This Bitcoin Ransomware Illegal Profits Worth $150 Million in Bitcoin

A new report from two cybersecurity firms shows that a ransomware strain called Ryuk has been hugely ‘successful’, earning more than $150 million in Bitcoin. The ransom payments “sometimes run into the millions of dollars, and are often in the hundreds of thousands of dollars.”

Ransomware makes $150 million in Bitcoin

According to a joint report by cybersecurity companies Advanced Intel and Hyas, the Ryuk ransomware family has earned $150 million in Bitcoin revenue. The report authors said: "The Ryuk ransomware family is particularly successful financially and has had a devastating impact on many industries around the world."

Our research involved tracing payments to 61 deposit addresses involved in the Ryuk ransomware. Ryuk criminals send most of their Bitcoin to exchanges through intermediaries to cash out.

The Ryuk ransomware family was first discovered in August 2018. It often targets high-profile organizations, including hospitals and media outlets.

“Substantial amounts of Bitcoin moved from money laundering services to Binance, Huobi, and criminal markets that we identified by tracking payments,” the report’s authors explained. Beyond these two crypto exchanges, “substantial amounts of cryptocurrency flowed to a very small collection of addresses, insufficient to establish an exchange and likely representing a criminal service that exchanges cryptocurrency for local currency or another digital currency.”

Additionally, the report states: “Ryuk has received significant ransom payments from a well-known broker who makes payments on behalf of ransomware victims. These payments have sometimes reached millions of dollars and are typically in the hundreds of thousands of dollars.”

After tracing Bitcoin transactions to known addresses belonging to Ryuk, the authors estimate that the crimeware company’s illicit proceeds may exceed $150 million.