A sovereign coin on a sanctioned network's backbone
Three domains answer from the same pair of Icelandic name servers: Kyrgyzstan's state-issued USDKG token, the sanctioned A7A5 ruble token, and A7's own operator backbone. A fourth, A7A5's Kyrgyz domain, answers from that backbone directly. Every record here was resolved on Aug. 30 and can be checked with one query.
Shared NS pair
3
usdkg.io, a7a5.io, muzpan.com
a7a5.kg name servers
2
both muzpan.com subdomains
Leak messages
18
explicit usdkg references
Months on Google
14
after the shutdown order
USDKG project domain
A7 / A7A5 domain (sanctioned)
A7 operator backbone
Third-party name server
Google (dashed edge)
— Headline findings
USDKG's development domain shares its name servers with the sanctioned A7A5 token and with A7's operator backbone.
A7A5's Kyrgyz domain goes further. Its name servers are subdomains of that backbone. That is a dependency, not a shared provider.
A7's administrator listed usdkg.io among the systems under his control in a February 2025 inventory sent to Ilan Shor. Kyrgyzstan announced the coin as a sovereign project nine months later.
In July 2025 the same administrator ordered usdkg.com taken down. Its Google registration, he wrote, left the operation exposed to American law. It is the sovereign project's website today, mail still running through Google.
The developers called the project Karat USD. Kyrgyzstan has never used the name, and karatusd.com does not resolve.
Key finding: Shared name servers, on their own, would prove only a shared provider. Three things lift this above coincidence. A7's own backbone sits in the same set. A7A5's Kyrgyz domain depends on that backbone directly. And A7 staff are on record provisioning usdkg.io themselves.
Every record was resolved on Aug. 30, 2026 against a public recursive resolver. The four highlighted rows can be checked by any reader with a command line. No credential, no login and no access to the leaked archive is needed.
Mail routing is a weaker second signal. usdkg.io publishes mr.usdkg.io as its mail exchanger; a7a5.io publishes mr1.a7a5.io. The naming convention matches. Convention is not authorship, and it is recorded here as corroboration.
Three things this does not establish. That Kyrgyz officials knew the coin's development infrastructure sat inside A7. That any of them directed it. That money moved between the two projects. Each would need its own evidence.
— Triangulation
The Centre for Information Resilience named muzpan.com and sodkamus.com as mail servers for more than 50 domains in June 2025, working from the outside without the internal files. The Open Source Centre, reporting on this archive a year later, said A7 had explored a second coin and that it was unclear whether the network followed through. The records above settle it. Britain designated A7A5's issuer, USDKG's issuer and A7's administrator on the same day, May 26, 2026.
SOURCE — Frontline Atlas DNS resolution, Aug. 30, 2026; leaked A7 internal message archive, August 2024 to July 2025; U.K. Office of Financial Sanctions Implementation designations, May 26, 2026; Centre for Information Resilience, June 2025; Open Source Centre, June 2026.
NOTE — Evidence levels: E1 directly observed and reproducible. Leak-derived claims are cited to individual messages in the working file and are not reproducible by the reader.
HANDLING — The archive exposes plaintext credentials for several mailboxes in this cluster. Frontline Atlas has not authenticated to any of them.