Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
20.00000000 BTC
Hops Traced
4
Flagged Hops
3
High Risk Hops
0
Starting Address
bc1qqcd3hsh4kkr8sdsy6adxuzy0sgh9ywx530cu2e
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-08 08:34 UTC
bc1qqcd3hsh4kkr8sdsy6adxuzy0sgh9ywx530cu2e → 3JgjA1xMGhjfwuS2RK7zomuesTbCt4bLyE
Split payment
20.00000000 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qx8mpvyhk098tnvxe67nj6tc5tf89vurxe6zluf 0.22933590 BTC Trace this branch
HOP 2 · 2026-07-30 18:10 UTC
3JgjA1xMGhjfwuS2RK7zomuesTbCt4bLyE → 1Ej3Co334KDS7XCxhXoooVQMhAvsz7BKM1
Split payment
120.00000000 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qxydg59mcm5cugl328qk07qr43v5na77e3v6w0x90hc27z627s43s5u7ln6 14.99994564 BTC Trace this branch
HOP 3 · 2026-08-02 09:15 UTC
1Ej3Co334KDS7XCxhXoooVQMhAvsz7BKM1 → bc1qj6x0rcgrhagkk826u5xrp32jjp9nf94yjctvm9
Split payment
114.99935101 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
15ZAumgvBkRBpBkvuB699FszE8KW7sUqof 20.00000000 BTC Trace this branch
HOP 4 · 2026-07-30 13:28 UTC
bc1qj6x0rcgrhagkk826u5xrp32jjp9nf94yjctvm9 → 15ZAumgvBkRBpBkvuB699FszE8KW7sUqof
Low Risk
40.00000000 BTC
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.