Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.12698896 BTC
Hops Traced
3
Flagged Hops
1
High Risk Hops
0
Starting Address
bc1qj2l5dsdxtx4w2wxhm4hxa3cplaj90875d5gdgz
blockchain.com Wallet view
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-09-01 01:05 UTC
bc1qj2l5dsdxtx4w2wxhm4hxa3cplaj90875d5gdgz → 36EzudiTMeTy2jdmLRkU5VbFJPoBdiajzR
tx 8cdd22612d9e6408…
Split payment
0.12698896 BTC
Continue from here
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qvaa5y54jsaumgcaqt8d9zmfy0lkzl5gg8pga5j 0.00106156 BTC Trace this branch
HOP 2 · 2026-09-01 01:38 UTC
36EzudiTMeTy2jdmLRkU5VbFJPoBdiajzR → bc1q0qfzuge7vr5s2xkczrjkccmxemlyyn8mhx298v
tx af48b24fa52837e0…
Low Risk
3.37380597 BTC
Continue from here
HOP 3 · 2026-09-08 15:08 UTC
bc1q0qfzuge7vr5s2xkczrjkccmxemlyyn8mhx298v → bc1qy7m70lm5vyncwehrr286nwucs9cu8g8rvjm0a8
tx cf547ed68859fb97…
Low Risk
0.03410000 BTC
Continue from here
Trace stopped: no further outgoing transactions from the last address.