60,000 Bitcoin Addresses Leaked as LockBit Ransomware Gang Gets Hacked

In a shocking turn of events, hackers have breached the dark web affiliate panel of the notorious LockBit ransomware gang, exposing almost 60,000 Bitcoin addresses tied to the group's illicit operations. The breach has left many questions unanswered, but one thing is clear: the impact will be felt far beyond the cybercrime community.

The attackers, who went by the pseudonym "Don't do crime CRIME IS BAD xoxo from Prague," gave the LockBit gang a taste of their own medicine. By sharing a MySQL database dump publicly online, they exposed a treasure trove of crypto-related information that could help blockchain analysts trace the group's illicit financial flows. The leak included 20 tables, including individual ransomware builds created by the organization's affiliates, as well as over 4,400 negotiation messages between victims and the ransomware organization.

Ransomware is a type of malware used by malicious actors to lock their target's files or computer systems, making them inaccessible. The attackers typically demand a ransom payment, often in digital assets like Bitcoin (BTC), in exchange for a decryption key to unlock the files. LockBit is one of the most notorious crypto ransomware groups, having caused billions in damages to key infrastructure.

In February 2024, 10 countries launched a joint operation to disrupt the group, saying that the organization had caused significant harm to critical infrastructure. While the breach has exposed almost 60,000 Bitcoin wallets, no private keys were included in the leak. However, one X user shared a conversation with a LockBit operator, confirming the breach. The LockBit person claimed that no private keys or data were lost, but analysts at Bleeping Computer say otherwise.

The database contained a "builds" table, which included individual ransomware builds created by the organization's affiliates. It also identified some of the target companies for these builds. Additionally, the leaked database included a "chats" table, containing over 4,400 negotiation messages between victims and the ransomware organization.

The breach highlighted the role that crypto plays in the ransomware economy. Each victim is usually assigned an address to pay their ransom, allowing the affiliates to monitor payments while attempting to obscure ties to their main wallets. The exposure of these addresses allows law enforcement and blockchain investigators to track patterns and potentially link past ransom payments to known wallets.

The identity of those behind the breach remains a mystery, but Bleeping Computer analysts suggest that there may be a link between this incident and another recent ransomware breach involving the Everest ransomware site. The message used in the Everest breach matched the one used by LockBit, fuelling speculation about a potential connection between the two incidents.

The impact of this breach will likely be felt for some time to come. As the world grapples with the growing threat of cybercrime, it's essential that law enforcement and blockchain investigators stay one step ahead of these malicious actors. Will they succeed in tracking down those responsible for the LockBit hack? Only time will tell.