Criminal stablecoins: the new channel for laundering and sanctions evasion

When a door closes, bad guys always look for (and find) a window. If before, to evade capital, hide funds or pay for unspeakable activities, shell companies, precious metals, works of art or, almost always, wads of banknotes were used, today the phenomenon has become more ethereal, abstract and digital. Even more so with stablecoins, a type of cryptocurrencies linked to the value of the dollar (although there are also those of the euro) with which the money does not take up space and is transmitted through its own channels. Payments are instant, cheap and global and sometimes oblivious to the eyes of supervisors.

This new form of digital money has become a useful tool for moving funds outside the traditional financial system. Unlike other extremely unstable cryptocurrencies (Bitcoin lost half of its capitalization in five months), stablecoins maintain a fixed value, allow instant transfers on a global scale, and can jump between multiple platforms without the need for intermediaries.

It is not surprising, then, that these types of currencies are the unofficial money of bad guys: stablecoins concentrate 84% of all the volume associated with illicit transactions in 2025, according to a report by Chainalysis. “A launderer cannot gamble the money of a criminal organization with a cryptocurrency that can lose a large part of its value overnight,” acknowledges a UDEF agent.

Those that appear the most in Civil Guard and National Police investigations are the most common and largest on the market: such as USDT issued by Tether and USDC from Circle. Both are regulated in the main jurisdictions, such as Europe or the United States, and, therefore, widely accepted by platforms that operate with cryptocurrencies. That is, whoever wants to use them has the guarantee that they will be able to buy, sell or exchange them anywhere. But being regulated, they are also on the radar of the authorities, with whom the platforms usually cooperate when it comes to freezing suspicious or illicit funds.

Precisely this greater supervision has driven the emergence of dark alternatives. In a world where creating a token representing money can be done in the snap of a finger, criminals have also begun manufacturing their own digital currencies. They are stablecoins made to measure, by and for criminal actors, such as the Russian A7A5 or the Cambodian USDH. Sources close to the investigations avoid detailing specific use cases, since the investigations are still open. However, they are mainly used in the trade of illicit goods and services, to evade international sanctions, and are also related to human trafficking.

It is a limited circuit: crypto platforms in the main countries are subject to regulation and cannot include this type of assets in their offer. “Instead of transacting with billions of people, they can only do so between bad guys, between those who have the same objective,” explains Fernanda Restrepo, head of Forensic Investigations at Kroll Iberia. But they are designed for that: to avoid controls, sanctions and avoid supervision mechanisms.

Taking advantage of jurisdictions where controls are weaker, the promoters of these assets leave windows to convert these currencies into respectable stablecoins and, therefore, into money. The Financial Action Task Force (FATF) defines them as proprietary stablecoins, assets specifically designed to evade intervention by security forces: the Russian A7A5, linked to the ruble, is the best example of this, since it has been key to building a parallel financial infrastructure, isolated from Western supervision.

From Moscow to Phnom Penh

Its origin is as enigmatic as its name. It was launched in February 2025 in Kyrgyzstan by the Russian company A7, backed by Moscow, with the aim of facilitating cross-border operations of Russian companies and users and circumventing international sanctions. Behind the company is Moldovan businessman Ilan Mironovich Shor, a fugitive in Russia after being involved in the theft of $1 billion from the Moldovan banking system in 2014, the largest banking fraud in the country's history and one of the largest in Europe.

The hourly pattern of use of this currency, according to the blockchain data analysis company Chainalysis, suggests an enterprise use: it works as a bridging asset through which users deposit rubles and receive A7A5 tokens that they can then exchange for other cryptocurrencies. “This sequence allows funds to enter the stablecoin ecosystem without going through traditional correspondent banking channels,” details the United Kingdom Center for Defense and Security Analysis.

But its use has gone further. An investigation by Moldovan police revealed that Shor collaborated with Promsvyazbank, a Russian state bank also sanctioned internationally, to buy votes in the key 2025 elections. According to the investigation, he used A7A5 to transfer at least $39 million to Moldovan citizens in exchange for their votes, as reported by a British Parliament report. Sources close to the investigations also assure that this asset has been used to pay users and create bots in massive disinformation campaigns.

Several international jurisdictions, such as the United States and the European Union, have sanctioned this stablecoin, its issuing company and the main platforms where it can be bought or sold. However, the token continues to circulate. In its first year of life, the asset moved $93 billion, most of it through platforms closely linked to Russia, according to Chainalysis' Crypto Crime Report.

The Russian stablecoin is not the only one of its kind. Huione Group, a financial conglomerate founded in 2014 based in Phnom Penh (Cambodia), considered a key money laundering node for transnational organized crime networks, operates an entire fraudulent financial ecosystem: from a payment platform to a crypto service provider, including a market that offers false identities, in the style of Silk Road, the former website used to traffic drugs and hire hitmen (and whose founder was pardoned by Donald Trump). The company launched the USDH stablecoin and touted it as immune to asset freezes and outside the oversight of traditional regulatory authorities.

This group has been identified on multiple occasions for human trafficking and as the epicenter of online scams: thousands of people of various nationalities were forced to work in massive call centers to deceive their victims through romantic scams with cryptocurrencies on Telegram or in dating apps like Tinder, several reports indicate. International authorities such as Interpol or the FBI have tried to stop these scammers and in May 2025, Huione Group announced that it had closed its activity, although it only changed its name and structure. To date, it has channeled more than $102 billion and among its main clients is Ilan Shor, promoter of the A7A5 stablecoin, according to industry sources.

For stablecoins like A7A5 and USDH to exist and circulate, they need an entire ecosystem to accept them. Crypto exchanges located mainly in Asia include these assets in their offer: "The bad guys launder money, but they also need to get cash. And exchanging it with traditional assets is easier," details Alberto Redondo, head of the Criminal Cyber ​​Intelligence Group of the Technical Unit of the Judicial Police.

Although it is not frequent, these assets have appeared in the investigations of the Spanish authorities. When it happens, alarms go off: the investigation is compromised. “When we are faced with an asset of this type, our job is much more difficult,” acknowledges Restrepo. The stablecoin cannot be blocked and usually circulates on crypto platforms in opaque jurisdictions that do not cooperate with international authorities. “We get no response at all,” he insists. To add another layer of complexity, criminal networks have tools to erase the trace of their transactions. “It is impossible to trace it, and above all impossible to intervene in it, because they control it,” acknowledges a UDEF agent.