Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.43370086 BTC
Hops Traced
4
Flagged Hops
1
High Risk Hops
0
Starting Address
3By9DWsiJYJXyyRVusvF96kqugBYe4Z9AK
blockchain.com Wallet view
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-06 22:31 UTC
3By9DWsiJYJXyyRVusvF96kqugBYe4Z9AK → 3MBHVZZSdMMadQRXsE1gPGgaNcD64VUGiE
tx e977eb4ca979c8f5…
Low Risk
0.43370086 BTC
Continue from here
HOP 2 · 2026-09-08 09:23 UTC
3MBHVZZSdMMadQRXsE1gPGgaNcD64VUGiE → bc1qjf7hjfq9hk3lpl7sdd39ut0teclpraycwsxv46
tx 94644d77357e3514…
Low Risk
0.16287569 BTC
Continue from here
HOP 3 · 2026-07-19 14:09 UTC
bc1qjf7hjfq9hk3lpl7sdd39ut0teclpraycwsxv46 → 36REsWqX8aw9y65nF3QuQLmtr1WbWjNgUB
tx ba34f793d83babbf…
Split payment
0.38801143 BTC
Continue from here
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qvwtvkp78vwf6eg5kqrn8l6cl28p3xstdkya7t9 0.03933906 BTC Trace this branch
HOP 4 · 2026-06-11 09:47 UTC
36REsWqX8aw9y65nF3QuQLmtr1WbWjNgUB → bc1qd2kx8pmpnvfx40rmgd483988jcasamm9xw326zlm4pwguv5drxfssc4c86
tx 21ac960626cc0367…
Low Risk
26.46185684 BTC
Continue from here
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.