Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.28661942 BTC
Hops Traced
4
Flagged Hops
2
High Risk Hops
0
Starting Address
bc1q6fvturtjfte0fk6uszga298tw5cjwvp7l8qtea
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-08-22 19:42 UTC
bc1q6fvturtjfte0fk6uszga298tw5cjwvp7l8qtea → 1PbyaZxeaz2usu2EdjP5eA5S4K7TkBBL2U
Split payment
0.28661942 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qed4sml582fgxkr23v5fwv6gfsuph26swxhs4y2 0.00000716 BTC Trace this branch
HOP 2 · 2026-09-10 13:56 UTC
1PbyaZxeaz2usu2EdjP5eA5S4K7TkBBL2U → 17Hh59K259oHaMtSfeJh9UmkV4seDAQe7x
Low Risk
1.93678578 BTC
HOP 3 · 2026-09-05 23:24 UTC
17Hh59K259oHaMtSfeJh9UmkV4seDAQe7x → 1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC
Low Risk
12.23465791 BTC
HOP 4 · 2026-09-08 03:19 UTC
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC → 12XZMdaAGmcHf4ocFSqpd8jFd1WH7RHUPs
Split payment
192.59458431 BTC
This spend also paid 6 other addresses — not followed above, since the walk only continues down the largest branch:
3J181J8GXt8AmNC8dHTvnbN17z21JgZUoN 15.00000000 BTC Trace this branch
bc1qz8ttn6sfunu8sy6usj6xnjlmz4jsdxvljrgjq6 0.00501857 BTC Trace this branch
1GYK5f7SMrKL6jg3SrKCNgyUHjMqMHaJ4D 0.00123914 BTC Trace this branch
bc1qmk378vskc9t92wgglatv49mh534kkmjenmh3pl 0.00097040 BTC Trace this branch
1JDomZgMEg5pPTyQandfd8oae3TyG9B7t5 0.00043300 BTC Trace this branch
bc1qhwpsf26fg23j4fhd929sg9fr3za4s3pmn3ugep 0.00029941 BTC Trace this branch
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.