Russian Authorities Say They’ve Dismantled REvil Ransomware Group at US Request

The FSB raided 25 residences, seizing approximately $6.8 million in various currencies including cryptocurrencies.

AccessTimeIconJan 18, 2022 at 7:52 p.m. UTC
Updated May 11, 2023 at 6:34 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Russia’s top domestic intelligence agency says REvil – the Russia-based ransomware gang tied to the Colonial Pipeline attack – has “ceased to exist” after the agency arrested 14 alleged members of the criminal organization last week.

The Federal Security Service (FSB) raided 25 residences tied to REvil, seizing approximately $6.8 million in various currencies – including cryptocurrencies. The FSB also seized computer equipment, crypto wallets “that were used to perpetrate crimes” and 20 luxury cars, according to a Jan. 14 press release.

The FSB said the arrests were carried out at the request of “US authorities.”

U.S. President Joe Biden has been pressing Russian authorities to act against REvil and other Russian cyber criminals since last summer, when REvil demanded $70 million in bitcoin payments after hacking Miami-based software provider Kaseya. Russia has been slow to take action. Last week’s arrests are the first time – at least publicly – that Russian authorities have acted against one of the many ransomware groups based in Russia.

It is also the first time in years that U.S. and Russian intelligence agencies teamed up on a cyber crime operation. A few observers of U.S.-Russian relations have highlighted that the timing of the arrests coincides with Russia’s escalating efforts to invade Ukraine.

A White House official speaking on the condition of anonymity told reporters last Friday that the U.S. did not consider the arrests to be related to the ongoing events in Ukraine.

Russia’s motives for tackling REvil aside, the arrests are part of an uptick in global collaboration against ransomware gangs. Last year, Romanian, Kuwaiti and South Korean authorities independently arrested suspected members of REvil-affiliated hacking groups.

The momentum has continued into this year.

On Jan. 17, Europol announced that it had seized 15 servers belonging to, a virtual private network provider that catered to cyber criminals and ransomware gangs, rendering the company’s virtual private network (VPN) services inoperable.

UPDATE (January 25, 2022, 4:26 UTC): Updates information that REvil demanded $70 million in ransom.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Cheyenne Ligon

Cheyenne Ligon is a CoinDesk news reporter with a focus on crypto regulation and policy. She has no significant crypto holdings.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.