ZachXBT Accuses Russian OTC Broker Aleks Khinkis of Involvement in $4.7M Ransomware Money Laundering Case

On-chain investigator ZachXBT released a report on March 24 alleging that Russian over-the-counter (OTC) broker Aleksandr (Aleks) Khinkis has laundered over $4.7 million for ransomware groups through a single crypto exchange account since July 2025. The funds are tied to three suspicious ransom payments totaling approximately 796 bitcoins (BTC). Investigators found the funds were bridged between Bitcoin and Avalanche before being sent in 75 batches to Khinkis’ exchange deposit address (0xa756) between July 2025 and March 2026. Additionally, roughly $16.6 million is currently held on Aave and is being gradually cashed out. ZachXBT highlighted key ransom transactions: around September 2025, ~72 BTC in ransom was bridged to the relevant address; in October 2025, ~164 BTC in ransom was converted to ~$3.8 million. Some linked addresses were blacklisted by Tether in November 2025, and frozen USDT was burned three weeks ago—indicating law enforcement and regulatory involvement. A September 2023 transaction also saw the account involved in a ~560 BTC ransom payment. The funds were bridged to the Avalanche network in 2024 after passing through multiple intermediary addresses and exchanges. The investigation notes the BTC source addresses are highly correlated with multiple ransomware addresses, suspected to act as payment relay nodes. While some funds remain dormant, ZachXBT warned they could still be further laundered. He urged victims to report related addresses promptly to freeze funds.