Gabi Dumitriu - Unmasking Web3 Money Laundering: from NeoBanks to crypto

We're talking about a token created by Russia, right? But what is that token A7 A5? Who built it? How it works? So we have some key actors here, right?

So the ticker it's A7 A5. The smart contract runs on Ethereum and Tron. The legal issuer is old vector LLC. Um and also we have a custody in uh in Russia from bank. And also last year actually after two weeks after ETH cluge 2025 ended uh OFAC office of foreign assets control u designate designated the um the token as you know a bad bad thing for for the ecosystem.

So how it works? So it is a rubble pegged stable coin engine to move Russian uh rubble value across international blockchain uh rails while keeping of course the reserve in Russia. Uh so we have the reserve banking uh so we each token is backed one by one uh with Russia rubble and we have the pronzias bank which is a state-owned bank u of course sanctioned in Russia. Um so then we have a company called A7 LLC operating as uh token which means the new tokens right. Um and then we have the crosschain transfer.

We have Tron and Ethereum. And also the the Tron unfortunately is the primary volume chain due to near zero fees of course. And also we have 50% yield incentive. Uh they created um an incentive mechanism in order to um uh to gain more people and um on board them. And also we we have the three layer A75 architecture.

We have the the bank in Moscow which holds the the rubble reserves and the token is also guaranteed by the Russian stateowned balance and also we have the old vector which is a company in Kyrgyzstan is the formal legal issuer basically they are the one that means the token uh of course in Kyrgyzstan they don't have AML policies uh they are super safe right there uh they don't have like what we have here in Europe or US and also we have the guarantex or grinex uh the exchange from um from Russia and also of course another OTC uh desk that converts the token into USDT and then in fiat also of course green X also was also um sanctioned of course and also the the domain name is also uh seized and then uh why uh the western freezes fail in this situation because you know reserve is in Moscow we don't have jurisdiction to enter in Moscow or also to apply sanctions to to actually seize seize the assets. There is no tether dependency of course we cannot freeze it and also there's a lot of um legal sh legal shows in in Kyrgyzstan and also of course we have DEX and OTC distribution. The thing is that um last year um one deck managed to finally finally um block the um the pair you know A7 A5 USDT USDT and the mastermind it's Elan Shore which is um you know a very controversial person in from Republic of Moldova maybe some of you know him he um yeah he's a Moldovan oligarch are convicted fraudster Russian as a political operator and also the central intelligence behind the A75. Um he managed to you know um run with a billion dollars a few years ago. Uh he went to Israel and then in Moscow with that money he created LLC Vector and then the token.

So we have him which is a mastermind. It's um actually younger than me in 87. Um yeah. Uh and then we have the short party network which is a bad party in the republic in in Moldova. uh which is yeah a Kremlin funded political movement designed to destabilize EU integration efforts and then uh there are a lot of sanctions on the in fact I will show you one second I'll show exactly so there is the national the uh the official office office of foreign assets control website and we see the company old vector LLC yeah which is funded by uh Elan Shore it's in sanction list also So we have him as an individual.

Yeah. Milan shore. He's double. He runs um he used to stay in Israel and then he moved uh in in Russia and also he's been uh on the sanction list even the um after a few weeks after he run with the money. Continuing um yeah and also we have the political finance uh using the token.

Uh the token has been used to uh to buy political influence, bribery, um selling oil as I said uh selling guns um and also basically all the bad stuff that is happening in this modern hybrid era uh ecosystem that if I can say that and also we have the commercial holdings because of course they have a lot of companies related to this um thing called A75. five. Um so we have AIA invest um Jolie Allen um they were alo also used of has been used as vehicle in the 1 billion brand fraud scheme after he was exiled um he created this infrastructure and then yeah as I said uh it's continuing to do bad things regarding the entities we have all these entities yeah so we have of course the mastermind Elan Shore he's um Russian in Muldova in Israel uh he's directing and also one one important thing he kept 51% of the tokens because yeah why not you know so he holds the majority of the tokens he's of of course it's on the off sanction list all vector LLC which is his company in Kyrgyzstan uh A7 LLC/taken of course the minting operation this is the company that actually mints the token of course and also burning the bank from Moscow Promez Bank of course allax sanctioned as well. This is the custodian uh entity that actually holds the the robbles and also we have the exchanges from Russia. Of course uh the domain as as I said was seized last year.

If you try to access Garantex, it's it's on on the blacklist. Uh also deals with the the conversion A7 A5. We have the Grin X which is uh he's been like a second like the baby of Garantex Grinex a Hong Kong node and we have yeah of course uh different nodes that are involved in this um um operation basically over the counter companies or gateways in Hong Kong in Dubai and in Turkey which is which are used as an exit or fiat of ramp or on ramp and yeah these are the entities involved in this in this uh Yeah. join join the club. I'll take grab.

Yeah, you can you can ask her to come. Huh? Okay. Okay. And then this is the entire circuit, right?

Elansure. So this is the uh sanction node, the high-risk node and the exit. So we have Elansure which is the principle. We have the bank, we have the convection uh sorry the um those vector LLC which is basically converts rubbles into uh into the token the the the exchange happens here in this pro I'm not sure if you're can you see it or you want to make it bigger it is was fine yeah of course the political party is also involved because uh because back in the days when they had the election Um the uh the police managed to see some relationship between the token Elan Shore and the party and also they've been involved in manipulating the the election in the Republic of Moldova and also the bank and then of course we have the u the nodes the exit nodes in Dubai, Hong Kong and uh in Turkey. Um yeah so some words about uh the bank uh is the most critical node of course in the A7 A5 architecture as a fully stateowned Russian defense bank it transformed A7 A5 token from a commercial crypto project into sovereign financial weapon and the thing is that um I think um half more or less half a year ago more of the Russian vloggers managed to create videos in which they try to create like tutorials how to buy token using their infrastructure.

Of course, we don't have access to to that kind of infrastructure, but they have uh and also the the Tik Tok the YouTube shorts has been almost flooded with uh Russian um paid vloggers that are using really really convincing um let's say um mechanism to make you buy the tok. Oh, it's the new tech to do digital. can use it on daily use. Yeah. However, uh they don't know exactly that this token is sanctioned.

This token is it's used as at large scale in doing bad things, you know. Um so yeah, as I said, it's full state ownership. Uh it's sanctioned the reserve custody. The uh the bank holds all the rubble reserves. Uh this is by design.

This is how they managed to to create it. And also it's immune to western uh sanctions because it's it's in their courtyard. Um what else? Um yeah, it also process conventional rubble denominated defense uh contractor payments and A75 uh crypto minting operation creating a deliberate regulatory ambiguity. Basically traditional AML mechanisms don't function in that ecosystems.

We have nothing to to uh to stop them. back in the days uh when they first try when they first used um uh the token on the Ethereum of course we could we we were able to to block all the transaction but now they moved to Tron because last year in August I think um the DEX managed to block um the pair and also as for the um no sorry why was the bank chosen of course it's a commercial Russian bank it's almost almost the biggest bank in in Russia. Um and also it's managed to uh it's managed by the service secret service from from Russia and also there is the jurisdictional gap as I said back in the days um hold the reserves the the reserves in US banks but the thing is that um in Tron as you know there is no blocking mechanism that we can use we as Europeans or in US we can use to block them. So they moved from Ethereum to Tron and as the workflow uh the sanction the step one sanctioned entity deposit robels into the bank. Yeah.

And then step two after the confirmation uh the company A7 LLC uh mint the equivalent A7 A5 tokens, right? It's one to one. One A7 A5 token equals one Russian rubble. And then Old Vector LLC means a token. Yeah.

Go ahead. Okay. And of course, traditionally, the tokens are sent to uh to the depositor's wallet, of course, and then A75 transferred to guaranteed green X uh and swap to USDT or routed to over the over the counter desk. And as the timeline, uh 20 2017, yeah, it was a conviction for Elanchor 1 billion Moldova bank fraud. Of course, a lot of mess was Yeah.

um 15 years sentence. He then uh moved to Israel and then Russia. Russia of course of listed it's listed on every single um sanctioned um entities. And then in 2023 after the Russian war started he created the old vector LLC launched the token on Tron U. Um the company is incorporated in Kyrgyzstan because why not and the A75 token goes live on the Trump blockchain with initial reserve banking right and then he gets 2 billion in USDT liquidity on guarantex because again why not uh two years ago uh was like peak operations uh when Russia was like on the edge let's say uh when they were almost trying to um um create new ways of obvious no trying to um evade sanctions and then uh it was like 41.

6 6 billion in transaction which is like super huge. Um, of course only 495 million equivalent in in US dollars but the thing is that it became the number three most traded token which is like crazy in Tron. Yeah. by volume. And then in uh last year in March um the seizure for for guarantex happened.

25 million USDT was frozen by Department of Justice. And then in August the company A785 was added as I as I showed you here in the uh uh here in the in the OFAC. Okay. And also the thing is that um if you if you run a company, if you are an um a person running in compliance legal um you need to know that by default you need to um to flag as sanctioned uh to flag as um um to flag only transaction in and out that are related to this uh this token. So we have the smart contract in Ethereum which is this one.

So basically any transaction in and out that are related to this contract should be flagged as suspicious and also um multiple investigation should be um performed at at least level five because they are using multiple hops in order to obiscate the transaction and also they are using swaps they're using u chain hops um and uh even though that transaction looks like yeah it's okay no it should be treated as um high priority risk and also should be flagged and also all the policies AML policies should be should be applied. Um yeah and also one more one important thing is that in some ways um there is um legal act called emlat mutual legal um agreement that can be used between multiple countries or entities in order to uh investigate um some some aspects related to uh this token. For example, if a company moves funds uh using a neo bank such as Revolute. Yeah. For example, a person from Russia converts the token, holds USDT or Ethereum.

It then moves Ethereum to um his personal um Revolute account and then convert to fiat or whatever. It should be automatically flagged. The thing is that in practice uh it's not happening you know because um this kind of investigation area that I'm involved in um at the at the moment uh is not widely um covered and the thing is that people are trained as crypto forensic investigator but they their background is like from legal they don't understand all the um the mechanics of the blockchain. So you cannot call a person crypto forensic investigator if he only managed to uh take his uh analysis uh crypto investigation course. He basically a user that he's trained to use a specific tool.

From my perspective u a crypto forensic investigator should be software agnostic. He should he should have multiple um skills and experience using not exactly investigation tools but knows exactly how a swap works, what a DeFi is. Uh he managed to lose money because when you lose money in crypto, you tend to have like a extra set of eyes when you investigate things. Um and yeah um yeah of course we have a lot lot of I'm not sure if the time allows us but u a lot of things going on here but one thing I want to show you um yeah why is critical of course as you know in blockchain immutable transaction yeah it's every every mint transfer index swap is permanently ced on on and ethereum as I said it bypasses the traditional AML policies we have crosschain attribution realtime seizure capability we have here but um multiple um crypto forensic investigation companies back in the days I mean last year managed to seize some funds related to a 785 token um but I want to show you here how the um crypto energy transfer network flow it is so we have uh who sanction state Russia Iran um and then we have the conversion here and I wanted to show you this because uh last year they managed to use unis swap to swap uh A75 to Ethereum sorry to USDT and then to Ethereum. So it was so much easier back in the days to um evade sanctions and then move on with the with the funds.

Then of course, unis swap after so many people reported the the pair and then the smart contract attached to to the token as malicious or suspicious uh unis swap managed to block this. So if you want to trade now on deck it's there is a big message right there. So you cannot um use the decks and also and then the grindex was involved in the equation and also the hub series as I said. Um so um the thing is that even though the transaction looks like from Europe or from US they uh they are using um a centralized exchange like Binance for example as a hop as a proxy. So it looks like the transaction is legit.

However, they are moving moving funds from hop to hop and using a centralized exchange as an offiscation layer in the layering process of money laundering. So even though a transaction looks like clean, it not necessarily is clean, you know. So from these um um um entities should be uh any transaction related to this entity should be of course you can throw another set of of eyes on on the transaction also of course you haven't you need to have in place um specializing like money laundering reporting officer in a bank um you need to have like um really qualified person that know how to create a a SAR suspicious activity report or suspicious this transaction report you know to how to interpret uh a transaction which looks suspicious and also as for the uh investigation methodology first of all check if the uh the san the the address is is sanctioned as I said yeah then of course you need to use blockchain analytics tools in order to detect as I said with multiple hops or chain hops and then crosschain throne Ethereum tracing there are specialized tools like ch analysis like durm labs, Elliptic, Crystal, Merkel Science, Metas, Sleuth, Arcom, a lot of them that can trace um this kind of conversion because um almost three or four months ago they added uh the whole infrastructure on their investigation tool and also uh created the um the wallet attribution um modules. Let's say wallet attribution is when uh using oint methods, open source intelligent methods, you can attribute um um to a wallet address. You can attribute a name, an entity, so on and so forth or a sanctioned entity.

And then of course you have the you need to to map the full ecosystem with all the transaction in and out all the swaps, all the chain hops, so on and so forth. And uh using uh the help of um prosecutor you can freeze the tokens if you can. If you cannot well I'm sorry for oh so sorry I'm sorry for your loss as as case c uh sorry um case study. I'm not sure if we have time. Yeah 12 minutes.

Huh?

15 minutes. Are you sure? 15y promise.

Of course. Nice. Yeah. So we have over the counter identification. Yeah.

Unlicicensed OTC broker in Dubai managed to transfer five almost 5 500K and also uh using specialized tools they managed to oh this is related to A7 A5 token and steps they see the exchange wallet in G analysis reactor is a tool from G analysis. Ch analysis it's an crypto investigation uh platform. Of course they managed to identify the flow in USDT applied huristic methods in order to see um patterns transfer patterns crosschain tracks monitor of course telegram and OTC advertisement from this address because in this kind of situation using a crypto forensking investigation tool is not enough. You need to apply some OIN methods, open source intelligence, cross um pollinate ideas with peers, uh monitor all the dark web, uh Telegram, so on and so forth. And you can gather the data using some tools and of course you can see the whole the whole map.

And then uh yeah, submit KYC subpoena to exchange. Basically, it's a legal procedure that only um a prosecutor can do. Uh in here we as investigator we have kind of a we are yeah more like frustrated because uh we do the all all the the the heavy load the the heavy work and then we know that this is the guy but we cannot knock on Binance's door and say Binance this is the guy you know freeze the funds no we cannot so we need to create that um uh legal document and then only the uh the prosecutor using mutual legal agreement um um procedures can knock on Binance's door and say dude Ahmed is using A7 Eagle or whatever you know. Yeah. But we we managed to um to help them as much as we can.

So this is why uh we tend to create more awareness. Yeah. Sorry. So the Roman Sturgling Roman Thoring was prosecuted by chain analysis over Bitcoin fog even though he didn't use it and he's now in prison for years. Uh can you comment like on the the impact of the forensics and what you think the industry could do better?

Yeah. Uh the thing is that um when you use uh crypto forensic investigation tools doesn't matter if analysis or doesn't matter um we can see as much as the blockchain can show us um if for example that person used um identity as a service provider and rented his uh identity to third parties in order to do bad things. he would also in the end lead the investigation to him. The thing is that yeah there's broken there's a missing gap. I agree with you there's a missing gap in uh in which uh some tools uh that used to be like manual now are being automated by the AI and also from time to time they kind of you know provide false positives.

Um so this is why yeah uh the case it's really well known in in this space but the thing is that we should use uh AI and digital not like the not like holding the the supreme truth but just more like guiding lines from my perspective. So yeah, I'm not sure if I

One of the exchange hacks last year was attributed to North Korea because

Yeah. Lazarus group. Yeah.

One address over overlapped, but as far as I could tell, the only evidence was they sent the funds to one address. Um

are you referring to uh the Bybit hack or what?

Yes, the Bybit hack. Um, so it cost them less than 1% of the proceeds to give a false positive to some

it's marketing money for them. Yeah.

Uh, in fact uh I investigated that um that hack. In the end there were like 26,000 addresses involved in Tron, Bitcoin, Ethereum, uh, Binance, Arbitrum and some other I think there were like seven blockchain involved. Solana Solana as well. Yeah. How many of those addresses over overlapped like known uh Lazarus group

that were the um so those 25,000 were like the primary addresses but from that addresses they managed to you know create layers of transaction thousands of thousand thousands in transaction and also on the Binance they managed and B in Solana and Ethereum they managed with the funds and managed to create another tokens create pairs in um indexes. So basically created um meme coins on Sana as well on pump that fun with the hacks with the funds from the hack and then uh they managed to gain more money using the the memecoin and also the shitcoins as we call it. Yeah. So um yeah.

Uh so uh why do you think they chose Tron as their main uh blockchain?

From obvious reasons I guess. What's what's the obvious reason?

You can freeze USDT, right?

Okay. Uh then do you think it's that uh

you cannot do it on Tron? Well, uh

yeah, but um the thing is that onron you can also you have that an extra layer of anonymity and also an extra layer of let's say

do do you think it's that censorship resistant as why why would they do it?

Yeah, I guess and also uh Russia is close to China. China is they are good friends with um northern Korea.

Okay. So probably

so basically I think it's the culture relationships or

I think it's the culture because they are in the region. Uh so yeah um but no a lot of um we can also of course speculate until 4:00 a.m. in the morning. The fact is that um company

I I just wanted to ask if if you have any information why why they chose specifically throne.

Oh not exactly. No no no no. And and another thing. So uh do you know the origin of the name A7 A5?

So the A so

A7 A5.

Yeah. So

so the name of the token

the the token the the original not not sure exactly. No.

So if you read it in Russian so a uh so if you replace seven with a t you have it on the first page somewhere.

Uh t uh no no.

Yeah. And uh if you replace seven with a t and five with s you get atas.

Ah yeah

in Russian it's called to fight.

Yeah yeah we can yeah we can speculate that I remember you know. Yeah which is true. Yeah actually. Yeah. Um yeah if you have any more question I'm all over internet on LinkedIn gabit gabrio.

and also you can ask me anything related to this kind of information um guide me through and also on on LinkedIn. I think this is it because there are a lot of stuff going on after this workshop. Thank you for having time to listen this and um yeah stay safe. What can I say?