ZachXBT Exposes Russian OTC Broker in $4.7M Crypto Laundering Scheme

Blockchain investigator ZachXBT has publicly identified Russian over-the-counter crypto broker Aleksandr Khinkis, alleging he laundered more than $4.7 million in cryptocurrency tied to ransomware payments. The investigation covered activity between July 2025 and March 2026, all traced back to a single exchange account.

The case centers on three suspected ransomware payments totaling 796 BTC. To uncover the scheme, ZachXBT's team contacted Khinkis on Telegram while posing as a potential client. Khinkis allegedly shared an exchange deposit address starting with "0xa756," which became the critical link in mapping the entire crypto flow. From that address, investigators identified roughly 75 transfers funneling over $4.7 million through Bitcoin, Avalanche, and Tron networks. An additional $16.6 million remains tied to related addresses, with some funds still being actively converted to fiat.

The laundering process reportedly moved Bitcoin through cross-chain bridges into Avalanche, then onward to Tron wallets. Timing analysis was used to connect Bitcoin outflows directly to Tron wallet outputs associated with the same operation.

The largest transaction traced was a 164 BTC ransom payment from October 2025, with around $3.8 million passing through instant exchanges. Seven Tron wallet addresses connected to that payment were later blacklisted by Tether, and the frozen USDT was subsequently burned. A second payment of 72 BTC from September 2025 showed over 15% overlap with known ransomware-flagged entities in compliance databases. The earliest linked case involved a 560 BTC payment from 2023, with funds eventually bridged into Avalanche throughout 2024.

Beyond on-chain data, open-source intelligence revealed that Khinkis travels frequently — including trips to Southeast Asia and Australia — and his personal information appears across multiple data breach records. ZachXBT confirmed that law enforcement agencies and compliance teams have received the full findings. Meanwhile, 73 BTC linked to the cluster remains dormant in a separate wallet.