issuer; they don’t change what the token’s code allows on-chain.  

Does 94.5% of supply sitting in one wallet mean something is wrong? Not necessarily on its own. What points to a single controlling party here is the pattern: wallets retired in coordinated succession, and a new vault created weeks after the shutdown that calls the token contract directly, plus a documented precedent (the 2025 supply reissuance) for exactly this kind of consolidation. 

What does “net transfer volume” mean, and why not just use total volume? Total, or gross, volume counts every transfer, including money moving back and forth between the same parties. Net transfer volume counts only the value that changes hands for good, so it’s a more reliable read of real activity. 

Is the yield A7A5 pays out real? The token reportedly distributes newly minted tokens to holders automatically, at a rate tied to the Russian central bank’s key rate, with no staking required. Crystal’s on-chain data confirms the mechanism and can observe payouts; it doesn’t independently verify the issuer’s stated reserve backing. 

 

Data as of 28 July 2026. On-chain figures are derived from Crystal Intelligence’s own analysis of Tron and Ethereum data. Off-chain context, including the ownership and reserve structure, the sanctions history, the destroyBlackFunds re-mint, and the reported April 2026 security breach, is drawn from open-source reporting and government sanctions announcements, used for framing only. These are, in several cases, allegations rather than adjudicated facts, and are labelled as reported where relevant. The analytic findings, including supply concentration, net-versus-gross flow, wallet lifecycle, and DEX market analysis, rest on Crystal’s own on-chain data. Wallet addresses are omitted or truncated throughout. A companion piece traces the April incident’s A7A5 leg and the network’s ownership in more detail. This article is for informational purposes only and is not investment, legal, or compliance advice.