Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
525.00067200 BTC
Hops Traced
4
Flagged Hops
4
High Risk Hops
0
Starting Address
bc1q646fx2g833cvtg9t65ldfhswn9f83xg5y9zffx Known family: Conti
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2020-09-07 21:39 UTC
bc1q646fx2g833cvtg9t65ldfhswn9f83xg5y9zffx → bc1qzgvw9pzm0reape2jmck37sxf4j5jlwz0yzprac
Split payment
525.00067200 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
1N8ZFeZXYq2YZBkjPCMNjeSMEi9EE6ufJU 175.00000000 BTC Trace this branch
HOP 2 · 2020-09-08 00:58 UTC
bc1qzgvw9pzm0reape2jmck37sxf4j5jlwz0yzprac → 1CPL13QLFhmsxFmypPyoxFcN6VnnyqCjq5
Split payment
360.00000000 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qqvyqr4uda0k6pduuqq9a644j4g2qy8m8nfjh8t 165.00043100 BTC Trace this branch
HOP 3 · 2021-10-24 15:13 UTC
1CPL13QLFhmsxFmypPyoxFcN6VnnyqCjq5 → 1Ct5ypq9BYPTkHkMGX4CHoXmYw93shohxx
Split payment
334.99989785 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
39udnSYP3nNaRQs4uAzv2CeJLMadZ7L5nV 25.00000000 BTC Trace this branch
HOP 4 · 2021-10-24 15:40 UTC
1Ct5ypq9BYPTkHkMGX4CHoXmYw93shohxx → 1xrqTjYiGS8uJm5Wp8G1n1CLdX3Yr8rJo
Split payment
309.99986380 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
3LwYUK1DuWzdoP6Zewc7Wn8h8TagAKZfAG 25.00000000 BTC Trace this branch
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.