BlacklistChainHome › Ransomware wallets › Research
What 11,156 Ransomware Bitcoin Wallets Show
BlacklistChain lists 11,156 Bitcoin addresses known to have received ransomware payments. Grouping them by family and by when they were first used shows how concentrated ransom wallets are, and how many still hold coins.
Updated 2026-10-29. Figures are recomputed from the register every time this page is built.
Key findings
- A few families account for most wallets. Locky, NotNevada, Conti together make up 89% of the ransom addresses on the register. Mass email campaigns such as Locky gave each victim its own payment address, so they leave far more wallets than targeted attacks that make one large demand.
- 54 wallets still hold Bitcoin, 56.7266 BTC in total, according to our latest lookups.
- 2016 was the year the most wallets were first used (7,072 addresses).
Wallets by family
| Family | Wallets | Transactions | First – latest transaction | Still holding BTC |
|---|---|---|---|---|
| Locky | 7,037 | 15,608 | Jan 2016 – Jun 2017 | 0 |
| NotNevada | 2,802 | 13 | Oct 2022 – Apr 2023 | 2 |
| Conti | 103 | 261 | Dec 2017 – Jan 2025 | 3 |
| Netwalker (Mailto) | 66 | 690 | Nov 2019 – Jan 2026 | 9 |
| SamSam | 47 | 92 | Jan 2016 – Jul 2017 | 3 |
| Ryuk | 39 | 105 | Aug 2018 – Apr 2023 | 0 |
| Maui | 39 | 3,485 | Sep 2018 – Dec 2022 | 0 |
| Qlocker | 22 | 981 | Apr 2021 – May 2022 | 0 |
| MedusaLocker | 21 | 1,183 | Dec 2019 – Oct 2023 | 4 |
| Karakurt | 19 | 49 | Sep 2021 – Sep 2022 | 2 |
| Cuba | 18 | 35 | Feb 2020 – Jun 2022 | 0 |
| Akira | 15 | 40 | Jul 2023 – Sep 2024 | 0 |
| JigSaw | 10 | 19 | Mar 2016 – Dec 2016 | 1 |
| CryptConsole | 10 | 27 | Apr 2016 – Sep 2017 | 1 |
| Egregor | 9 | 18 | Oct 2020 – Dec 2020 | 0 |
| DMALockerv3 | 9 | 258 | Oct 2016 – Nov 2017 | 0 |
| DeadBolt | 9 | 22 | Jan 2022 – Dec 2022 | 9 |
| REvil / Sodinokibi | 8 | 18 | Jan 2020 – Jun 2021 | 0 |
| Globev3 | 7 | 84 | Nov 2016 – Feb 2018 | 0 |
| CryptoTorLocker2015 | 6 | 466 | Dec 2014 – Aug 2016 | 0 |
| Globe | 5 | 204 | Oct 2016 – Jan 2017 | 0 |
| TeslaCrypt | 5 | 1 | Mar 2015 – Mar 2015 | 1 |
| CTB-Locker | 5 | 3 | Mar 2016 – Apr 2016 | 1 |
| HC6/HC7 | 5 | 10 | Jul 2017 – Nov 2017 | 0 |
| RagnarLocker | 4 | 17 | Jul 2020 – May 2021 | 1 |
| Xorist | 3 | 8 | May 2017 – Oct 2017 | 0 |
| DarkSide | 3 | 7 | Feb 2021 – May 2021 | 0 |
| ThunderCrypt | 3 | – | 0 | |
| Nemucod | 3 | – | 0 | |
| GlobeImposter | 3 | 110 | Mar 2017 – Dec 2017 | 1 |
| LockBit | 3 | 14 | Dec 2020 – Oct 2024 | 2 |
| CryptoLocker | 2 | 76 | Sep 2013 – Aug 2014 | 1 |
| Black Kingdom | 2 | 4 | Mar 2020 – Mar 2021 | 0 |
| Badblock | 2 | – | 0 | |
| Globev2 | 2 | – | 0 | |
| Razy | 2 | 1,844 | Oct 2022 – Jul 2025 | 1 |
| Decryptiomega | 2 | 4 | Jul 2019 – Aug 2019 | 0 |
| LockBit 2.0 | 2 | 24 | Jun 2021 – Aug 2024 | 0 |
| Chimera | 2 | 3 | Nov 2015 – Nov 2015 | 0 |
| NoobCrypt | 2 | 34 | Oct 2015 – Jul 2016 | 1 |
| XLockerv5.0 | 2 | 11 | Jan 2017 – Mar 2017 | 0 |
| Avos Locker | 2 | 4 | Sep 2021 – Sep 2021 | 0 |
| Black Basta | 2 | 6 | Oct 2022 – Dec 2022 | 0 |
| ZeroLocker | 1 | – | 0 | |
| Flyper | 1 | 6 | Oct 2016 – Jul 2018 | 0 |
| Avaddon | 1 | 2 | May 2021 – May 2021 | 0 |
| Cryptohitman | 1 | 11 | Apr 2016 – Sep 2019 | 0 |
| Bitpaymer / DoppelPaymer | 1 | 4 | Aug 2020 – Aug 2020 | 0 |
| ComradeCircle | 1 | 2 | Oct 2016 – Oct 2016 | 0 |
| CyberSpLiTTER | 1 | – | 0 | |
| Cryptowall | 1 | 6 | Apr 2016 – Jun 2016 | 0 |
| SynAck | 1 | 501 | Sep 2017 – Jan 2018 | 0 |
| Ranzy Locker | 1 | 2 | Feb 2021 – Feb 2021 | 0 |
| XTPLocker | 1 | 6 | Oct 2016 – Nov 2016 | 0 |
| Bagli | 1 | 4 | Apr 2021 – May 2022 | 0 |
| ChupaCabra | 1 | 68 | Jun 2021 – Sep 2021 | 0 |
| Phobos | 1 | 4 | Jul 2021 – Jul 2021 | 0 |
| Ako | 1 | 21 | Jan 2020 – Jul 2021 | 0 |
| Qweuirtksd | 1 | 2 | Nov 2018 – Nov 2018 | 0 |
| Predator | 1 | 131 | Oct 2018 – Jun 2019 | 0 |
| WannaSmile | 1 | 1 | Nov 2017 – Nov 2017 | 1 |
| Kelly | 1 | 1 | Sep 2020 – Sep 2020 | 1 |
| Vega / Jamper / Buran | 1 | 14 | Aug 2021 – Sep 2021 | 0 |
| HelloKitty | 1 | 3 | Jul 2021 – Jul 2021 | 0 |
| DMALocker | 1 | 3 | Dec 2015 – Jan 2016 | 0 |
| Trump Locker | 1 | – | 0 | |
| CryptXXX | 1 | 146 | Jun 2016 – Aug 2016 | 0 |
| TowerWeb | 1 | 6 | Apr 2016 – Jun 2016 | 0 |
| EDA2 | 1 | 2 | Oct 2014 – Oct 2014 | 0 |
| CryptoSweetTooth | 1 | – | 0 | |
| BlackFeather | 1 | – | 0 | |
| Sam | 1 | 3 | Sep 2016 – Sep 2016 | 0 |
| REKTLocker | 1 | – | 0 | |
| BadEncrypt | 1 | – | 0 | |
| AdamLocker | 1 | – | 0 | |
| Stupid | 1 | – | 0 | |
| Encrpt3d | 1 | 4 | Dec 2019 – Jul 2021 | 1 |
| Tejodes | 1 | 48 | Jul 2019 – Jan 2020 | 0 |
| SunCrypt | 1 | 2 | Jul 2021 – Jul 2021 | 0 |
| Gula | 1 | 20 | Sep 2018 – Nov 2018 | 0 |
| Git | 1 | 6 | May 2019 – Nov 2021 | 1 |
| BlackRouter | 1 | 4 | Dec 2018 – Jun 2019 | 0 |
| Makop | 1 | 198 | Jul 2021 – Sep 2021 | 0 |
| Darkangels | 1 | 4 | May 2022 – Jun 2022 | 0 |
| Quantum | 1 | 2 | Jun 2022 – Jun 2022 | 0 |
| Hive | 1 | 4 | Nov 2022 – Nov 2022 | 0 |
| BlackCat | 1 | 9 | Mar 2024 – Mar 2024 | 0 |
| BlackSuit | 1 | 4 | Jun 2024 – Jun 2024 | 0 |
| Filecry | 1 | – | 0 | |
| MountLocker | 1 | 3 | Nov 2020 – Nov 2020 | 0 |
| Doxware | 1 | – | 0 | |
| RansomPlus | 1 | – | 0 | |
| AngleWare | 1 | – | 0 | |
| FakeGlobe | 1 | – | 0 | |
| Zyka | 1 | – | 0 | |
| Bucbi | 1 | 1 | Apr 2016 – Apr 2016 | 1 |
| NotPetya | 1 | 2 | Jul 2017 – Jul 2017 | 0 |
| AlbDecryptor | 1 | 55 | Jan 2021 – Jun 2021 | 0 |
| WannaCry | 1 | 16 | May 2017 – Aug 2020 | 1 |
| Pgpsnippet | 1 | – | 0 | |
| BlackMatter | 1 | 4 | Jul 2021 – Jul 2021 | 0 |
| CryptoHost | 1 | 1 | Jun 2016 – Jun 2016 | 1 |
| WannaRen | 1 | 2 | Apr 2020 – Apr 2020 | 1 |
| FireCrypt | 1 | – | 0 | |
| Phoenix | 1 | 2 | Dec 2016 – May 2017 | 0 |
| Philadelphia | 1 | – | 0 | |
| L1me_expl0it | 1 | – | 0 | |
| APT | 1 | 13 | Sep 2016 – Jan 2017 | 0 |
| NullByte | 1 | 2 | Sep 2016 – Sep 2016 | 0 |
| Rush/Sanction | 1 | – | 0 | |
| Domino | 1 | – | 0 | |
| PayDay | 1 | – | 0 | |
| Alphabet | 1 | – | 0 | |
| 7ev3n | 1 | 2 | Apr 2016 – Nov 2017 | 1 |
| Buddy | 1 | – | 0 | |
| Mallox | 1 | 2 | Apr 2023 – Apr 2023 | 0 |
Wallets by year first used
| Year | Wallets first used | Transactions |
|---|---|---|
| 2013 | 2 | 76 |
| 2014 | 2 | 44 |
| 2015 | 9 | 465 |
| 2016 | 7,072 | 16,187 |
| 2017 | 45 | 980 |
| 2018 | 39 | 283 |
| 2019 | 143 | 3,837 |
| 2020 | 466 | 2,461 |
| 2021 | 303 | 2,280 |
| 2022 | 106 | 2,090 |
| 2023 | 18 | 41 |
| 2024 | 11 | 37 |
Method and limits
Addresses come mainly from the open Ransomwhere dataset of ransom addresses reported by victims and researchers, plus sanctions lists. Transaction counts, dates and balances come from our own blockchain lookups and are blank where a lookup has not completed. Wallets with more than 100,000 transactions are left out: at that size they are exchange or service wallets, not ransom addresses. A wallet's family is the label its source gave it. Not every ransom payment is captured: victims report only a fraction of attacks, so treat these figures as a lower bound.
You may quote these figures with a link to this page. Browse every family or check an address.