Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
2.51882600 BTC
Hops Traced
4
Flagged Hops
1
High Risk Hops
0
Starting Address
35C2L1pCgwzBHNcDcVL1a5RuoefeWqyjAR
blockchain.com Wallet view
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-07 10:20 UTC
35C2L1pCgwzBHNcDcVL1a5RuoefeWqyjAR → bc1ptxr5zs6xq63742qa7ltn7q4y8330lpz0953tmucpk0a6m66fx0dqhavlmu
tx 69838adef8300846…
Low Risk
2.51882600 BTC
Continue from here
HOP 2 · 2025-12-31 07:56 UTC
bc1ptxr5zs6xq63742qa7ltn7q4y8330lpz0953tmucpk0a6m66fx0dqhavlmu → 12HfsVnBSGMmYZ4TA2g1quecvwwZTtToBq
tx 17ab5466a87d324a…
Low Risk
11.50000000 BTC
Continue from here
HOP 3 · 2025-03-07 06:15 UTC
12HfsVnBSGMmYZ4TA2g1quecvwwZTtToBq → 1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC
tx bf81b914d0b5edb3…
Low Risk
2315.89763136 BTC
Continue from here
HOP 4 · 2026-09-08 03:19 UTC
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC → 12XZMdaAGmcHf4ocFSqpd8jFd1WH7RHUPs
tx 2ac3c25060a194da…
Split payment
192.59458431 BTC
Continue from here
This spend also paid 6 other addresses — not followed above, since the walk only continues down the largest branch:
3J181J8GXt8AmNC8dHTvnbN17z21JgZUoN 15.00000000 BTC Trace this branch
bc1qz8ttn6sfunu8sy6usj6xnjlmz4jsdxvljrgjq6 0.00501857 BTC Trace this branch
1GYK5f7SMrKL6jg3SrKCNgyUHjMqMHaJ4D 0.00123914 BTC Trace this branch
bc1qmk378vskc9t92wgglatv49mh534kkmjenmh3pl 0.00097040 BTC Trace this branch
1JDomZgMEg5pPTyQandfd8oae3TyG9B7t5 0.00043300 BTC Trace this branch
bc1qhwpsf26fg23j4fhd929sg9fr3za4s3pmn3ugep 0.00029941 BTC Trace this branch
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.