According to ChainCatcher, Russian OTC broker Aleksandr Khinkis (Aleks) is suspected of assisting a ransomware group in laundering money since July 2025, transferring more than $4.7 million through a single cryptocurrency exchange account, involving three ransom payments totaling 796 BTC.
Investigators, posing as potential customers via Telegram, successfully obtained the address of the user's exchange deposits (0xa756...0706e). On-chain forensic evidence shows that the funds were bridged to the Avalanche network via Bitcoin cross-chain technology, with 75 transactions flowing into this address. Among these, a ransom payment of 164 BTC in October 2025, approximately $3.8 million, was transferred to the Tron network after being exchanged on an instant exchange. The seven Tron addresses involved were blacklisted by Tether in November 2025.
