Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
196.49339146 BTC
Hops Traced
3
Flagged Hops
2
High Risk Hops
0
Starting Address
3MqUP6G1daVS5YTD8fz3QgwjZortWwxXFd
blockchain.com Wallet view
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-07 13:43 UTC
3MqUP6G1daVS5YTD8fz3QgwjZortWwxXFd → bc1q4wa3jl0885aeac642h4nfdgjj5ww5k5w5tq8rj
tx dfad75d2af6fc965…
Low Risk
196.49339146 BTC
Continue from here
HOP 2 · 2026-06-29 10:44 UTC
bc1q4wa3jl0885aeac642h4nfdgjj5ww5k5w5tq8rj → 36YZXcTVLPdyapYuqXdJEt46oMVB2NrzVv
tx fc0bda7ecc953caa…
Split payment
231.65414340 BTC
Continue from here
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
3J7cUjBZxvGRCwFBz3q23zAsnhFfZrDSSU 0.00010827 BTC Trace this branch
HOP 3 · 2026-09-02 10:23 UTC
36YZXcTVLPdyapYuqXdJEt46oMVB2NrzVv → 3MqUP6G1daVS5YTD8fz3QgwjZortWwxXFd
tx d2f341da56af8a3d…
Self-consolidation
1979.94228352 BTC
Continue from here
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qmakjy7ns2z8vwgptf9vs8fndp304fg0p9xafm2 668.32616565 BTC Trace this branch
Trace stopped: the largest outgoing path led back to an already-visited address (self-consolidation or a cycle), not a new counterparty.