FBI Seizes Bitcoin Worth More Than $2.2 Million From Ransomware Affiliate

The Federal Bureau of Investigation (FBI) has seized bitcoin worth more than $2.2 million tied to ransomware payments. The cryptocurrency allegedly belongs to an affiliate of Gandcrab and Revil/Sodinokibi ransomware.

The Federal Bureau of Investigation (FBI) has seized almost 40 bitcoins from a Russian resident tied to Revil and Gandcrab ransomware, according to a court document unsealed Tuesday. The forfeiture complaint reads:

The United States of America files this verified complaint in rem against 39.89138522 bitcoin seized from Exodus wallet … that is now located and in the custody and management of the Federal Bureau of Investigation (FBI) Dallas Division.

At the time of writing, the price of bitcoin is around $56,318.06 based on data from Bitcoin.com Markets. The amount seized totals almost $2.247 million.

The seizure took place on Aug. 3. While the FBI did not reveal how it gained access to the wallet, the court document explains that the wallet contained Revil ransom payments belonging to an affiliate identified as Aleksandr Sikerin (aka Alexander Sikerin and Oleksandr Sikerin), whose email address is [email protected].

According to Bleeping Computer, the name “engfog” in the email address is tied to a well-known Gandcrab and Revil/Sodinokibi affiliate known as “Lalartu.”



Gandcrab and Revil organizations operated as Ransomware-as-a-Service (RaaS), where core operators partner with third-party hackers, known as affiliates, the news outlet noted, adding that ransom payments are split between the affiliate and core operators. The operators usually earn between 20% and 30% of the ransom.

Earlier this month, the U.S. Department of Justice (DOJ) announced that it had seized $6.1 million from Yevgeniy Polyanin, a Russian “charged with deploying Sodinokibi/Revil ransomware to attack businesses and government entities in the United States.”

Meanwhile, the U.S. government has been increasing its efforts to fight ransomware attacks. The Treasury Department has already sanctioned two cryptocurrency exchanges tied to ransom payments.

What do you think about the FBI seizing bitcoin tied to ransomware attacks? Let us know in the comments section below.