Russian broker Aleksandr “Aleks” Khinkis is accused of laundering over $4.7 million for ransomware groups since July 2025. Investigators linked his exchange account to 75 transfers from three separate ransom payments totaling 796 Bitcoin. Blockchain analyst ZachXBT shared forensic data showing the funds were moved through instant exchanges and bridges, with an additional $16.6 million currently deposited in Aave.
Investigators allege Aleksandr “Aleks” Khinkis moved 796 Bitcoin across three ransom payments using one crypto exchange account since July 2025. The transactions involved Bitcoin that was converted into Avalanche tokens.
According to a forensic graph, about 75 transfers totaling over $4.7 million were sent to the suspect’s account from July 2025 to March 2026. Another $16.6 million is currently deposited in Aave, though it is regularly withdrawn.
The account received Bitcoin bridge deposits in October 2025 from addresses linked to a suspected 164 BTC ransom payment. These funds were quickly moved to instant exchanges and bridges, suggesting laundering activity.
About $3.8 million worth of Bitcoin was swapped via an instant exchange, with tracking revealing related Tron addresses. Seven of those Tron addresses were later blacklisted by Tether in November 2025, and the frozen USDT was burned three weeks ago.
His account was also traced to addresses tied to a suspected 72 BTC ransom from September 2, 2025. One sending address had over 15% exposure to other ransomware addresses, indicating it may have acted as a payment processor.
Aleks’ account could be linked to five Bitcoin bridge addresses from a September 2023 ransom of 560 BTC. These funds moved through multiple exchanges before being bridged from Bitcoin to Avalanche in 2024.
The report noted he traveled frequently outside Russia, mainly to Southeast Asia and Australia. His personal information has appeared in multiple data breaches, and he shares his travels openly on social media.
