Locky ransomware Bitcoin addresses

Locky spread from 2016 through mass spam emails carrying booby-trapped Office documents and script attachments, much of it sent by the Necurs botnet. It encrypted files and demanded payment in Bitcoin through a Tor payment page.

If a ransom note asked you to pay one of these addresses, report the attack to the police before paying anyone. Paying a sanctioned group can be illegal. Check any address.

Wallets 1–500 of 7,037

All ransomware families · What the ransomware data shows