CYBER EXTORTION FINANCIAL INTELLIGENCE
Ransom Demands & Crypto Recovery Tracker
Documenting documented extortion amounts, corporate ransoms paid in virtual currency, and subsequent cryptocurrency forfeiture seizures executed by the U.S. Department of Justice and international partners.
Documented Payments
$243.9M
Extortion proceeds paid by targeted corporations across healthcare, energy, meat processing, and insurance.
DOJ Crypto Recoveries
$50.5M
Cryptocurrency seized via federal seizure warrants, key extraction, and international law enforcement operations.
Targeted Recovery Ratio
20.7%
Proportion of paid ransom value reclaimed in tracked cases where law enforcement successfully seized affiliate wallets.
Documented Extortion Incidents & Judicial Forfeitures
| Incident & Target | Threat Cartel | Variant | Demand | Paid | Recovered | Crypto / Docket | Legal Status |
|---|---|---|---|---|---|---|---|
| Colonial Pipeline Cyber Extortion 2021-05-07 | DarkSide / BlackMatter | DarkSide | $4.4M | $4.4M | $2.3M | 75.0 BTC (Demanded/Paid) -> 63.7 BTC Seized 1:21-mj-00424 (D.D.C.) | DOJ Asset Forfeiture Seizure |
| Change Healthcare Nationwide Extortion 2024-02-21 | ALPHV / BlackCat | BlackCat / Noberus | $22.0M | $22.0M | $0 | 350.0 BTC 6:24-cv-00122 (M.D. Fla.) | Affiliate Exit Scam & Global Takedown |
| Kaseya VSA Supply Chain Extortion 2021-07-02 | REvil / Sodinokibi | Sodinokibi | $70.0M | $0 | $6.1M | Monero (XMR) & Bitcoin (BTC) 3:21-cr-00314 (N.D. Tex.) | Defendant Extradited & Restitution Ordered |
| Netwalker Healthcare Extortion Campaign 2021-01-27 | Netwalker Syndicate | Netwalker | $27.6M | $21.5M | $28.1M | 458.8 BTC & CAD Cash Seizure 8:20-cr-00355 (M.D. Fla.) | Defendant Sentenced to 20 Years |
| JBS Foods Global Meat Processing Extortion 2021-05-30 | REvil / Sodinokibi | Sodinokibi | $11.0M | $11.0M | $0 | Bitcoin (BTC) DOJ Statement June 9, 2021 | Voluntary Corporate Payment Disclosed |
| CNA Financial Enterprise Insurance Hack 2021-03-21 | Evil Corp (Dridex Cartel) | Phoenix Locker | $40.0M | $40.0M | $0 | Bitcoin (BTC) Treasury Designation Action | Sanctioned Entity Extortion Payment |
| City of Atlanta Municipal Outage 2018-03-22 | SamSam Ransomware Group | SamSam | $51K | $0 | $0 | Bitcoin (BTC) 2:18-cr-00760 (D.N.J.) | Fugitive Indictments Unsealed |
| Operation Cronos LockBit Disruption 2024-05-07 | LockBit Syndicate | LockBit 3.0 | $500.0M | $120.0M | $14.0M | Tether (USDT) & Bitcoin (BTC) 1:24-cr-00128 (D.N.J.) | Leader Unmasked & Sanctioned |
| CDK Global Automotive Outage Extortion 2024-06-19 | BlackSuit Ransomware Group | BlackSuit | $25.0M | $25.0M | $0 | 387.0 BTC 1:24-cv-05231 (N.D. Ill.) | Mass Automotive Dealership Outage |
Illicit Virtual Currency Laundering Facilitators Cited in Court
ChipMixer
Seized by DOJ / BKA (March 2023)
Est. Volume: 3,000,000,000+
Tornado Cash
Sanctioned by OFAC (August 2022)
Est. Volume: 1,000,000,000+
BTC-e
Seized by DOJ (July 2017)
Est. Volume: 4,000,000,000+
Blender.io
Sanctioned by OFAC (May 2022)
Est. Volume: 500,000,000+
Garantex
Sanctioned by OFAC (April 2022)
Est. Volume: 2,000,000,000+