Post

4/ October 2025: Aleks' exchange account traces back to six Bitcoin bridge deposit addresses tied to a suspected 164 BTC ransom payment from Oct 10, 2025 due to irregular outflows to instant exchanges / bridges. Receiving address: 19JNQLfoXBgUE7kuW4jMRFoCZJq3cqbRGU Instant exchange source addresses: bc1qk8ezrwtagz2dn273rxd0tfv5sqmey278qezaxy bc1qj98ezf9rgjvfcdewg4pjj7g4lfvrl26qujlcz8

5/ In Oct 2025 ~$3.8M worth of Bitcoin was swapped via instant exchange 1 from bc1qk8e & bc1qj98e. I performed a timing analysis to identify the outputs on Tron which can be seen in the table below. In Nov 2025 seven Tron addresses were blacklisted by Tether in relation to the ransom payment indicating law enforcement involvement. Three weeks ago the frozen USDT was burned by Tether.

6/ September 2025: Aleks' exchange account traces back to four Bitcoin bridge deposit addresses tied to a suspected 72 BTC ransom payment from Sep 2, 2025. The address which initiated the transfer has >15% exposure to other ransomware addresses across multiple compliance tools suggesting it may serve as a payment processor for ransomware. Receiving address: bc1q7mullnemg7sqef9u2tj8clatl04z78mdzhy6dy Instant exchange source addresses: bc1qan25sjpe5gt2h590p4gzvp2kyfq2sy6g8mzp2k bc1qm7qsqmhwl8ams35glczzs4vaxj9mnskwln59dg

7/ In Sep 2025 ~$1.36M worth of Bitcoin was swapped via instant exchange 1 from bc1qan & bc1qm7. I performed a timing analysis that identified Tron outputs to TKdsVDE & TWxkK which can be seen in the table below. TWxkK was also an output from the Oct 2025 ransom payment. The funds consolidated to: TW5fHfrn5AdV9kDbXTSazGUK7bGfia2X1G which has transfers with TUjsQi, a Tron address frozen by Tether.

8/ September 2023: Aleks' exchange account traces back to five Bitcoin bridge deposit addresses tied to a suspected 560 BTC ransom payment from Sep 19, 2023. Funds peeled off multiple exchanges and services via intermediary addresses before it was bridged from Bitcoin -> Avalanche in 2024. Receiving address: 1ECPUEjGbbJmXUsxUQSntwf4apjnpGLpUR

9/ OSINT indicates Aleks frequently travels outside of Russia to Southeast Asia and Australia. His personal information appears in multiple data breaches, and he openly documents his travels on social media. It's a bit unusual level of exposure for someone allegedly laundering millions in ransomware proceeds.

10/ Hopefully law enforcement will prosecute Aleks, but given it likely involves multiple jurisdictions that adds a lot of complexity for a case. 73 BTC remains dormant at 1ECrX6LiBhuGLGgJYB6mtacEEhzNSS9xdP, which will likely be laundered in the future. When I first began researching this ransom cluster in early Oct 2025, few of the addresses were reported in compliance tools by third party providers. While a number of ransom payments go unreported, they are easy to identify onchain and freeze. My recommendation to victims is to always report addresses. Special thanks to @bax1337 for OSINT assistance and to @TobyFrei4 for Russian translation.

@zachxbt hopefully

@zachxbt legend Zach

@laufej 🤝

@kryptosopus Blocked for AI slop x.com/zachxbt/status/203643204…

@zachxbt Let's hope this Alex is brought to justice. Very good investigation, Zach never dissapoints.

@zachxbt GOD BLESS YOU BROTHER ❤️‍🔥✝️ For your great work with out asking nothing 🫡👏🏼👏🏼👏🏼

@zachxbt x.com/JohnJames____/status/203…

@zachxbt I’ll be anticipating the next update 🫡

@zachxbt @kryptosopus x.com/UpTheLeverage/status/203…

@zachxbt Bro please what software do you use for the flowchart

@zachxbt Next time, if you need help with translation or communication in Russian, feel free to reach out to me

@zachxbt another amazing analysis, well done sir!

@bellx_crypto 🫡

@zachxbt The reason he doesn’t really try to hide is that: he believes he’s untouchable in Russia, it’s difficult to hold someone legally accountable. But step by step, enthusiasts will move that wall.

@zachxbt Deposit address is the nexus. All bridges lead there. Clustering wins.

@zachxbt when data haven

@zachxbt Based off some of those photos he's traveled around Indonesia and likely in Bali. Either Canggu or Seminyak. I'm currently in Seminyak, can go ask him a few questions if you like

@zachxbt @SpecterAnalyst You're a treasure man

@loudyprime @zachxbt maybe I should tell @zachxbt what kind of scam empire you’re secretly building? or should we wait until he exposes you himself? x.com/kudrichonchain/status/20…

@zachxbt Full rect x.com/votesa/status/2036437356…

@kudrichonchain @zachxbt he already knows x.com/loudyprime/status/203643…

@zachxbt Bro Bali police are useless - they won’t do anything to him 😂

@zachxbt Bro is in Canggu right now chillin

@zachxbt its also unusual for someone who launders millions to agree to exchange 2k$ tho (and at market price)

@zachxbt @CryptoSnooper_ what is that tool that shows up with all the yandex, microsoft accounts

@zachxbt @itsmeyourvicky Zach’s on the case x.com/cryptofuks/status/203643…

@zachxbt Did you catch the ransomware group though

@zachxbt Crazyy you can lay out the evidence like this and the man could still walk free

@zachxbt Check DM homie.✌️

@zachxbt I really wanna be like you some day 👍👌

@zachxbt insaneeee, thank you zac! it's always the "vulgar" people who are doing these crazy stunts

@zachxbt Great work as always 🔥

@zachxbt i thought Zach know Russian for a bit 😭

@zachxbt Another one Zach.🫡

@zachxbt Have you made a referral to the FBI?

Update: After my investigation went live Aleks started charging 35,000 Stars on Telegram to make it so you cannot contact him without paying. x.com/zachxbt/status/203644175…

@zachxbt @grok how much is that in $

@zachxbt Well done Zach

@zachxbt @inversebrah it's just business

@zachxbt He can't deny at this point

@zachxbt is that 1 BTC?

@zachxbt He’s scared… 🤣

@zachxbt bro really put up a paywall like: x.com/Intern_Leverup/status/20…