One afternoon, one $83 million sum, 33 transfers: how A7A5 turnover is made

On 26 August 2026 at 14:43 UTC the wallet that holds almost nine tenths of all A7A5 sent 7,000,000,000 tokens, about $82.9 million at the ruble's par rate that day, to a second address. That address sent one half of the sum to a third wallet and the other half to a fourth. The third spread its half over four wallets, had every token back in eight and a half minutes, and returned it to the second, which passed it on to the fourth. The fourth, now holding all 7 billion, spread parts of it over five wallets and then over three, collected everything again, and sent the full 7 billion back to the second. At 15:34 the second returned it to the vault. Thirty-three transfers among sixteen addresses, 51 minutes, and the coins ended exactly where they started.

Add the column up — all 33 transfers — and A7A5 "moved" $643 million that afternoon. It did not. One sum of $82.9 million made a round trip; even the seven transfers on the spine of the loop, ignoring the fan-outs, add up to $407 million. Every digit in the column is true and the total is worthless. The sum was counted 7.8 times over — and 26 August is one afternoon, not the size of the pattern: the same structure ran on 24 September with a $59 million sum and counted it 7.9 times (section 4). It is the defect we measured on a Bitcoin peel chain last week, and it is why the published turnover figures for this token — $51 billion, $100 billion, $110 billion, $140 billion — are all correct and none of them measures what a reader assumes it measures.

This is the long version: what we counted, three independent ways of measuring how much of the turnover is the same coins going round, what those measures do not prove, and two scripts that let anyone redo the arithmetic without an account.

1. What we measured

A7A5 is a ruble-pegged stablecoin issued on TRON and Ethereum since January 2025. The EU prohibited any transaction involving it by name (Council Regulation (EU) 2025/2033, Article 5ba and Annex LIII of Regulation 833/2014, in force 25 November 2025); OFAC and UK OFSI designated the issuer-side companies in August 2025. The token contracts themselves are on no list.

We hold every Transfer event of the four contracts from the first mint to 23 September 2026 in a local database: 407,790 transfers, valued at par (1 A7A5 = 1 RUB at the Bank of Russia rate of the day), plus the issuer's own events (Issue, Burn, Blacklisted, DeBlacklisted, DestroyedBlackFunds) and the contracts' balances read by balanceOf() at one block. Nothing comes from an explorer's holder table, which for a rebasing token is wrong by construction: totalSupply() on this contract returns the share count, 15.7% below what holders own today, and the largest holder's balance is bigger than "total supply".

Every number below has a SQL file behind it and, for the headline ones, a second query that recomputed it by a different route. What is public and what is not is stated at the end.

2. How the number shrinks

One dataset, five readings of the same word:

"Operator" is not an attribution. It is any address that received at least 1% of all mints, originated 1% of burns, was ever blacklisted by the issuer, is on the OFAC list, or moved at least 0.5% of its chain's lifetime volume — 102 addresses, derived from the ledger alone. Move that last cut to 0.25% or 1% and V2 is $52.1 B or $80.6 B; tighten the human-scale caps to ≤10 transfers and ≤$10K and V3 is $10.5 M; drop the frequency cap and allow $1M and it is $2.16 B. We print the middle and the range, because the cut is a choice and the reader should see what the choice does.

3. How much of it is the same coins: three bounds

The V2 step depends on a threshold. So we measured circularity two more ways that share nothing with it — one that can only undercount, one that can only overcount — and read the three together.

The floor: exact round trips. A transfer A→B whose exact token amount comes back B→A within 24 hours. No address set, no volume cut, no label; the only parameter is the window. Over the whole history that is 1,678 such pairs, $21.9 billion counting both legs, 16.1% of V0. Allow a 0.1% difference in amount and it is 20.5%; allow seven days instead of one and it is 18.6%. This measure can only undercount: in the loop at the top of this piece, 22 of the 33 legs sit in exact pairs — the vault's out-and-back, A's leg to C and back, and nine of the twelve fan-out wallets — while A's two split legs to B, B's single merged return, one wallet that sent its two sums back cut differently, and two returns that came back 0.000001 tokens over pair with nothing.

Who does it? 1,226 of the 1,678 pairs touch an operator address and carry $21.4 billion, with a median leg of $4.7 million; 361 legs of $10 million or more account for $16.2 billion on their own. The other 452 pairs — both ends outside the operator set — carry $0.5 billion with a median leg of $211: people sending a small sum and getting it back. All of it is on TRON; the Ethereum contract shows 89 tiny pairs worth nothing.

By month, the floor has moved with the token's life:

The cut: operator-to-operator. The V2 step above: a transfer whose both ends are in the derived operator set. 51.5% of V0, and 40%–61% across the three volume cuts. This is the number closest to what analytics vendors call "circular", and it is the one that depends on a definition.

The ceiling: same-day pass-through. For every address and every day, take the smaller of what came in and what went out. That is the part of the day's inflow that left the same address the same day — whatever it did next. Summed over the history it is $115.8 billion, 85% of V0; by month it ran between 71% and 90% until July 2026, and 99.1% in August, 98.8% in September. This measure can only overcount: a distributor that receives a mint and pays it on the same day is a pass-through, and so is any honest intermediary. It is a ceiling on how much of the turnover could possibly be the same coins, not a claim that it is.

The twenty addresses with the most pass-through are all in the operator set — the issuer's post-designation distributor at the top with $8.4 billion over 94 days, then the volume hubs, then the vault. 28,308 addresses had at least one pass-through day; 13 addresses carry half of all turnover, 251 carry 90%.

Read together:

Whatever definition a reader prefers, between one sixth and five sixths of the headline figure is coins moving on the same day they arrived, and the slice that looks like people paying people is seven hundredths of one percent. The $136 billion is real; it is just not $136 billion of anything.

4. The vault, August to September

The wallet at the top of the loop holds 40.18 B A7A5 — 87.6% of the rebased supply, about $478 million at par — and was created on 4 May 2026, eighteen days after the Grinex exchange stopped operating. Between 3 August and 22 September it did the same thing on thirty-one separate days: send a round sum to A and get all, or almost all, of it back the same day — usually within the hour, at most within two.

USD at par; 16 of the 31 days shown.

Between 4 and 23 September: 34 transfers, $367 million out, $352 million in. Net, the vault's balance fell by 1.28 billion A7A5 — about $15 million — in small transfers to four addresses that have between two and six lifetime counterparties each and no label anywhere.

A and B are TRON accounts created eleven minutes apart on 25 December 2025 (21:29 and 21:40 UTC). A appears on one side of 13.6% of all TRON A7A5 turnover ever and B on 11.9%; together, counting their transfers to each other once, 19.4% — through 171 and 37 counterparties respectively. The twelve wallets the halves were spread over on 26 August were created in bursts: eight on 4 August 2026 between 10:51 and 12:32 UTC and four on 10 August between 12:53 and 13:26, several of them twelve to eighteen seconds apart (C, the third hub, was created on 4 August at 12:31). They are not throwaway wallets. Each had carried between 24 and 60 A7A5 transfers by 23 September, every one of them with the hub that feeds it — ten have exactly one lifetime counterparty, two have exactly two — and each holds a single raw unit, 0.000001 A7A5, today. None of the sixteen addresses is on any list, none carries a public tag, and our own label database does not know any of them.

That fingerprint — addresses created seconds apart, one counterparty for life, nothing retained, no tag — is what a dedicated wallet set looks like. It is also exactly what an exchange's or a payment processor's deposit-address pool looks like. The chain does not say which, it does not establish a common controller, and we do not claim one. Against ordinary wallet churn this is unusual; "unusual" is as far as the ledger goes.

The pattern was still running while this text was being checked, and it was larger. On 24 September the vault sent 5,000,000,000 tokens — about $59 million at that day's rate — to A at 09:46 UTC; A sent them to B at 11:02, B returned them at 11:20 (8fa84b62…a764a, d5eb21b7…f917a), and A passed them on to C at 11:21. Around that spine, counting only legs of 1,000 tokens or more that touch one of the four hubs between 09:46 and 11:27, B spread the sum over sixteen legs and took sixteen back and C over five and five: 52 transfers, 25 addresses, 39.65 billion tokens, $470 million in the column for a $59 million sum — 7.9 times, against 7.8 on 26 August. Eleven of August's twelve wallets were used again and ten new ones appeared. Our dataset stops at 23 September, so that day is in none of the figures above; and its transfer count depends on where the dust cut sits, while the token multiple does not.

5. What these measures do not prove

This section is the important one.

• A loop is not a crime. Round trips between wallets under one operator can be treasury operations, liquidity rebalancing, tests, settlement of an off-chain ledger, or turnover made to be seen. The ledger shows the amounts and the times; it does not show the reason, and we do not infer one.
• This is not a wash-trading finding. Wash trading is a claim about prices on a venue. There is no venue here and no price; there are transfers. We say the transfers are circular, not that a market was manipulated.
• The floor is a floor. Exact-amount reversal within a day is a strong signal, but a legitimate transfer can also come straight back (a refused delivery, a mistaken send). That is why the composition matters: the non-operator part is $0.5 billion with a $211 median; the operator part is $21.4 billion with a $4.7 million median. And the measure misses every loop through three or more wallets, every split leg, and every sum that comes back re-cut — on 26 August one wallet received 369.5 M and 222.2 M from C and returned 478.2 M and 113.5 M, the same total in different pieces — so it undercounts by construction.
• The ceiling is a ceiling. Pass-through counts the issuer's distributor paying out a mint on the day it arrives, and any exchange or payment intermediary doing its job. It says how much could be circular, not how much is.
• The cut is a parameter. 51.5% becomes 40% or 61% at the other two cuts we tried. We publish all three and do not choose for the reader.
• A route is not an identification. A, B, C and the wallets around them are addresses with a creation time and a transfer history. We do not know who controls them, whether one hand controls all of them, or whether the twelve are a deposit-address pool doing its job; neither does our label database — we checked. Nothing here names a person or a company beyond the official designations.
• Par is a convention. 1 A7A5 = 1 RUB at the central bank's rate of the day. The market price has stayed within a few percent of par; a different rate moves every dollar figure a few percent and no ratio at all.

6. What the other published numbers are counting

Everyone who reads the chain gets the same V0. The dispute is entirely about which transfers to subtract, and that is a definition, not a measurement — which is why we publish three bounds and a ladder instead of one number.

7. The screening gap, re-run today

We took 32 key addresses — the four contracts, both deployers, the vault, the three distributors, the issuer's burner, the Grinex-hack wallet, every OFAC-listed Grinex, Garantex and Old Vector wallet in the data, the three Curve pools and the top holders — and asked three screens, on 3 September and again on 23 September:

Two control rows sit beside the 32: a Lazarus SDN address and Garantex's own 2022 Ethereum wallet. On both dates both came back blocked from all three screens, so the oracle's zero is coverage, not transport: it has the 2022 designations and none of the 2025 ones.

On 23 September the same test found something else, and we were among the parties it caught. The free Chainalysis sanctions oracle (public.chainalysis.com/api/v1/address/{address}) was asked twelve times in a row, seconds apart, about the Lazarus control address 0x098b716b…2f96. Seven answers carried its identifications. Four — at 18:19–18:20 UTC — were an HTTP 200 whose body read {"status":"500","message":"Server Error"} with no identifications key at all. An error, delivered with a success status. Our research screener, and the public script we were about to hand out, had both been storing that body as an empty list, which their verdict rules read as clear: on a bad minute they would have waved the Lazarus wallet through, and in three of our own runs that afternoon they did exactly that for the control before we noticed. (The client inside the ChainHint product treats a body without the array as unavailable; the research code did not.) Both scripts now treat such a body as no answer and retry; the five n/a rows above — three OFAC-listed wallets, the 2022 Garantex Ethereum wallet our own list blocks, and one top holder — are what was left after six tries each. The point is not the vendor's bad minute. It is that a screen which reads "empty" as "clean" turns every provider outage into a clearance, and ours did.

What the gap means in practice: the regulation names an asset, the lists name wallets, and the two do not meet. A wallet holding $478 million at par of a prohibited asset passes every list-based screen. The only check that follows the regulation is a balance and transfer check against the four contract addresses, valued at par — and a look at the contract's own isBlackListed() flag, which is the issuer's freeze and the one signal that says whether a balance can move. And a "clear" from any oracle is only a clear if the response says so explicitly.

8. What changed since 3 September

• The issuer did nothing. No Issue, Burn, Blacklisted, DeBlacklisted or DestroyedBlackFunds event on either chain in twenty days. The Grinex-hack wallet (TXK2UQ…uepy, 374 M A7A5, frozen by the issuer since 16 April) has not moved.
• The vault moved a lot and went almost nowhere (section 4).
• Turnover came back; people did not. August printed $6.4 B of V0 and September to date $4.0 B, after four months under $2.5 B. Exact round trips were 55% of August and 62% of September; pass-through 99%. Human-scale V3 stayed at $2–5 M a month.
• No new designation, delisting or regulator statement named the token; Annex LIII still holds one entry.
• Supply. totalLiquidity() on TRON is 45.85 B A7A5, about $545 M at par (45.52 B and $523 M on 3 September: the dollar figure rose because the ruble did; the supply grew 0.7% by rebase). totalSupply() still prints 38.66 B. The vault holds 40.18 B, 87.6%, down from 90.5%.

9. What we are not claiming

• Holding a prohibited asset is a fact about the asset. No address here is accused of anything. The vault's balance is public and reproducible; its owner is not named because no primary source names one.
• We do not say where the money went. The Grinex-hack wallet's onward trace exists in our product but is not public, so nothing from it is cited. The service labels our graphs carry for TRON counterparties are unverified, and one was wrong (a TRON address labelled as an Ethereum DeFi vault by a substring match); it is being removed.
• Vendor figures are quoted as published, with dates. Where a page could not be opened, we say so and quote only the search snippet.
• Nothing here is legal advice on Article 5ba. The regulation names the asset, not a contract; the mapping to four contracts is ours, sourced in data/labels.csv.
• Everything in section 5 applies.

10. Re-run it

Three scripts are published alongside this article: a7a5_loops.py, which redoes the daily out-and-back arithmetic for any address; a7a5_screen.py, which re-runs the screening table; and a7a5_component.py, which takes the vault's connected component across the whole chain over a window, and is how the 33 was found and shown to be complete. Python 3 standard library, no key and no account, open sources only.

python3 a7a5_loops.py TNnWYcH3Ph4WpH4inLJAfrchN3AoujmtRH 2026-08-01 2026-09-23

Reads the vault's A7A5 transfers from TronGrid and prints, per day, what went out, what came back, the same-day pass-through, and every exact out-and-back pair with both transaction ids. Run on 24 September it printed 109 transfers, 31 days of out-and-back, 15 exact pairs worth 46.2 billion tokens out and back, and 32 pairs worth 96.9 billion once a 0.1% difference is allowed — the token rebases, so a sum sent as 7,000,000,000.000000 often comes back as 6,999,999,999.999997, and the exact rule refuses it. Pass any address and any date range.

python3 a7a5_screen.py

For the 32 addresses (or any you pass) prints today's OFAC list status, the A7A5 balance read from the contract itself, the issuer's isBlackListed() flag, and the date of the check. Set CHAINALYSIS_API_KEY (free registration) to add the oracle column — an error body is printed as unavailable, never as clear.

python3 a7a5_component.py 2026-08-26T14:00 2026-08-26T16:30

Reads every A7A5 Transfer event on TRON in the window — not one wallet's ledger — and takes the vault's connected component by closure. That is how the 33 was found and how it was shown to be complete: from the loop's own 51 minutes to a two-and-a-half-hour window holding 150 chain-wide transfers, the component stays at 16 addresses, 33 transfers, 54.34 billion tokens. Widen the window until the number stops moving before you trust it; on 24 September a dust address bridges the hubs into unrelated traffic within two hours, and the same closure balloons to 73 addresses — an artefact, which is why that day is printed as a cut above.

The full dataset (407,790 transfers, the issuer events, the balance snapshot) and the SQL behind every row of the ladder and the three circularity measures are held in our repository and are not public at the time of writing; an export (code MIT, data CC-BY-4.0) is prepared. Everything in this piece that a reader can check without it — the loop, the daily table, the screen — the three scripts check.

The case page: chainhint.com/cases/a7a5-restricted-asset.