A stash of 73 bitcoins sitting untouched in a separate crypto wallet may be what finally leads to a Russian cryptocurrency broker being brought to justice.
That sleeping pile of digital money, It has been marked By blockchain investigator ZachXBT, it sits on the edge of a much larger money trail — one that reportedly spans three ransomware payments, multiple networks, and at least one secret Telegram chat.
Sting’s operation led to the case being opened
ZachXBT, an anonymous on-chain investigator with a long track record of tracking illicit cryptocurrency flows, identified a Russian OTC broker. Alexander Khinkis As the central figure in the alleged scheme.
According to reports, investigators posed as potential clients and contacted Khinkis directly via Telegram. He allegedly handed over the exchange’s deposit address — a move that gave investigators the thread they needed to pull.
1/ Meet Alexander (Alex) Khinkis, a Russian OTC broker who allegedly helped a ransomware group launder over $4.7 million USD through a single cryptocurrency exchange account since July 2025, via three suspected ransom payments totaling 796 BTC. pic.twitter.com/GpOjAvtaAd
– ZackXPT (@ZackXPT) March 24, 2026
This single address, starting with 0xa756, became the anchor point for the entire investigation. Through it, researchers tracked nearly 75 transfers that transferred more than $4.7 million to the same account. The money has been moving since at least July 2025.
Three ransom. Three tracks. One broker
The alleged laundering involved three separate ransomware payments totaling 796 bitcoins. Each has left a distinct footprint across multiple blockchain networks.
The oldest case dates back to September 2023, when there were five cases Bitcoin Bridge deposit addresses were linked to a ransom of 560 bitcoins. These funds eventually cross over to Avalanche Network sometime in 2024.
2/ Last month we reached out to Aleks via a Telegram account posing as a potential client looking to convert crypto assets on Avalanche into fiat currencies.
He immediately provided his exchange deposit address:
0xa75666786a4e120110418ed3b4865a114d70706eThe conversation took place in… pic.twitter.com/zt827Du3Ow
– ZackXPT (@ZackXPT) March 24, 2026
The second batch of 72 BTC, traced back to September 2025, showed over 15% overlap with known ransomware wallets via compliance scanning tools. About $1.36 million of that payment was transferred across spot exchanges before being integrated into the Tron wallet.
The most recent and largest batch – 164 bitcoins – was recorded in October 2025. Based on reports, around $3.8 million worth of bitcoin passed through spot exchanges before reaching the output associated with Tron.
Seven TRON addresses connected to this stream were frozen by Tether the following month. The frozen funds were later burned, confirming that executive action had been taken.
Meanwhile, an additional $16.6 million is still sitting in relevant titles or platforms, with some of it already disbursed.
Law enforcement now has the data
ZachXBT confirmed that compliance teams and law enforcement agencies received detailed logs of addresses tracked and money movements. No arrests have been announced publicly.
Beyond blockchain data, open source intelligence has painted a clearer picture of Khinkis as a person. Reports indicate that he travels outside Russia regularly — including trips to Southeast Asia and Australia — and documents those trips openly on social media.
73 BTC are still idle in a separate address and have not been transferred. If and when that happens, investigators will certainly be watching.
Featured image from Pexels, chart from TradingView
Editing process Bitcoinist focuses on providing well-researched, accurate, and unbiased content. We adhere to strict sourcing standards, and every page is carefully reviewed by our team of senior technology experts and experienced editors. This process ensures the integrity, relevance, and value of our content to our readers.
