bc1q0478h9sv4udsrw4887vtv28zg8vm0t3hyjw7x6

Ransomware Payment Wallets

• Scam type: Malware
• Chain: Bitcoin
• Reported: 2026-04-25
• Last updated: 2026-04-25

Ransomware payment addresses used by LockBit, Conti, BlackBasta, and other ransomware groups for ransom collection and extortion.database. These wallets were identified through analysis of ransomware campaigns and victim payment tracking.

Other addresses in this report: bc1q045u3dk6jjhs5qxj72rduj5h2lhjr32k3xaxx6, bc1q045vukdz6atnex7s4uqycaca636gn9xkmlh0yw, bc1q0463edujsr96wkgh9xquk8t7a7xqwtuwakuclx, bc1q04682n2t7h5thkdjhjaaggv887fqezkn6z0xyq, bc1q0472wt7zsxazjdctrswgujgpzu5xsgte8esu4d, bc1q0477zhhlp76yjhmeu77n0grf92c6tma3llrw6y, bc1q048e7nrvtn8fn27heyghjsq79m5nfpte47wmkv, bc1q048nd2rxt0lkamgkd2440rz0rw29rqq2lx7j8r, bc1q0493emqhh956mzte4uxm49awz07rcaqur62487, bc1q04a0vfdg454awdt455nlp5qjut82aydjx7yfqr, bc1q04a0xhx4tpz7mm4emvxvhu3uvvn2xsgsdeajnk, bc1q04a900ay6wvj0w9mszusrrc7adgz0v8f6sgcdn, bc1q04a96r204pvdywcr45mk7r5rts4zqkfjjwnme0, bc1q04alnwttsfqwfe70z89uk2pjlfm259lt3khqrq, bc1q04dapt4l5knu5a600ne6r2tgsuzk39tdcvx5pk, bc1q04fn2uvygp5jp7vzvgyuevn5j977yt904sq9uk, bc1q04gu8zm6naps9sckdhr4tc9u78ktteurzgmy9p, bc1q04hf0k0uspt60mzae66qtgckkdstqnwllqdcsu, bc1q04hqasmw4d7cyugdczhgqjt58yljt92xtwskw7, bc1q04jya927nmtepgcmf7nmlhpdfkmm8f88ykrqma and 29 more

Ransomware Wallets — ransomware addresses

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Ransomware payment wallet. Source: crowdsourced ransomware wallet tracking database. Entities: lockbit. Programs: lockbit.

Other addresses in this report: bc1q03rcajyy42x0q7v9rrzpn68ftvl74vcz7rl4g0, bc1q03s754zufxq6xdxecncpftsca6qpctr5cr3n0j, bc1q03savltm2u9vlgna93dkhuvazqt0ykhkdqqezg, bc1q03sj24vqgrvudpa75u3w23ha9qqgnnslexuh5w, bc1q03sta4ta7srmslqrq74djrcdecp8nwwa3vscny, bc1q03sxwhn56ddkwzynxpmnxkwy6uaguqts6x7s2n, bc1q03sy4wawxxahehmgrq8nfugf0hdfha25h6j9rj, bc1q03szjkzqzus3mpqem6j3ery3xcgr92qfwaduks, bc1q03t9pfzz7ng22v9t9gfq0mkz22qr6vx68kcc32, bc1q03tpmdux8sw00lgvskd7ltmz3nql7d2vcj5d6v, bc1q03tv67jz672x9dafsxnse74ufvx5njxd8h3n7c, bc1q03u44m75tnsxs0zwdxltenwlwl27cxf0a26tk9, bc1q03uj6yrwge3ry06u6266ey8vggcdx859jmvsw3, bc1q03veyusaje8tkk372pmmr49z3j2l894uwqmlew, bc1q03wz8ftyt7we54vdwn24ayv4yw7j0f0qp4ywp2, bc1q03xaexxfw9l3qv90uzwxmve2rcy5f7pmdzcg5k, bc1q03xkffdxc3mvlq9qh0yhcm0s5u8ec7pcm647q3, bc1q03xmneuetspdjqrpm3r6efppcz57s6axkc2mjr, bc1q03xn3tz42c4hrqm2qsfpvtnaf8sjyge9kta8cj, bc1q03xtp42khg3hcxy8y7cmxx5xlgjj0s5m82hqvj and 29 more

LockBit ransomware: Bitcoin addresses from the leaked LockBit affiliate-panel database (Danchev list), part 5 of 1,246

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-10-27

Bitcoin addresses that security researcher Dancho Danchev published as LockBit addresses from the May 7, 2025 leak of the LockBit ransomware affiliate-panel database. This report holds 50 of them, entries 201 to 250 of the 62,313 in his list (part 5 of 1,246). Background: On May 7, 2025, LockBit's affiliate-panel sites were defaced with a link to a MySQL dump of the panel database. BleepingComputer reported that its btc_addresses table held 59,975 unique Bitcoin addresses, alongside victim negotiation chats and affiliate accounts. The dump appears to date from April 29, 2025. What the…

Other addresses in this report: bc1q0450kts9gnah2mle8c79dhqgrhfjjzhzz90a7q, bc1q0459a0jn80xzcsna4s7cm6xhtyyhkel879qxn2, bc1q045ky2vwfsenh6wf9c33jue9e5vwnwkprevqcz, bc1q045t500t6dmrtdz0cmjqm2j4lxw8v855wch3ej, bc1q045u3dk6jjhs5qxj72rduj5h2lhjr32k3xaxx6, bc1q045vukdz6atnex7s4uqycaca636gn9xkmlh0yw, bc1q045xv5ysdpxmnsqsyh7j7gdy7fasnuxqz6y0fq, bc1q0463edujsr96wkgh9xquk8t7a7xqwtuwakuclx, bc1q04682n2t7h5thkdjhjaaggv887fqezkn6z0xyq, bc1q0477zhhlp76yjhmeu77n0grf92c6tma3llrw6y, bc1q048e7nrvtn8fn27heyghjsq79m5nfpte47wmkv, bc1q048mu7cl9s6zwh3fjrdnjhqggk8qgaurccvjxj, bc1q048nd2rxt0lkamgkd2440rz0rw29rqq2lx7j8r, bc1q0493emqhh956mzte4uxm49awz07rcaqur62487, bc1q04a0vfdg454awdt455nlp5qjut82aydjx7yfqr, bc1q04a0xhx4tpz7mm4emvxvhu3uvvn2xsgsdeajnk, bc1q04a900ay6wvj0w9mszusrrc7adgz0v8f6sgcdn, bc1q04a96r204pvdywcr45mk7r5rts4zqkfjjwnme0, bc1q04alnwttsfqwfe70z89uk2pjlfm259lt3khqrq, bc1q04dapt4l5knu5a600ne6r2tgsuzk39tdcvx5pk and 29 more

lockbit Ransomware Payment Address

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Ransomware payment address associated with lockbit. This address was used to collect ransom payments from victims. Source: Threat intelligence database aggregated from ransomware tracking services.

lockbit Ransomware Payment Address

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Ransomware payment address associated with lockbit. This address was used to collect ransom payments from victims. Source: Threat intelligence database aggregated from ransomware tracking services.

lockbit Ransomware Payment Address

• Scam type: Ransomware
• Chain: Bitcoin
• Reported: 2026-04-22
• Last updated: 2026-04-22

Cryptocurrency address used to collect ransom payments by lockbit. Victims directed to this address in ransom notes.