ZachXBT accuses Russian OTC broker Aleks Khinkis of being involved in a $4.7 million ransomware money laundering case

Well-known on-chain investigator ZachXBT today released an investigation claiming that a Russian over-the-counter (OTC) broker named Aleksandr (Aleks) Khinkis is suspected of assisting ransomware groups in laundering over $4.7 million since 2025 through a single cryptocurrency trading platform account.

The related funds involve three suspicious ransom payments, totaling approximately 796 bitcoins (BTC). The investigation shows that these funds were transferred in batches to his trading platform's deposit address (0xa756) after being bridged between Bitcoin and Avalanche, completing a total of 75 transactions from 2025 to 2026. Additionally, approximately $16.6 million is currently still held in Aave and is being gradually liquidated.

ZachXBT pointed out multiple ransom transactions: a ransom payment of about 72 BTC in September 2025 was bridged to the relevant address; a ransom of about 164 BTC was also discovered in October 2025 and converted to approximately $3.8 million. Some related addresses were blacklisted by Tether in November 2025, and the subsequently frozen USDT was destroyed three weeks ago, indicating that law enforcement and compliance agencies have intervened.

Earlier in 2023, this account was also involved in a ransom transaction of about 560 BTC, which flowed through multiple intermediary addresses and various trading platforms before being bridged back to the Avalanche network in 2024. Furthermore, the investigation noted that the source addresses of the relevant bitcoins have a high correlation with multiple ransomware addresses, suspected to serve as payment transit nodes. Although some funds remain dormant, ZachXBT warned that they may still be laundered in the future and urged victims to report relevant addresses promptly to freeze the funds.