Crypto Sleuth Links Russian OTC Desk To $4.7M Laundering

bitcoinistPublished on 2026-03-25Last updated on 2026-03-25

Abstract

ZachXBT, an anonymous blockchain investigator, has identified Russian OTC broker Aleksandr Khinkis as the central figure in a money laundering scheme involving over $4.7 million from three separate ransomware payments totaling 796 BTC. The investigation, which included an undercover Telegram conversation, revealed that Khinkis provided an exchange deposit address that became the anchor for tracing the illicit flows. The funds moved through multiple networks, including Bitcoin, Avalanche, and Tron, with some addresses later frozen by Tether. A dormant 73-BTC wallet remains under watch. Law enforcement has received the detailed transaction records, though no arrests have been announced.

A 73-bitcoin stash sitting untouched in a separate crypto wallet may be what eventually brings a Russian crypto broker to justice.

That dormant pile of digital cash, flagged by blockchain investigator ZachXBT, sits at the edge of a much larger money trail — one that reportedly spans three ransomware payments, multiple networks, and at least one undercover Telegram conversation.

Sting Operation Cracked The Case Open

ZachXBT, an anonymous on-chain investigator with a long record of tracing illicit crypto flows, identified Russian OTC broker Aleksandr Khinkis as the central figure in the alleged scheme.

According to reports, investigators posed as potential clients and contacted Khinkis directly through Telegram. He allegedly handed over an exchange deposit address — a move that gave investigators the thread they needed to pull.

That single address, starting with 0xa756, became the anchor point for the entire investigation. From it, researchers tracked roughly 75 transfers funneling more than $4.7 million into the same account. The money had been moving since at least July 2025.

Three Ransoms. Three Trails. One Broker

The alleged laundering involved three separate ransomware payments totaling 796 BTC. Each left a distinct footprint across multiple blockchain networks.

The oldest case dates back to September 2023, when five Bitcoin bridge deposit addresses were tied to a 560 BTC ransom. Those funds eventually crossed into the Avalanche network sometime in 2024.

A second payment of 72 BTC, traced to September 2025, showed more than 15% overlap with known ransomware wallets across compliance screening tools. About $1.36 million from that batch moved through instant exchanges before consolidating into a Tron wallet.

The most recent and largest payment — 164 BTC — was recorded in October 2025. Based on reports, around $3.8 million in bitcoin passed through instant exchanges before reaching Tron-linked outputs.

Bitcoin is now trading at $71,701. Chart: TradingView

Seven Tron addresses connected to that flow were frozen by Tether the following month. The frozen funds were later burned, confirming that enforcement action had been taken.

Meanwhile, an additional $16.6 million remains sitting in related addresses or platforms, with some of it already being cashed out.

Law Enforcement Now Has the Data

ZachXBT confirmed that compliance teams and law enforcement agencies have received detailed records of the traced addresses and fund movements. No arrests have been publicly announced.

Beyond the blockchain data, open-source intelligence painted a clearer picture of Khinkis as a person. Reports indicate he travels outside Russia regularly — including trips to Southeast Asia and Australia — and documents those trips openly on social media.

The 73 BTC still sitting dormant at a separate address hasn’t moved. If and when it does, investigators will almost certainly be watching.

Featured image from Pexels, chart from TradingView

Related Questions

QWho is the central figure identified in the alleged money laundering scheme, and what is his profession?

AThe central figure is Aleksandr Khinkis, a Russian OTC broker.

QWhat was the total amount of money laundered through the single crypto exchange account, and how many Bitcoin did the three ransomware payments total?

AMore than $4.7 million was laundered through the account, and the three ransomware payments totaled 796 BTC.

QWhat crucial piece of evidence did the undercover investigators obtain from Aleksandr Khinkis on Telegram?

AThe investigators obtained his exchange deposit address (0xa756...), which became the anchor point for the entire investigation.

QWhat action did Tether take regarding the seven Tron addresses connected to the most recent ransom payment?

ATether froze the funds in the seven Tron addresses, and the frozen funds were later burned.

QWhat significant amount of cryptocurrency remains untouched and is being monitored by investigators?

AA stash of 73 Bitcoin sitting in a separate wallet remains dormant and is being watched by investigators.

Related Reads

Programmers Worldwide Are Wasting Money on Anthropic! The Company Can't Stand It Anymore

Anthropic recently published guidelines to help developers using Claude Code reduce unnecessary token costs. The key recommendations include: 1) Clear (/clear) conversations after completing a task to avoid carrying irrelevant file reads and command outputs into the next task. 2) Set the model and reasoning effort level at the start of a session, as switching mid-session invalidates the prompt cache, requiring a full-price recalculation of the entire dialog history. 3) Attach files using @ references instead of typing paths manually to avoid extra tool calls and searches that bloat the context. 4) Add quiet flags to verbose commands (e.g., in CLAUDE.md) to minimize lengthy output in the dialog history. 5) Use /compact while the session cache is still warm (before breaks) to compress the dialog at one-tenth the cost. 6) Offload large-output tasks to a sub-agent, which runs in an isolated context and only returns conclusions, preventing intermediate outputs from polluting the main dialog. The article explains token pricing: input tokens (prefill) are processed in parallel, while output tokens (decode) are generated serially, making output tokens five times more expensive. Caching is crucial for savings—if a request's prefix (system prompt, CLAUDE.md, dialog history) matches the previous one byte-for-byte, reading it costs only 10% of the standard input price. However, cache invalidation occurs when changing models, effort levels, fast mode, compressing dialogs, after cache expiration, or when resuming old sessions. Dialog history also grows quadratically (O(n²)) as file contents and command outputs accumulate, increasing costs per round. Proactive context management—like isolating noisy tasks, using /rewind to trim unproductive turns, and task-based session clearing—is becoming an essential skill for cost-effective AI-assisted development.

marsbit1h ago

Programmers Worldwide Are Wasting Money on Anthropic! The Company Can't Stand It Anymore

marsbit1h ago

Pax Silica vs. WAICO: The US Wants to Prohibit Europe from Using Chinese Artificial Intelligence

The United States is preparing to demand that European and other partners abandon Chinese artificial intelligence initiatives, threatening exclusion from the American-led "Pax Silica" coalition, according to a leaked U.S. State Department document. This ultimatum forces signatories of the "AI Opportunity Statement" to choose between the Western technological ecosystem and alternative frameworks, with China not explicitly named but clearly targeted. Pax Silica is a U.S. strategy for AI and semiconductor hegemony, launched in late 2025. Its European presence expanded significantly in mid-2026. Concurrently, China, Russia, and 27 other nations established the World AI Cooperation Organization (WAICO) in July 2026 as an independent intergovernmental platform promoting AI governance based on UN principles. This situation creates a difficult choice, especially for European nations balancing strategic autonomy with dependence on U.S. tech and security. It also pressures Global South countries with pragmatic ties to both Washington and Beijing. The formation of competing blocks risks fragmenting the global tech landscape, forcing companies to split supply chains, increasing costs, and potentially leading to incompatible standards and protocols. The era of open globalization in AI may be ending, replaced by geopolitical confrontation where technological sovereignty trumps economic efficiency. The decisions made will shape the global digital economy for decades.

cryptonews.ru3h ago

Pax Silica vs. WAICO: The US Wants to Prohibit Europe from Using Chinese Artificial Intelligence

cryptonews.ru3h ago

Paul Tudor Jones' Bet on BlackRock's Bitcoin ETF Reaches $22.9 Million

Tudor Investment Corp, a macro hedge fund founded by Paul Tudor Jones, disclosed owning 688,529 shares of the BlackRock iShares Bitcoin Trust (IBIT) in its latest 13F filing. As of June 30, the stake was valued at $22.9 million, marking an 18.9% increase from the previous quarter. This positions Jones among traditional asset managers increasingly using spot Bitcoin ETFs for crypto exposure. With Tudor managing approximately $106 billion, the IBIT investment remains a small portion of its overall portfolio. A long-time Bitcoin advocate, Jones has consistently framed the asset as an inflation hedge rather than a speculative trade. His recent shift from Bitcoin futures to a direct, growing stake in a regulated spot ETF reflects both Bitcoin's mainstream adoption and his preference for traditional investment structures. IBIT, commanding about 49% of the U.S. spot Bitcoin ETF market, remains the dominant institutional vehicle. While not a major bet for a fund of Tudor's size, Jones's steady quarterly increases signal Bitcoin is evolving from a symbolic holding to a permanent portfolio fixture. The market will watch the next 13F filings in mid-November to gauge the sustainability of this trend and the conviction behind his longstanding bullish stance.

cryptonews.ru4h ago

Paul Tudor Jones' Bet on BlackRock's Bitcoin ETF Reaches $22.9 Million

cryptonews.ru4h ago

Robert Kiyosaki Shares His Mentor's Predictions About the Emergence of Bitcoin and AI

American entrepreneur and author of "Rich Dad Poor Dad," Robert Kiyosaki, discussed the influence of futurist R. Buckminster Fuller on his worldview, linking Fuller's past technological predictions to the emergence of Bitcoin and the development of artificial intelligence. In an X post, Kiyosaki also reflected on personal purpose, sharing his journey from the music business—where he worked with bands like The Police and Iron Maiden—to creating the "Cashflow" board game and writing his famous book. He described feeling an inner emptiness despite his success, a turning point that came after meeting Fuller, whom he studied with for three summers. Kiyosaki described Fuller as a "friendly genius" who foresaw world-changing developments like Bitcoin and AI. However, the core of his post focused on Fuller's philosophical impact, particularly a quote about belonging to the universe and finding purpose by dedicating one's life to the maximum benefit of others. The entrepreneur remains a vocal advocate for cryptocurrencies. He regularly advises buying Bitcoin during market panics, viewing it and assets like Ethereum, gold, and silver as hedges against traditional financial system failures. Kiyosaki has predicted a major market crash by 2026, seeing it as an opportunity for prepared investors, with long-term price targets including $750,000 for Bitcoin and $95,000 for Ethereum.

cryptonews.ru4h ago

Robert Kiyosaki Shares His Mentor's Predictions About the Emergence of Bitcoin and AI

cryptonews.ru4h ago

Etherealize CEO Calls Wall Street's Private Blockchains a 'Race to the Bottom'

Etherealize co-founder and CEO Vivek Raman criticized Wall Street's growing interest in private, permissioned blockchains, calling them a "race to the bottom." In an interview with CoinDesk, Raman argued that consortium networks fragment liquidity and return the industry to the siloed systems that blockchain technology was meant to overcome. He stated that closed networks do not interoperate, undermining two key advantages of the technology: system compatibility and liquidity concentration. Etherealize promotes Ethereum as an open, foundational layer for institutional players. Raman insists that privacy and access restrictions should be built on top of public infrastructure—at the application or L2 level—rather than creating separate, closed networks. He compared Ethereum to HTTP as a base layer, with additional permissioned and private layers akin to HTTPS. Examples of this new wave of "closed" solutions mentioned include Canton Network from Digital Asset, Circle's Arc project, and Stripe's Tempo. Raman termed this trend "consortium chains 2.0," recalling earlier initiatives like the R3 interbank consortium and the Hyperledger corporate ecosystem from 2016 that failed to gain significant traction. He reiterated his firm belief that a global, open, permissionless infrastructure is necessary as a foundational base layer. Raman previously noted in June that traditional financial institutions had begun implementing Ethereum-based solutions into real business processes.

cryptonews.ru5h ago

Etherealize CEO Calls Wall Street's Private Blockchains a 'Race to the Bottom'

cryptonews.ru5h ago

Trading

Spot
活动图片