BlacklistChainHome › Ransomware wallets
Ransomware Bitcoin wallets by family
11,156 Bitcoin addresses that received ransom payments, grouped by the ransomware that demanded them. Each wallet has its own page with its source and on-chain activity.
11,156ransomware wallets
116named families
28,795transactions recorded
Sep 2013 – Jan 2026first to latest transaction
Were you asked to pay one of these addresses? Check the address, and read what the data shows.
Families
| Family | Wallets | Transactions | First – latest transaction | Still holding BTC |
|---|---|---|---|---|
| Locky | 7,037 | 15,608 | Jan 2016 – Jun 2017 | 0 |
| NotNevada | 2,802 | 13 | Oct 2022 – Apr 2023 | 2 |
| Conti | 103 | 261 | Dec 2017 – Jan 2025 | 3 |
| Netwalker (Mailto) | 66 | 690 | Nov 2019 – Jan 2026 | 9 |
| SamSam | 47 | 92 | Jan 2016 – Jul 2017 | 3 |
| Ryuk | 39 | 105 | Aug 2018 – Apr 2023 | 0 |
| Maui | 39 | 3,485 | Sep 2018 – Dec 2022 | 0 |
| Qlocker | 22 | 981 | Apr 2021 – May 2022 | 0 |
| MedusaLocker | 21 | 1,183 | Dec 2019 – Oct 2023 | 4 |
| Karakurt | 19 | 49 | Sep 2021 – Sep 2022 | 2 |
| Cuba | 18 | 35 | Feb 2020 – Jun 2022 | 0 |
| Akira | 15 | 40 | Jul 2023 – Sep 2024 | 0 |
| JigSaw | 10 | 19 | Mar 2016 – Dec 2016 | 1 |
| CryptConsole | 10 | 27 | Apr 2016 – Sep 2017 | 1 |
| Egregor | 9 | 18 | Oct 2020 – Dec 2020 | 0 |
| DMALockerv3 | 9 | 258 | Oct 2016 – Nov 2017 | 0 |
| DeadBolt | 9 | 22 | Jan 2022 – Dec 2022 | 9 |
| REvil / Sodinokibi | 8 | 18 | Jan 2020 – Jun 2021 | 0 |
| Globev3 | 7 | 84 | Nov 2016 – Feb 2018 | 0 |
| CryptoTorLocker2015 | 6 | 466 | Dec 2014 – Aug 2016 | 0 |
| Globe | 5 | 204 | Oct 2016 – Jan 2017 | 0 |
| TeslaCrypt | 5 | 1 | Mar 2015 – Mar 2015 | 1 |
| CTB-Locker | 5 | 3 | Mar 2016 – Apr 2016 | 1 |
| HC6/HC7 | 5 | 10 | Jul 2017 – Nov 2017 | 0 |
| RagnarLocker | 4 | 17 | Jul 2020 – May 2021 | 1 |
| Xorist | 3 | 8 | May 2017 – Oct 2017 | 0 |
| DarkSide | 3 | 7 | Feb 2021 – May 2021 | 0 |
| ThunderCrypt | 3 | – | 0 | |
| Nemucod | 3 | – | 0 | |
| GlobeImposter | 3 | 110 | Mar 2017 – Dec 2017 | 1 |
| LockBit | 3 | 14 | Dec 2020 – Oct 2024 | 2 |
| CryptoLocker | 2 | 76 | Sep 2013 – Aug 2014 | 1 |
| Black Kingdom | 2 | 4 | Mar 2020 – Mar 2021 | 0 |
| Badblock | 2 | – | 0 | |
| Globev2 | 2 | – | 0 | |
| Razy | 2 | 1,844 | Oct 2022 – Jul 2025 | 1 |
| Decryptiomega | 2 | 4 | Jul 2019 – Aug 2019 | 0 |
| LockBit 2.0 | 2 | 24 | Jun 2021 – Aug 2024 | 0 |
| Chimera | 2 | 3 | Nov 2015 – Nov 2015 | 0 |
| NoobCrypt | 2 | 34 | Oct 2015 – Jul 2016 | 1 |
| XLockerv5.0 | 2 | 11 | Jan 2017 – Mar 2017 | 0 |
| Avos Locker | 2 | 4 | Sep 2021 – Sep 2021 | 0 |
| Black Basta | 2 | 6 | Oct 2022 – Dec 2022 | 0 |
| ZeroLocker | 1 | – | 0 | |
| Flyper | 1 | 6 | Oct 2016 – Jul 2018 | 0 |
| Avaddon | 1 | 2 | May 2021 – May 2021 | 0 |
| Cryptohitman | 1 | 11 | Apr 2016 – Sep 2019 | 0 |
| Bitpaymer / DoppelPaymer | 1 | 4 | Aug 2020 – Aug 2020 | 0 |
| ComradeCircle | 1 | 2 | Oct 2016 – Oct 2016 | 0 |
| CyberSpLiTTER | 1 | – | 0 | |
| Cryptowall | 1 | 6 | Apr 2016 – Jun 2016 | 0 |
| SynAck | 1 | 501 | Sep 2017 – Jan 2018 | 0 |
| Ranzy Locker | 1 | 2 | Feb 2021 – Feb 2021 | 0 |
| XTPLocker | 1 | 6 | Oct 2016 – Nov 2016 | 0 |
| Bagli | 1 | 4 | Apr 2021 – May 2022 | 0 |
| ChupaCabra | 1 | 68 | Jun 2021 – Sep 2021 | 0 |
| Phobos | 1 | 4 | Jul 2021 – Jul 2021 | 0 |
| Ako | 1 | 21 | Jan 2020 – Jul 2021 | 0 |
| Qweuirtksd | 1 | 2 | Nov 2018 – Nov 2018 | 0 |
| Predator | 1 | 131 | Oct 2018 – Jun 2019 | 0 |
| WannaSmile | 1 | 1 | Nov 2017 – Nov 2017 | 1 |
| Kelly | 1 | 1 | Sep 2020 – Sep 2020 | 1 |
| Vega / Jamper / Buran | 1 | 14 | Aug 2021 – Sep 2021 | 0 |
| HelloKitty | 1 | 3 | Jul 2021 – Jul 2021 | 0 |
| DMALocker | 1 | 3 | Dec 2015 – Jan 2016 | 0 |
| Trump Locker | 1 | – | 0 | |
| CryptXXX | 1 | 146 | Jun 2016 – Aug 2016 | 0 |
| TowerWeb | 1 | 6 | Apr 2016 – Jun 2016 | 0 |
| EDA2 | 1 | 2 | Oct 2014 – Oct 2014 | 0 |
| CryptoSweetTooth | 1 | – | 0 | |
| BlackFeather | 1 | – | 0 | |
| Sam | 1 | 3 | Sep 2016 – Sep 2016 | 0 |
| REKTLocker | 1 | – | 0 | |
| BadEncrypt | 1 | – | 0 | |
| AdamLocker | 1 | – | 0 | |
| Stupid | 1 | – | 0 | |
| Encrpt3d | 1 | 4 | Dec 2019 – Jul 2021 | 1 |
| Tejodes | 1 | 48 | Jul 2019 – Jan 2020 | 0 |
| SunCrypt | 1 | 2 | Jul 2021 – Jul 2021 | 0 |
| Gula | 1 | 20 | Sep 2018 – Nov 2018 | 0 |
| Git | 1 | 6 | May 2019 – Nov 2021 | 1 |
| BlackRouter | 1 | 4 | Dec 2018 – Jun 2019 | 0 |
| Makop | 1 | 198 | Jul 2021 – Sep 2021 | 0 |
| Darkangels | 1 | 4 | May 2022 – Jun 2022 | 0 |
| Quantum | 1 | 2 | Jun 2022 – Jun 2022 | 0 |
| Hive | 1 | 4 | Nov 2022 – Nov 2022 | 0 |
| BlackCat | 1 | 9 | Mar 2024 – Mar 2024 | 0 |
| BlackSuit | 1 | 4 | Jun 2024 – Jun 2024 | 0 |
| Filecry | 1 | – | 0 | |
| MountLocker | 1 | 3 | Nov 2020 – Nov 2020 | 0 |
| Doxware | 1 | – | 0 | |
| RansomPlus | 1 | – | 0 | |
| AngleWare | 1 | – | 0 | |
| FakeGlobe | 1 | – | 0 | |
| Zyka | 1 | – | 0 | |
| Bucbi | 1 | 1 | Apr 2016 – Apr 2016 | 1 |
| NotPetya | 1 | 2 | Jul 2017 – Jul 2017 | 0 |
| AlbDecryptor | 1 | 55 | Jan 2021 – Jun 2021 | 0 |
| WannaCry | 1 | 16 | May 2017 – Aug 2020 | 1 |
| Pgpsnippet | 1 | – | 0 | |
| BlackMatter | 1 | 4 | Jul 2021 – Jul 2021 | 0 |
| CryptoHost | 1 | 1 | Jun 2016 – Jun 2016 | 1 |
| WannaRen | 1 | 2 | Apr 2020 – Apr 2020 | 1 |
| FireCrypt | 1 | – | 0 | |
| Phoenix | 1 | 2 | Dec 2016 – May 2017 | 0 |
| Philadelphia | 1 | – | 0 | |
| L1me_expl0it | 1 | – | 0 | |
| APT | 1 | 13 | Sep 2016 – Jan 2017 | 0 |
| NullByte | 1 | 2 | Sep 2016 – Sep 2016 | 0 |
| Rush/Sanction | 1 | – | 0 | |
| Domino | 1 | – | 0 | |
| PayDay | 1 | – | 0 | |
| Alphabet | 1 | – | 0 | |
| 7ev3n | 1 | 2 | Apr 2016 – Nov 2017 | 1 |
| Buddy | 1 | – | 0 | |
| Mallox | 1 | 2 | Apr 2023 – Apr 2023 | 0 |
721 further wallets are known ransom addresses without a family name; they are in the Bitcoin directory. "Transactions" counts payments in and out recorded by our blockchain lookups. Old ransom wallets keep receiving tiny unsolicited "dust" transfers, so the latest transaction can be years after the attacks ended.
Questions
- What is a ransomware wallet?
- A cryptocurrency address that received ransom payments from victims of a ransomware attack. Researchers link addresses to a family from ransom notes, victim reports and the payment pages the criminals used.
- Where does this data come from?
- Mainly the open Ransomwhere dataset (ransomwhe.re), which collects ransom addresses reported by victims and researchers, plus sanctions lists. Activity figures come from the Bitcoin blockchain.
- Is it legal to pay a ransomware demand?
- In many countries paying is not itself illegal, but paying a sanctioned group or wallet can be. Talk to the police and a lawyer before paying anyone.