Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.27130838 BTC
Hops Traced
4
Flagged Hops
1
High Risk Hops
0
Starting Address
1Ey7CTMxc5vbHk3Sih68PtKPu2jw4wx1ZJ
blockchain.com Wallet view
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-08-28 10:42 UTC
1Ey7CTMxc5vbHk3Sih68PtKPu2jw4wx1ZJ → bc1qvtw6edfw2cy6n5r3lgcsly8j086zctaa0vrs3j
tx 4f91962aff753265…
Split payment
0.27130838 BTC
Continue from here
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qqvuvdnrnw3sm9ktu6hyx6erg28d2ld2yu0fmy4 0.01355148 BTC Trace this branch
HOP 2 · 2026-08-05 17:42 UTC
bc1qvtw6edfw2cy6n5r3lgcsly8j086zctaa0vrs3j → bc1qfuq4ld6arx2nhfdrazxj5fk3hvdwm84hqsat42
tx 01d3d47726bc6b3a…
Low Risk
19.57430036 BTC
Continue from here
HOP 3 · 2026-09-04 07:58 UTC
bc1qfuq4ld6arx2nhfdrazxj5fk3hvdwm84hqsat42 → bc1q4a42gdgv5su8j0agljt9vcwlte9nz9jql0xr9n
tx 8609633393d44083…
Low Risk
8.00000000 BTC
Continue from here
HOP 4 · 2026-09-08 07:21 UTC
bc1q4a42gdgv5su8j0agljt9vcwlte9nz9jql0xr9n → bc1q5nlft9m6yhlsjq9gntw8z5d6682m3npd3y4w63
tx 757bb7a797c3b50b…
Low Risk
1.37370465 BTC
Continue from here
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.