A 73-bitcoin stash sitting untouched in a separate crypto pockets could also be what ultimately brings a Russian crypto dealer to justice.
That dormant pile of digital money, flagged by blockchain investigator ZachXBT, sits on the fringe of a a lot bigger cash path — one which reportedly spans three ransomware funds, a number of networks, and not less than one undercover Telegram dialog.
Sting Operation Cracked The Case Open
ZachXBT, an nameless on-chain investigator with a protracted report of tracing illicit crypto flows, recognized Russian OTC dealer Aleksandr Khinkis because the central determine within the alleged scheme.
Based on reviews, investigators posed as potential shoppers and contacted Khinkis straight by way of Telegram. He allegedly handed over an alternate deposit tackle — a transfer that gave investigators the thread they wanted to drag.
1/ Meet Aleksandr (Aleks) Khinkis, a Russian OTC dealer who has allegedly helped a ransomware group launder $4.7M+ by way of a single crypto alternate account since July 2025, throughout three suspected ransom funds totaling 796 BTC. pic.twitter.com/GpOjAvtaAd
— ZachXBT (@zachxbt) March 24, 2026
That single tackle, beginning with 0xa756, turned the anchor level for the whole investigation. From it, researchers tracked roughly 75 transfers funneling greater than $4.7 million into the identical account. The cash had been transferring since not less than July 2025.
Three Ransoms. Three Trails. One Dealer
The alleged laundering concerned three separate ransomware funds totaling 796 BTC. Every left a definite footprint throughout a number of blockchain networks.
The oldest case dates again to September 2023, when 5 Bitcoin bridge deposit addresses had been tied to a 560 BTC ransom. These funds ultimately crossed into the Avalanche community someday in 2024.
2/ Final month we reached out to Aleks by way of a Telegram account posing as a possible shopper trying to convert crypto belongings on Avalanche to fiat.
He promptly supplied his alternate deposit tackle:
0xa75666786a4e120110418ed3b4865a114d70706eThe dialog was carried out in… pic.twitter.com/zt827Du3Ow
— ZachXBT (@zachxbt) March 24, 2026
A second fee of 72 BTC, traced to September 2025, confirmed greater than 15% overlap with identified ransomware wallets throughout compliance screening instruments. About $1.36 million from that batch moved by way of immediate exchanges earlier than consolidating right into a Tron pockets.
The newest and largest fee — 164 BTC — was recorded in October 2025. Primarily based on reviews, round $3.8 million in bitcoin handed by way of immediate exchanges earlier than reaching Tron-linked outputs.
Seven Tron addresses linked to that move had been frozen by Tether the next month. The frozen funds had been later burned, confirming that enforcement motion had been taken.
In the meantime, an extra $16.6 million stays sitting in associated addresses or platforms, with a few of it already being cashed out.
Legislation Enforcement Now Has the Knowledge
ZachXBT confirmed that compliance groups and regulation enforcement businesses have acquired detailed data of the traced addresses and fund actions. No arrests have been publicly introduced.
Past the blockchain information, open-source intelligence painted a clearer image of Khinkis as an individual. Reviews point out that he travels outdoors Russia commonly — together with journeys to Southeast Asia and Australia — and paperwork these journeys brazenly on social media.
The 73 BTC nonetheless sitting dormant at a separate tackle has not been moved. If and when it does, investigators will nearly definitely be watching.
Featured picture from Pexels, chart from TradingView
Editorial Course of for bitcoinist is centered on delivering totally researched, correct, and unbiased content material. We uphold strict sourcing requirements, and every web page undergoes diligent overview by our staff of prime know-how specialists and seasoned editors. This course of ensures the integrity, relevance, and worth of our content material for our readers.
