A significant cryptocurrency wallet containing 73 Bitcoin, seemingly untouched, might be pivotal in an ongoing investigation against a Russian crypto broker.
This inactive digital fortune, highlighted by blockchain analyst ZachXBT, is connected to a more complex network involving various illicit activities, including multiple ransomware transactions and even clandestine chats on Telegram.
Undercover Operations Spark Investigations
ZachXBT, known for his expertise in tracing dubious cryptocurrency transactions, pinpointed Aleksandr Khinkis, a prominent OTC broker, as a person of interest in these activities.
Reports indicate that investigators masqueraded as prospective clients and initiated contact with Khinkis via Telegram. During the interactions, he allegedly disclosed an exchange deposit address, a crucial clue that helped investigators connect the dots.
1/ Introducing Aleksandr (Aleks) Khinkis, an OTC broker believed to have facilitated the laundering of over $4.7 million through a single crypto exchange since July 2025, relating to three suspected ransom payments totaling 796 BTC. pic.twitter.com/GpOjAvtaAd
— ZachXBT (@zachxbt) March 24, 2026
The specific address, starting with 0xa756, became the key element in the investigation. Researchers traced approximately 75 transactions, leading to the detection of over $4.7 million flowing into a single account, starting as early as July 2025.
The Web of Ransoms: A Broker’s Dilemma
The alleged money laundering involved three different ransomware payments amounting to 796 BTC. Each payment displayed unique characteristics across various blockchain platforms.
The initial case, traced back to September 2023, involved five Bitcoin bridge deposit addresses associated with a ransom of 560 BTC. These funds eventually migrated to the Avalanche network in 2024.
2/ We reached out to Aleks through a Telegram account pretending to be a potential client wanting to convert crypto assets on Avalanche to fiat.
He quickly provided an exchange deposit address:
0xa75666786a4e120110418ed3b4865a114d70706eThe conversation was documented in… pic.twitter.com/zt827Du3Ow
— ZachXBT (@zachxbt) March 24, 2026
A second ransom payment, containing 72 BTC traced to September 2025, showed significant overlap with known ransomware wallets identified through compliance tools. This batch, amounting to $1.36 million, was funneled through quick exchanges before amalgamating into a Tron wallet.
The most recent and significant payment, accumulating 164 BTC, surfaced in October 2025. Findings indicated that around $3.8 million in Bitcoin cycled through various instant exchanges before reaching Tron-related outputs.
In the following month, seven linked Tron addresses were frozen by Tether, and subsequently, the funds were burned, demonstrating enforcement action was applied.
As the investigation continues, an additional $16.6 million remains dormant in various related wallets and platforms, with some funds already converted into cash.
Law Enforcement Steps In
ZachXBT confirmed that comprehensive records detailing the traced addresses and transactions have been shared with law enforcement agencies and compliance teams. As of now, no arrests have been publicly reported.
In addition to blockchain analytics, open-source intelligence provided a broader picture of Khinkis. Reports suggest he frequently travels outside of Russia, visiting places such as Southeast Asia and Australia, and shares his journeys openly on social media.
The 73 BTC sitting in the separate dormant address has not been moved. Should any activity occur, investigators are sure to be closely monitoring the situation.
Image credit: Pexels; Chart source: TradingView
