Russian Crypto Broker’s $4.7M Laundering Scheme Exposed by Blockchain Sleuth!

by

Crypto Sleuth Links Russian OTC Desk To $4.7M Laundering

A Russian cryptocurrency broker could face legal consequences due to 73 bitcoins that have been held in a separate digital wallet without any activity.

A hidden stash of cryptocurrency, identified by blockchain researcher ZachXBT, appears to be connected to a complex web of financial activity – including at least three ransomware payments, several online platforms, and a secret discussion on Telegram.

Sting Operation Cracked The Case Open

ZachXBT, a well-known and anonymous researcher who tracks illegal activity in cryptocurrency, has named Aleksandr Khinkis, a Russian broker dealing in over-the-counter trades, as a key person involved in the suspected fraud.

Investigators reportedly contacted Khinkis on Telegram, pretending to be interested in his services. He then supposedly provided them with an address to send funds – a key piece of information that allowed them to track his activity.

Aleksandr Khinkis, a Russian cryptocurrency broker, is accused of helping a ransomware group clean money—over $4.7 million—through a crypto exchange. Authorities believe he’s been doing this since July 2025, processing payments totaling 796 Bitcoin related to three separate ransomware attacks.

— ZachXBT (@zachxbt) March 24, 2026

The investigation centered around a specific digital address, beginning with 0xa756. Researchers used this address to trace approximately 75 transactions, totaling over $4.7 million, all deposited into the same account. These transfers had been occurring since at least July 2025.

Three Ransoms. Three Trails. One Broker

Investigators believe the money laundering involved three ransomware payments, adding up to 796 Bitcoin. Each payment was traceable and left unique clues across various blockchain systems.

The earliest instance occurred in September 2023, involving a ransom of 560 Bitcoin linked to five deposit addresses used for a Bitcoin bridge. These funds were later transferred to the Avalanche network in 2024.

Last month, we contacted Aleks on Telegram, pretending to be a customer who wanted to exchange cryptocurrency from the Avalanche network for traditional money.

He promptly provided his exchange deposit address:
0xa75666786a4e120110418ed3b4865a114d70706e

The conversation was conducted in…

— ZachXBT (@zachxbt) March 24, 2026

Another payment of 72 Bitcoin, identified in September 2025, shared connections with wallets known to be used for ransomware attacks, according to several security checks. Roughly $1.36 million from this payment was quickly exchanged through instant services and then combined into a single wallet on the Tron network.

The biggest recent transaction, worth 164 Bitcoin, happened in October 2025. Reports indicate that approximately $3.8 million in Bitcoin went through quick exchange services before being transferred to addresses associated with the Tron network.

As an analyst, I observed that Tether froze seven Tron addresses linked to a specific transaction flow the following month. They later confirmed enforcement action by permanently removing – or ‘burning’ – those funds from circulation.

Currently, about $16.6 million is still held in connected accounts or on related platforms, and some of that money is already being withdrawn.

Law Enforcement Now Has the Data

ZachXBT has shared comprehensive records of tracked cryptocurrency addresses and fund transfers with both compliance teams and law enforcement. As of now, no arrests related to this information have been made public.

Looking beyond the blockchain information, other publicly available sources revealed more about Khinkis. He appears to travel internationally quite often – visiting places like Southeast Asia and Australia – and frequently shares photos and details of his trips online.

The 73 Bitcoin remaining at the original address haven’t been transferred. Authorities will likely monitor the account closely if any activity occurs.

Read More

2026-03-26 00:12