Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.76718648 BTC
Hops Traced
2
Flagged Hops
1
High Risk Hops
0
Starting Address
bc1qpqgygwep7addgfgy0qq3le0dj24tskg0yn4vte
blockchain.com Wallet view
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-09 09:16 UTC
bc1qpqgygwep7addgfgy0qq3le0dj24tskg0yn4vte → bc1q3qhfhcwc2ffjd9werggmxguz97s2qr5ja333ps
tx e8cb811c41c18b1c…
Split payment
0.76718648 BTC
Continue from here
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qaf0h9ea8gpzxwpyld4rfhr68e4ecnkdshyepug 0.00012207 BTC Trace this branch
HOP 2 · 2026-09-09 09:40 UTC
bc1q3qhfhcwc2ffjd9werggmxguz97s2qr5ja333ps → bc1q002m5c0qe4m7yagn8yzh6z8l4236n9punkaryj
tx f1bf531971a0d522…
Low Risk
0.76718404 BTC
Continue from here
Trace stopped: no further outgoing transactions from the last address.