Russian Broker Aleksandr Khinkis Allegedly Laundered $4.7M For Ransomware Groups

By Onyi | Edited By Ammar Raza,March 25, 2026, 4:30 PM

A Russian broker named Aleksandr “Aleks” Khinkis is accused of helping a ransomware group launder over $4.7 million.

Since July 2025, investigators say Aleks moved three ransom payments’ funds, which were about 796 BTC, using one crypto exchange account. The transactions involved Bitcoin, and it was converted into Avalanche tokens.

According to a forensic graph shared by ZachXBT, about 75 transfers from July 2025 to March 2026, totaling more than $4.7 million, were sent to the suspect’s exchange account. Another $16.6 million is currently deposited in Aave, though it is regularly withdrawn.

Source: ZachXBT (X)

How Aleks Funneled Ransom Money In His Exchange Accounts 

In October 2025, Aleks’ account received about six different Bitcoin bridge deposits from a number of wallet addresses.

These addresses are said to be linked to a suspected 164 BTC ransom payment that was made on the 10th of October, 2025. The funds were quickly moved to instant exchanges and bridges, suggesting laundering activity.

About $3.8 million worth of Bitcoin from the transaction was further swapped via one of the instant exchanges. The analysts were able to track the date the transaction was made on Tron, and seven of those Tron addresses were later blacklisted by Tether in November 2025. Three weeks ago, the frozen USDT on these addresses was burned.

Also Read: Cryptocurrency Scam Hits Retired Hong Kong Woman, Causing 6.6 Million Yuan Loss

Also in September 2025, Aleks’ account was traced to four Bitcoin bridge addresses tied to a suspected 72 BTC ransom payment from September 2, 2025. One of the addresses sending funds had over 15% exposure to other ransomware addresses, which would mean that it may have acted as a payment processor. 

Going further back, Aleks’ account could also be linked to five Bitcoin bridge addresses from a September 19, 2023 ransom of 560 BTC. These funds moved through multiple exchanges and services before they were finally bridged from Bitcoin to Avalanche in 2024.

Aleks’ Personal Life and Exposure

The report recorded that he traveled frequently outside Russia, mainly to Southeast Asia and Australia. His personal information has appeared in multiple data breaches, and he shares his travels openly on social media.

Also Read: Key Suspect in Ledger Co-Founder Kidnapping Case Nabbed in Spain