Ransomware payment addresses used by LockBit, Conti, BlackBasta, and other ransomware groups for ransom collection and extortion.database. These wallets were identified through analysis of ransomware campaigns and victim payment tracking.
Bitcoin addresses that security researcher Dancho Danchev published as LockBit addresses from the May 7, 2025 leak of the LockBit ransomware affiliate-panel database. This report holds 50 of them, entries 51 to 100 of the 62,313 in his list (part 2 of 1,246). Background: On May 7, 2025, LockBit's affiliate-panel sites were defaced with a link to a MySQL dump of the panel database. BleepingComputer reported that its btc_addresses table held 59,975 unique Bitcoin addresses, alongside victim negotiation chats and affiliate accounts. The dump appears to date from April 29, 2025. What the…
Ransomware payment address associated with lockbit. This address was used to collect ransom payments from victims. Source: Threat intelligence database aggregated from ransomware tracking services.
Ransomware payment address associated with lockbit. This address was used to collect ransom payments from victims. Source: Threat intelligence database aggregated from ransomware tracking services.