A7 network on-chain volume exceeds $166 billion, ties to IRGC and

A new TRM‑OSC report shows the A7 network, a state‑backed Russian payment system, processed more than $166 billion in on‑chain transactions, directly connecting sanctioned actors such as Iran’s Islamic Revolutionary Guard Corps (IRGC), North Korean state hackers and Hamas [1]. The scale underscores crypto’s role as a liquidity and accounting bridge for entities excluded from the formal banking system.

Crypto functions in A7’s operations

TRM identified two core uses for digital assets. Domestically, USDT holdings are sold in Moscow’s cash‑intensive wholesale markets and the ruble proceeds are funneled to foreign treasury pools in Kyrgyzstan, China, Egypt, Turkey and Dubai. Internally, the network circulates its own token, A7A5, in circular transfers that settle balances without minting new tokens, a practice that inflated reported volume by roughly $35 billion [1].

Sanctioned counterparties and on‑chain flows

On‑chain analysis linked A7‑controlled wallets to several high‑risk actors. One address received $65 million directly from an IRGC‑attributed wallet, while another got $5 million from Hamas [1]. Hackers linked to North Korea moved at least $590,000 from compromised exchanges BTCTurk and Woo X through A7 intermediaries before cash conversion [1]. Elliptic’s separate leak revealed $8 billion in stablecoin transactions over the past 18 months, expanding the known crypto footprint of A7‑related entities [2].

Broader implications

The findings illustrate how crypto fills gaps that traditional finance cannot, enabling sanctioned actors to move funds, manage liquidity and bypass enforcement actions such as the seizure of the Garantex exchange. By migrating frozen balances into the ruble‑backed stablecoin A7A5, the network insulated its liquidity from smart‑contract attacks and regulatory disruption [1].

What to watch

• A7A5 activity spikes – sudden increases may signal new migration of frozen assets or fresh liquidity moves.
• Further on‑chain links – additional addresses tied to IRGC, Hamas or North Korean entities could expand the network’s exposure.
• Regulatory actions – any new sanctions on A7, Promsvyazbank or related wallets may trigger abrupt on‑chain volume shifts.

The report confirms that crypto is not a peripheral element of A7 but a core conduit for sanctioned finance, raising questions about the effectiveness of existing sanctions regimes and the need for enhanced on‑chain monitoring.