Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.08632268 BTC
Hops Traced
4
Flagged Hops
3
High Risk Hops
0
Starting Address
bc1q4rr4qlfdxx63407h6qr252kvkudvuukpn3wynv
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-03 23:59 UTC
bc1q4rr4qlfdxx63407h6qr252kvkudvuukpn3wynv → 3Ezvf8TdHfuMgQK6cK1JAtXcspxVMsWYcc
Low Risk
0.08632268 BTC
HOP 2 · 2026-09-06 12:28 UTC
3Ezvf8TdHfuMgQK6cK1JAtXcspxVMsWYcc → bc1qq8jt78yptchyveeqchc3srfw7tv0au8h4kfdvx
Split payment
0.12482850 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
3MPcH8RakXZBD39ggF556qMn6NGh9K274r 0.04647548 BTC Trace this branch
HOP 3 · 2026-09-09 22:24 UTC
bc1qq8jt78yptchyveeqchc3srfw7tv0au8h4kfdvx → 32qLpxq7F8RjbNXHdASPYMbG32pzFK16dL
Split payment
3.84955923 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1q0kawjq547d5r2fsrqqyudjk00zxqjdxmnwqc5l 0.09889191 BTC Trace this branch
HOP 4 · 2026-06-16 05:27 UTC
32qLpxq7F8RjbNXHdASPYMbG32pzFK16dL → 3MPcH8RakXZBD39ggF556qMn6NGh9K274r
Split payment
4.25680951 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1plxl6dzgg9ejy6m0hje8jn9vykzad60nlnlmcj3zpa7p3kvgq8jdq4x2ksd 1.50000000 BTC Trace this branch
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.