Crypto Sleuth Links Russian OTC Desk To $4.7M Laundering
A 73-bitcoin stash sitting untouched in a separate crypto pockets could also be what finally brings a Russian crypto dealer to justice.
That dormant pile of digital money, flagged by blockchain investigator ZachXBT, sits on the fringe of a a lot bigger cash path — one which reportedly spans three ransomware funds, a number of networks, and not less than one undercover Telegram dialog.
Sting Operation Cracked The Case Open
ZachXBT, an nameless on-chain investigator with an extended report of tracing illicit crypto flows, recognized Russian OTC dealer Aleksandr Khinkis because the central determine within the alleged scheme.
According to stories, investigators posed as potential shoppers and contacted Khinkis instantly by way of Telegram. He allegedly handed over an change deposit tackle — a transfer that gave investigators the thread they wanted to tug.
1/ Meet Aleksandr (Aleks) Khinkis, a Russian OTC dealer who has allegedly helped a ransomware group launder $4.7M+ by way of a single crypto change account since July 2025, throughout three suspected ransom funds totaling 796 BTC. pic.twitter.com/GpOjAvtaAd
— ZachXBT (@zachxbt) March 24, 2026
That single tackle, beginning with 0xa756, turned the anchor level for your entire investigation. From it, researchers tracked roughly 75 transfers funneling greater than $4.7 million into the identical account. The cash had been transferring since not less than July 2025.
Three Ransoms. Three Trails. One Broker
The alleged laundering concerned three separate ransomware funds totaling 796 BTC. Each left a definite footprint throughout a number of blockchain networks.
The oldest case dates again to September 2023, when 5 Bitcoin bridge deposit addresses had been tied to a 560 BTC ransom. Those funds finally crossed into the Avalanche community someday in 2024.
2/ Last month we reached out to Aleks by way of a Telegram account posing as a possible shopper seeking to convert crypto property on Avalanche to fiat.
He promptly offered his change deposit tackle:
0xa75666786a4e120110418ed3b4865a114d70706eThe dialog was carried out in… pic.twitter.com/zt827Du3Ow
— ZachXBT (@zachxbt) March 24, 2026
A second fee of 72 BTC, traced to September 2025, confirmed greater than 15% overlap with recognized ransomware wallets throughout compliance screening instruments. About $1.36 million from that batch moved by way of instantaneous exchanges earlier than consolidating right into a Tron pockets.
The most up-to-date and largest fee — 164 BTC — was recorded in October 2025. Based on stories, round $3.8 million in bitcoin handed by way of instantaneous exchanges earlier than reaching Tron-linked outputs.
Seven Tron addresses related to that stream had been frozen by Tether the next month. The frozen funds had been later burned, confirming that enforcement motion had been taken.
Meanwhile, a further $16.6 million stays sitting in associated addresses or platforms, with a few of it already being cashed out.
Law Enforcement Now Has the Data
ZachXBT confirmed that compliance groups and regulation enforcement businesses have obtained detailed information of the traced addresses and fund actions. No arrests have been publicly introduced.
Beyond the blockchain information, open-source intelligence painted a clearer image of Khinkis as an individual. Reports point out he travels outdoors Russia recurrently — together with journeys to Southeast Asia and Australia — and paperwork these journeys brazenly on social media.
The 73 BTC nonetheless sitting dormant at a separate tackle hasn’t moved. If and when it does, investigators will nearly definitely be watching.
Featured picture from Pexels, chart from TradingView
