{"id":55798,"date":"2026-03-25T22:01:50","date_gmt":"2026-03-25T22:01:50","guid":{"rendered":"https:\/\/www.bitrabo.com\/discover\/?p=55798"},"modified":"2026-03-25T22:01:50","modified_gmt":"2026-03-25T22:01:50","slug":"russian-otc-desk-tied-to-4-7m-crypto-laundering-scandal","status":"publish","type":"post","link":"https:\/\/www.bitrabo.com\/discover\/russian-otc-desk-tied-to-4-7m-crypto-laundering-scandal\/","title":{"rendered":"Russian OTC Desk Tied to $4.7M Crypto Laundering Scandal"},"content":{"rendered":"\n

A significant cryptocurrency wallet containing 73 Bitcoin, seemingly untouched, might be pivotal in an ongoing investigation against a Russian crypto broker.<\/p>\n

This inactive digital fortune, highlighted by blockchain analyst ZachXBT<\/a>, is connected to a more complex network involving various illicit activities, including multiple ransomware transactions and even clandestine chats on Telegram.<\/p>\n

<\/span>Undercover Operations Spark Investigations<\/span><\/h2>\n

ZachXBT, known for his expertise in tracing dubious cryptocurrency transactions, pinpointed Aleksandr Khinkis<\/a>, a prominent OTC broker, as a person of interest in these activities.<\/p>\n

Reports indicate that investigators masqueraded as prospective clients and initiated contact with Khinkis via Telegram. During the interactions, he allegedly disclosed an exchange deposit address, a crucial clue that helped investigators connect the dots.<\/p>\n

\n

1\/ Introducing Aleksandr (Aleks) Khinkis, an OTC broker believed to have facilitated the laundering of over $4.7 million through a single crypto exchange since July 2025, relating to three suspected ransom payments totaling 796 BTC. pic.twitter.com\/GpOjAvtaAd<\/a><\/p>\n

\u2014 ZachXBT (@zachxbt) March 24, 2026<\/a><\/p>\n<\/blockquote>\n

The specific address, starting with 0xa756, became the key element in the investigation. Researchers traced approximately 75 transactions, leading to the detection of over $4.7 million flowing into a single account, starting as early as July 2025.<\/p>\n

<\/span>The Web of Ransoms: A Broker’s Dilemma<\/span><\/h2>\n

The alleged money laundering involved three different ransomware payments amounting to 796 BTC. Each payment displayed unique characteristics across various blockchain platforms.<\/p>\n

The initial case, traced back to September 2023, involved five Bitcoin<\/a> bridge deposit addresses associated with a ransom of 560 BTC. These funds eventually migrated to the Avalanche network in 2024.<\/p>\n

\n

2\/ We reached out to Aleks through a Telegram account pretending to be a potential client wanting to convert crypto assets on Avalanche to fiat.<\/p>\n

He quickly provided an exchange deposit address:
\n0xa75666786a4e120110418ed3b4865a114d70706e<\/p>\n

The conversation was documented in\u2026 pic.twitter.com\/zt827Du3Ow<\/a><\/p>\n

\u2014 ZachXBT (@zachxbt) March 24, 2026<\/a><\/p>\n<\/blockquote>\n

A second ransom payment, containing 72 BTC traced to September 2025, showed significant overlap with known ransomware wallets identified through compliance tools. This batch, amounting to $1.36 million, was funneled through quick exchanges before amalgamating into a Tron wallet.<\/p>\n

The most recent and significant payment, accumulating 164 BTC, surfaced in October 2025. Findings indicated that around $3.8 million in Bitcoin cycled through various instant exchanges before reaching Tron-related outputs.<\/p>\n

<\/p>\n

In the following month, seven linked Tron addresses were frozen by Tether, and subsequently, the funds were burned, demonstrating enforcement action was applied.<\/p>\n

As the investigation continues, an additional $16.6 million remains dormant in various related wallets and platforms, with some funds already converted into cash.<\/p>\n

<\/span>Law Enforcement Steps In<\/span><\/h2>\n

ZachXBT confirmed that comprehensive records detailing the traced addresses and transactions have been shared with law enforcement agencies and compliance teams. As of now, no arrests have been publicly reported.<\/p>\n

In addition to blockchain analytics, open-source intelligence provided a broader picture of Khinkis. Reports suggest he frequently travels outside of Russia, visiting places such as Southeast Asia and Australia, and shares his journeys openly on social media.<\/p>\n

The 73 BTC sitting in the separate dormant address has not been moved. Should any activity occur, investigators are sure to be closely monitoring the situation.<\/p>\n

Image credit: Pexels; Chart source: TradingView<\/em><\/p>\n