Russia-Affiliated Addresses Received 74% of Ransomware Revenue Last Year: Chainalysis

Almost three-quarters of revenue from ransomware attacks last year, or $400 million, went to addresses that are “highly likely” to be affiliated with Russia, according to a report from crypto analytics firm Chainalysis.

The firm determines whether ransomware strains are affiliated with Russia based on three criteria: Whether they avoid attacking former Soviet countries, markers such as language and location and whether they are related to Russia-based cybercrime organization Evil Corp., Chainalysis said on Monday.
Ransomware attacks have grown in the past year, according to a joint report of U.S., U.K. and Australian cybersecurity authorities. North American addresses are the biggest targets, according to another Chainalysis report. The U.S. government is pushing for measures to combat this type of attack, in which hackers hold a firm’s data hostage.
In 2019-2021, between 29% and 48% of all crypto going to addresses belonging to businesses in Moscow City, the Russian capital’s financial center, came from “illicit and risky” addresses, said the research report.
The recipients included Suex, an over-the-counter exchange that has been sanctioned by the U.S. government; Eggchange, whose co-founder was reportedly arrested by Russian authorities in November; and peer-to-peer exchange Bitzlato.
These firms are linked to money laundering of the illegally obtained funds, Chainalysis said.
Some instances of firms receiving low proportions of illicitly obtained crypto can be attributed to their lack of awareness, rather than criminal activity, the report said.
Of all the crypto going to Moscow City, funds coming from scams at $313 million and darknet markets at $296 million made up the majority of illicit crypto in that time period. Ransomware came third at $38 million.

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Eliza Gkritsi

Eliza Gkritsi is CoinDesk's crypto mining reporter.

Follow @egreechee on Twitter

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.