Pinned Tweet
A huge marketplace for online scammers, with links to the ruling family of Cambodia - check out this 90-second summary of our recent research
🎙️Russia’s search for alternatives to the Western financial system is increasingly moving into crypto.
One experiment has attracted particular attention: A7A5, a rouble-backed stablecoin linked to the wider A7 payments network. It is designed to facilitate cross-border payments outside conventional banking channels.
In the latest episode of the #STRPodcast, host @keatingetom speaks with Dr Tom Robinson, Chief Scientist and Founder of @elliptic, about what A7A5 reveals about the evolution of sanctions evasion.
Listen to the full episode here: bit.ly/4ioYtBX
🇷🇺 Sanctions-evasion service provider A7 has launched a "USDT to SWIFT" service to help Russian businesses pay for imports:
• Send invoice + USDT (+0.3% fee) to A7
• A7 wires funds to overseas supplier via SWIFT
This also provides A7 with vital USDT liquidity to prop up A7A5.
A7A5 transactions have plummeted following recent Ukrainian strikes on Yandex data centers in Russia. Not because the Ruble-backed sanctions-evasion stablecoin itself depends on these facilities (it runs on decentralised blockchains) but because its exchange service does.
1/N
A7A5’s primary use is to bridge Rubles to Tether’s USDT, primarily through the issuer’s own exchange. That service has been hosted by Yandex since Sep 2025. Before that it was hosted in Europe - but sanctions against A7A5 in Aug 2025 likely prompted a switch to Russian hosting.
The U.S. @SecretService has frozen $52.8M in crypto held by Xinbi Guarantee, with the assistance of @elliptic. We exposed Xinbi in 2025 as a fraudsters' marketplace and key enabler of pig butchering scams worldwide. It is the 2nd-largest illicit online market of all time.
And now it looks like Xinbi Guarantee is on the verge of collapse, as Telegram starts to close its channels, and ban its usernames:
The U.S. @SecretService has frozen $52.8M in crypto held by Xinbi Guarantee, with the assistance of @elliptic. We exposed Xinbi in 2025 as a fraudsters' marketplace and key enabler of pig butchering scams worldwide. It is the 2nd-largest illicit online market of all time.
A7A5 was built to be unstoppable: a ruble stablecoin beyond the reach of sanctions, moving funds that help sustain Russia's war machine. But sanctions and blockchain analytics have left it largely unusable, as described in @Elliptic's new report.
Read the report:
elliptic.co/blog/the-fall-of…
It's 3 weeks since Xinbi was sanctioned. @Elliptic data shows that the scammer's marketplace has now facilitated over $21Bn in transactions. Meanwhile @telegram, which could shut it down with the press of a button, continues to turn a blind eye...
wired.com/story/telegram-is-… @WIRED
Telegram has taken action! By banning UK @telegram users from accessing Xinbi... 😕 So probably the bare minimum they think they need to do to comply with the UK sanction, while doing nothing to address the underlying issue...
Crypto outflows from Iran spiked 700% in the minutes following the first airstrike.
Nobitex, Iran’s largest crypto exchange, also saw withdrawals surge on 16th and 30th January - days on which the U.S. announced new sanctions against regime officials.
elliptic.co/blog/iranian-cry…
New research: Iran’s Central Bank has purchased US dollar stablecoins worth at least half a billion dollars, likely used to evade sanctions and support the rial
elliptic.co/blog/iran-has-ac…
Tom Robinson retweeted
1/8 I was taking a look at this research from @elliptic and noticed something interesting. It seems that the same entity who is selling USDT to the Central Bank of Iran 🇮🇷 is also buying USDT from groups laundering on behalf of DPRK 🇰🇵
New research: Iran’s Central Bank has purchased US dollar stablecoins worth at least half a billion dollars, likely used to evade sanctions and support the rial
elliptic.co/blog/iran-has-ac…















