One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam. In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told to add their own money in order to get paid. On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.

We live in unprecedented times. But DPRK are up to their old tricks. We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack. Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds

On April 1, 2026, the Drift exploiter sent funds from five exploit wallets into a stopover wallet across 13 transactions. The wallet then sat dormant until today. Today, $61.5M moved from that wallet into Tornado Cash in 100 ETH tranches. We are continuing to monitor the situation.

A recent data leak alleged to reveal the inner workings of Silent Ransom Group (SRG), a prolific Russia-based hacker group that has extorted millions of dollars from US law firms and financial institutions. Chainalysis confirms the legitimacy of crypto addresses included in the leak; they are tied to SRG, aka Luna Moth or Chatty Spider. While we cannot speak to the totality of claims documented in the leak, we can confirm that certain leaked SRG addresses sit downstream of millions of dollars in ransomware payments that SRG has extorted from victims. This Reactor graph shows how we connect the dots. On the right side are two operational addresses contained in the leak. They collected hundreds of thousands of dollars in bitcoin from a member of SRG. We understand these six-figure transfers as payment for services to sustain Silent ransomware operations. Our confidence stems from the leaked addresses’ transaction history. Several payment addresses contained within the leaks source their funds from confirmed SRG ransom payments. For example, one of the Silent member’s wallets specified in the leaked chats is funded entirely from a $10 million+ victim payment that SRG collected in mid-2026, and which we were tracking before the leak. Most of the addresses contained with the leak are reinvesting the proceeds of ransomware into operating expenses, including paying teams and individuals for infrastructure and services. We are continuing to review the leak for actionable intelligence.

Today, OFAC sanctioned an FBI Top 10 fugitive and Tren de Aragua member who allegedly stole millions from U.S. ATMs using malware loaded on Raspberry Pis — and laundered the proceeds through crypto. Our investigators analyzed the on-chain network surrounding the now-sanctioned wallets. What we found: counterparties with exposure to known money laundering operations based in Mexico, Colombia, and Venezuela that have been used by drug cartels, smugglers, and other illicit actors. While the underlying crimes differ, criminal organizations rely on common laundering infrastructure to move funds. ATM jackpotting proceeds flow through the same channels as drug trafficking money. "The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering," said Chainalysis Senior Intelligence Analyst Kaitlin Martin. "These are insights that only the blockchain can provide." We also found these networks heavily use stablecoins to move criminal proceeds globally. Stablecoins offer price stability, but they also leave these networks susceptible to advanced monitoring and instant freezing actions. This action is part of a broader government campaign: 30+ actions against 300+ individuals and entities tied to transnational criminal organizations since 2025. As these groups increasingly route funds through crypto, on-chain intelligence becomes critical. Read our full analysis: chainalysis.com/blog/ofac-sa…

Today, OFAC sanctioned an FBI Top 10 fugitive and Tren de Aragua member who allegedly stole millions from U.S. ATMs using malware loaded on Raspberry Pis — and laundered the proceeds through crypto. Our investigators analyzed the on-chain network surrounding the now-sanctioned wallets. What we found: counterparties with exposure to known money laundering operations based in Mexico, Colombia, and Venezuela that have been used by drug cartels, smugglers, and other illicit actors. While the underlying crimes differ, criminal organizations rely on common laundering infrastructure to move funds. ATM jackpotting proceeds flow through the same channels as drug trafficking money. "The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering," said Chainalysis Senior Intelligence Analyst Kaitlin Martin. "These are insights that only the blockchain can provide." We also found these networks heavily use stablecoins to move criminal proceeds globally. Stablecoins offer price stability, but they also leave these networks susceptible to advanced monitoring and instant freezing actions. This action is part of a broader government campaign: 30+ actions against 300+ individuals and entities tied to transnational criminal organizations since 2025. As these groups increasingly route funds through crypto, on-chain intelligence becomes critical. Read our full analysis: chainalysis.com/blog/ofac-sa…

Chainalysis' investigation of Xinbi Guarantee finds that DPRK-linked threat actors moved tens of millions in stolen crypto through the newly-sanctioned cybercriminal marketplace. To launder stolen cryptocurrency, DPRK-linked threat actors have used specialized vendors known as "Black U" launderers on the Xinbi platform. These vendors accept traceable stolen funds and replace them with stablecoins sourced from separate illicit revenue streams, including the proceeds of pig butchering and romance scams. The stolen crypto is absorbed into a much larger pool of illicit volume, while the threat actors walk away with nominally "clean" stablecoins they can move to unlicensed OTC desks for conversion to fiat. Black U vendors are one piece of a much larger criminal marketplace. Xinbi processed an estimated $24 billion and hosted vendors spanning cash delivery, bank card fraud, personal data sales, KYC bypass, scam platform development, surveillance equipment, and malware services. Its vendor channels also served as recruitment pipelines for Southeast Asian scam compounds where trafficked workers are held under forced labor, torture, and physical confinement. Xinbi's hulking criminal footprint made it a top-priority target for international enforcement. OFAC and FCDO have both sanctioned Xinbi, and the DOJ today seized its infrastructure and froze $52 million in illicit crypto.

The FBI seized $560,000 in crypto from Hamas over the past 18 months. Agents used blockchain analytics to follow the money on-chain. Here’s how they did it. 1/5