Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Ransom Payment Tracer

Inspired by secworkspace/ransomware-payment-tracer.

First Hop Amount
0.79792259 BTC
Hops Traced
4
Flagged Hops
3
High Risk Hops
0
Starting Address
1Kg9E4rfFPbJdwD1Xvmw1eeiqYvboZYSk7
Fund Flow Trace
Clean hop Self-consolidation / fan-out branch OFAC-listed / known ransomware family Click any node to continue tracing from it · scroll to zoom · drag to pan
Hop Detail
HOP 1 · 2026-08-03 09:51 UTC
1Kg9E4rfFPbJdwD1Xvmw1eeiqYvboZYSk7 → bc1qsauelcsugfv8vxfc0aukmyqha56546spm7qy4e
Low Risk
0.79792259 BTC
HOP 2 · 2026-08-03 10:54 UTC
bc1qsauelcsugfv8vxfc0aukmyqha56546spm7qy4e → bc1pfwvqm8hgrdar6uzenq84r0zm50jmpwcjtrkxvn4c4usutyy0908qc88uqd
Split payment
0.68000000 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1ql2x78a05ama68fw9qdwn4ldhengd95ze8lw763 0.11791600 BTC Trace this branch
HOP 3 · 2026-08-03 11:02 UTC
bc1pfwvqm8hgrdar6uzenq84r0zm50jmpwcjtrkxvn4c4usutyy0908qc88uqd → bc1pjn89zgjgfn7auyj355050yn8x6gl3a9dhryqcaucg0myg3akg6pq8qssql
Split payment
0.51999845 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qg5zck40ajg9ttpqr5fvtlyykqsx6963n75qg33y8teyst0dcc5pqtpsmtf 0.16000000 BTC Trace this branch
HOP 4 · 2026-08-03 11:22 UTC
bc1pjn89zgjgfn7auyj355050yn8x6gl3a9dhryqcaucg0myg3akg6pq8qssql → bc1p8sdm3ahalk3ulq9agugns5daydh042au0pdca80h5gza038jpsaqdjrdu0
Split payment
0.35999690 BTC
This spend also paid 1 other address — not followed above, since the walk only continues down the largest branch:
bc1qs440ds7qxgk9t4rq3j2gmhpfqpclmg75vsshtpy29nus79jruwnsx26pvj 0.16000000 BTC Trace this branch
Reached the 4-hop limit for this run — continue from the last hop above to keep walking.