Moldova’s National Anticorruption Center has uncovered a scheme to influence the country’s 2025 parliamentary elections using cryptocurrency. The scheme allegedly funneled over $107 million through a complex transaction network to promote candidates and bribe voters. Authorities traced the funds back to centralized crypto platforms in Russia and Kyrgyzstan, with blockchain analysis linking the operation to a larger Russian sanctions evasion ecosystem involving exchanges like TokenSpot and Garantex.
Moldova’s National Anticorruption Center has uncovered a scheme to influence the country’s 2025 parliamentary elections that used cryptocurrency to channel funds to activists and bribe voters. According to CNA director Alexandr Pinzari, the scheme involved the “illegal financing of certain political parties, with the aim of influencing the elections’ results in favor of specific electoral contenders.”
The scheme involved transferring virtual assets to an intermediary in Moldova, who converted them into cash before distributing funds to local activists. Pinzari said the funds were used to remunerate people for promoting candidates, to bribe voters, and to mobilize participants for rallies.
The CNA identified a complex transaction scheme leveraging non-custodial cryptocurrency wallets. One wallet saw transfers of over $107 million in the stablecoin USDT between 2023 and 2025, with $43 million transferred in 2025 alone.
According to the CNA, the origin of the funds could be traced back to two centralized crypto platforms in Russia and Kyrgyzstan. Pinzari noted that the crime ring created its own virtual currency, converting funds through exchanges into USDT to facilitate integration into Moldova’s economy.
Blockchain analysis firm TRM Labs linked the campaign to a Russia-backed foreign influence operation. With help from a Moldovan investigative journalist, TRM identified Kyrgyzstani crypto exchange TokenSpot as the likely source of one transaction.
TRM Labs Senior Blockchain intelligence Analyst Chris Keegan stated the firm was unable to locate the source of a second payment. He added that TokenSpot is connected to a larger Russian sanctions evasion ecosystem that includes the sanctioned exchange Garantex.
Keegan told Decrypt that Garantex-related entities have been heavily integrated into a Kremlin-backed sanctions evasion environment. According to TokenSpot’s website, legal entities must verify themselves by disclosing customer due diligence measures and information on applied sanctions.
According to TRM Labs, illicit entities received some $141 billion via stablecoin wallets in 2025. Last month, the European Commission reportedly considered a bloc-wide ban on all crypto transactions with Russian counterparties to clamp down on sanctions evasion.
