A breach of Lockbit’s infrastructure has resulted in the public release of a database containing approximately 60,000 Bitcoin addresses.
The leak of the addresses permits law enforcement and blockchain investigators to track the patterns and draw a link between past ransom payments to known wallets. Hackers recently violated the dark web affiliate panel of Lockbit’s ransomware infrastructure, leading to a massive leak of around 60,000 Bitcoin addresses associated with the group. After the hack, a MySQL database dump was shared publicly online. The database dump consisted of crypto-associated information, helping blockchain analysts to trace the illegal financial flows of the group. Ransomware is a malware used by bad actors to lock its target’s files or computer systems, after which it becomes inaccessible. After the attack, the attackers demand a ransom amount to provide the decryption key to unlock the files. The payment is usually demanded in virtual assets such as Bitcoin, Ethereum, and many more.
In February last year, around 10 countries led a joint operation to damage the group. The countries also mentioned that the organization has resulted in billions in damages to prominent infrastructure.
No Private Keys Included
The leak only included 60,000 Bitcoin wallets, excluding the private keys. A user confirmed on X about the breach and also shared a conversation with a LockBit operator. The user further confirmed that no private keys or data were lost. The Bleeding Computer’s analysts revealed that the database included 20 tablets consisting of a build table. Individual ransomware builds made by the affiliates of the organization also consisted. Adding more to this, the database of the leak also consisted of a chats table. Around 4,400 negotiation messages between victims and the ransomware organization were also present in that chat table.
However, the group behind the breach and the process to get into LockBit’s operations is still unclear. The leak of the addresses permits law enforcement and blockchain investigators to track the patterns and draw a link between past ransom payments to known wallets. The breach has underscored the role that crypto has in the ransomware economy.
