bc1q00uhs9me8neqdwtdh4z8jprmfh872fnhknwka0

High-Value Threat Actor Infrastructure

• Scam type: Scam
• Chain: Bitcoin
• Reported: 2026-04-25
• Last updated: 2026-04-25

Infrastructure and accounts associated with identified threat actors and high-value targets.

Other addresses in this report: bc1qgqeystsp4lw308z9hleqtrkyxlvmhmqv7asudg, bc1qx8m5fazkqw8z9nlx9jhhgxcqa5e6mzcnupvyr7, bc1q832gvmujx860xq8mj5yenkt9vq7yk33sw4kg0w, bc1q93xns5udagzrasrzhvx0xdg2se8d67w7jargdl, bc1qxxfx6dhpge2630hu6gqssxw6zpmj08fmlgfwtm, bc1qz6fvjl6key5yzttatlhftrt0vyau57z39qex5u, bc1qhjmry5zc8g5xz2lued8q9du8sy9ld6gq68pvwv, bc1q4jx0qz7mu2zak85y6v4ercuyk62q0k3lqatmhj, bc1qhwth9cj6gf3eueulmmcl7wrzg9gh7fu8746ph7, bc1q69rgv0263v3f6qx73js4f4lcuuugfeyucc2zrq, bc1qnc5vj3p8fykj82jjtrcu7r7jrdjzc0hffrks7s, bc1qnkp62htrkl4gv8hp0qrlml7v6asgyc9y0e29ts, bc1q9ur2ujk4d07pr3p0zgsthx7hp0lux2tr9nxyfw, bc1q87kyrc8s92h4yuwx2f2c3ay4wna53axnrtm87l, bc1qh6g9354pfkprjxv9n7l0ylvte4xg75kq29zxyy, bc1qxff07hrhn376zr7r7pmt6zkg2dma0x4d7w9h3u, bc1qm6mj3mlp9q2xxlsq8kpxctrjs09uetwxtysstp, bc1qw2zkrusavnhnlqpwwkcds98yx7vjdk7q5rn0dx, bc1qdpqmmcwjfq0scpsy4usm7k546rrsy63lg9hlek, bc1qkpteec385l2es63kgy2x75wxpykcs3lmgcjfr6 and 29 more

Ransomware Wallets — ransomware addresses

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Ransomware payment wallet. Source: crowdsourced ransomware wallet tracking database. Entities: lockbit. Programs: lockbit.

Other addresses in this report: bc1q00acjkxt4u6jwxr79h4kmnwh949npqx5xjmnzr, bc1q00atcaaxh7805g2gydngyw9qf0388xuz0rgexh, bc1q00ax8vpmwv3qjrff3gscd43zznr0wl6mz9pyw0, bc1q00c4jea950mj8s2r0wad85a6rqwwvvgshx9tt4, bc1q00c8yet0d0zsjfwmwuxffue2ux5wtl4a2z8pr2, bc1q00cw5c6hn7d7r9ht9gd3s475zr3ujgv2k2sxkj, bc1q00f9wgapjn6jzsdsv03nz8n2jpawahy4vjffe9, bc1q00gay9t05s83y594rwczy4l9hhktmclnqwxrh4, bc1q00gc3c9854ydqp5f3lp8rygy8k7l9mprtmtep5, bc1q00gds6d3tseq4xaj2gwxcr2ytjxpv4e7jdu68p, bc1q00hdh3v6wahm40d5csrnrnhz3dcqs4antfeyu8, bc1q00hk3lfyrgc6fyfx5vpv0f3klg3ltgzrajq0hs, bc1q00j29p32sd8a4lhaluwqyfld5rweqwrpfzsjdw, bc1q00j9f4d8w08eg0m06fylqy9scl66n658ac5ktc, bc1q00k3e4c3kl0sjtpf98x54m2vlj2ld2thpcdxjg, bc1q00kdxysgpylhaafjs4v3jrp62s6qfed3v62k7r, bc1q00l484aprcn2ed62jfl24nu3ww3695c3phnu9j, bc1q00l79lh6vsjrpfs66ttlh0ts09dy357zv3z7k6, bc1q00lh43spnharkcqp77eat292lpx6vj27q5rw0l, bc1q00lh4t9rqkpe472e6hg8ugznpvt26dnhx6qdcw and 29 more

LockBit ransomware: Bitcoin addresses from the leaked LockBit affiliate-panel database (Danchev list), part 2 of 1,246

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-10-27

Bitcoin addresses that security researcher Dancho Danchev published as LockBit addresses from the May 7, 2025 leak of the LockBit ransomware affiliate-panel database. This report holds 50 of them, entries 51 to 100 of the 62,313 in his list (part 2 of 1,246). Background: On May 7, 2025, LockBit's affiliate-panel sites were defaced with a link to a MySQL dump of the panel database. BleepingComputer reported that its btc_addresses table held 59,975 unique Bitcoin addresses, alongside victim negotiation chats and affiliate accounts. The dump appears to date from April 29, 2025. What the…

Other addresses in this report: bc1q00ptafnsjzg8vpxn4npq4fn2km8fkqkvsx0j6g, bc1q00qf6mr7nu3n3pvgtt4gerkqmnm0p62mxthg0e, bc1q00qg4wz3wlwh4v773sve3rf0fwnv90uufv97dc, bc1q00qmafecg2n857dmvpsahh03wczzt8vdc9r9mz, bc1q00qx6gz3m9vx0vgdggmre4hpe20nxg4azm7fv3, bc1q00rqqazcak8xer8ddwrxqqx309nqntmgxldc58, bc1q00scsez8pfpvpz6j6d5nz7kmrhe365pzgn2tjl, bc1q00shzvh0avan3ca0xh6xjrgyp33lrp66hllda3, bc1q00svpwujllrgh3yd7p9mxxhaa6m83kx3qu8zjh, bc1q00sy56adptw3d7j6t9hqdk5ckqw45fygvqq5hz, bc1q00u3yvfwgtmk3w5xqjddffdeuavmgzrekn687s, bc1q00uec22a739vm8kcytypp3avdapgp248n5sv3v, bc1q00uj6narg37td0qg4h8l5f0cr3jezrk08flght, bc1q00uuryuhaw3dq5cjxj9jwxqyhpjxv04gu8vps9, bc1q00uuz8vzzzzykaqwtz5k57lmsrpyg2gjuhu4e7, bc1q00v6rh5waqrnddkm5pra4c0k7yrjarvrjvrrvk, bc1q00xqx9mvwaug4dxzd4gntkkl8hnnkm8yq35t86, bc1q00z85qaw7285lu8j9hwx6c2ncnj8naj0ul4uhu, bc1q00zmykv0ec8wh7qlfqe34auqfr3x02asf7gey0, bc1q020393s5j7d0zr36cvrzz948t99yynz6d6c0ge and 29 more

lockbit Ransomware Payment Address

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Ransomware payment address associated with lockbit. This address was used to collect ransom payments from victims. Source: Threat intelligence database aggregated from ransomware tracking services.

lockbit Ransomware Payment Address

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Ransomware payment address associated with lockbit. This address was used to collect ransom payments from victims. Source: Threat intelligence database aggregated from ransomware tracking services.