Laundering ransomware payments

As of November 2026: Figures and actions are stated as of the dates of the sources above. FinCEN's counts come only from reports that financial institutions filed, so they understate total ransomware activity, and FinCEN's 2021 advisory says ransomware reporting is likely incomplete. The Colonial Pipeline seizure and the 2025 Chaos forfeiture complaint rest on affidavits and allegations, and the outcome of the Chaos case was not confirmed for this page. The charges against Sergey Ivanov are allegations. Designations and orders against Suex, Chatex, Garantex, Bitzlato and Cryptex are described as announced; whether each remains in force was not rechecked, and the Garantex case page covers its later history. No FinCEN ransomware advisory or trend report newer than December 2025 was located. FATF's July 2026 virtual asset update was not reviewed for this page.

Also called: ransomware money laundering · ransom payment laundering · extortion proceeds laundering.

What is ransomware payment laundering?

Ransomware is malicious software that blocks access to a computer system or its data, often by encrypting it, so the attacker can demand payment for restoring access. In many attacks the criminals also steal files and threaten to publish them. The attack is the crime. Laundering is the follow-on step that turns a payment into money the criminals can spend. FinCEN notes that extortion and computer fraud are both predicate offences to money laundering.

The scale is large, although nobody sees all of it. FinCEN’s December 2025 analysis covers 7,395 reports that financial institutions filed under the Bank Secrecy Act. They describe 4,194 ransomware incidents and more than $2.1 billion in payments between 2022 and 2024. FinCEN warns that this data shows only activity that was identified and reported. The FATF adds that criminals use crypto almost exclusively and have easy access to virtual asset service providers around the world.

This page reads the evidence from the investigator’s side. It covers what regulators, prosecutors and blockchain analysts have said in public about how the money moves, and it stays with the records of enforcement actions.

How are the proceeds moved?

Public records describe a consistent chain.

1. The victim buys crypto. FinCEN’s advisory says the victim typically sends a wire, an ACH transfer or a card payment to a crypto exchange to buy the amount demanded. The victim, or a firm working for the victim, then sends the coins to the attacker’s address. Cyber insurers and incident response firms sometimes arrange this, and FinCEN says some of them and some money services businesses receive the victim’s funds, exchange them for crypto and pass them on. Depending on the facts, that can count as money transmission, which carries registration and reporting duties.
2. The attacker collects the payment. FinCEN’s 2025 analysis found that attackers overwhelmingly collected payments in unhosted wallets, meaning wallets with no exchange holding the funds. The wallet is the first point where the victim’s money becomes the criminals’ money.
3. The proceeds are shared. Many gangs run on ransomware-as-a-service, where a developer supplies the software and takes a cut. In the Colonial Pipeline attack, FinCEN says, the group that carried it out passed part of the ransom to DarkSide, which wrote the ransomware. FinCEN’s 2025 analysis also points to specialist sellers of initial access to victim networks. So one payment can fan out to several parties early.
4. The funds are split and swapped. The advisory says launderers move funds through mixers, tumblers and chain hopping, and may break amounts into smaller transfers across many addresses, accounts and exchanges, including peer-to-peer and nested exchanges. Mixers pool coins from many users so that coins out are not tied to coins in. FinCEN also reports that some groups demanded or favoured privacy-enhanced coins such as Monero, which appeared in 2% of the 2022 to 2024 reports.
5. The cash-out happens at an exchange. To turn the crypto into ordinary money, FinCEN says criminals often use exchanges with weak compliance, or exchanges in jurisdictions with little oversight. Treasury has said that exchanges of this kind are critical to ransomware profits because they launder and cash out the proceeds. The Cryptex and PM2BTC actions fit this pattern: FinCEN found PM2BTC offered direct conversion between crypto and rubles using US-sanctioned banks.
6. The money re-enters the ordinary economy. FinCEN describes this as converting dirty crypto into the criminals’ preferred legal tender so it can be integrated back into the financial system. At this point the money looks like a bank balance, and the trail lives in the records of the businesses that handled it.

Why does it work?

Speed. Crypto payments are nearly instant, so funds can be several hops away before anyone calls the police. The FATF says authorities need the skills and tools to trace such transactions and to recover assets before they dissipate.

A service economy. The gangs buy what they need. Developers sell tools, access sellers sell entry to networks, and some exchange operators sell cash-out. Treasury said of Garantex that it, like other exchanges Treasury named, facilitates illicit activity for its own gain. FinCEN’s 2021 advisory also said criminals prefer to launder in places with weak anti-money laundering controls.

Under-reporting and borders. FinCEN assesses that ransomware activity is under-reported, so some payments never reach investigators. The FATF adds that the transnational nature of these attacks and their laundering makes international cooperation essential.

None of these advantages is permanent. The public ledger keeps a permanent record, and the cash-out step needs a business that holds real accounts.

Real cases: Colonial Pipeline and the exchanges behind the gangs

Colonial Pipeline, 2021. On or about May 7, 2021, Colonial Pipeline was hit by ransomware, and the company took parts of its infrastructure offline. FinCEN says the FBI later attributed the attack to a Russian-speaking group known as DarkSide. Colonial told the FBI it paid a ransom of about 75 bitcoins. On June 7, 2021, DOJ announced it had seized 63.7 bitcoins, worth about $2.3 million, as the alleged proceeds of the May 8 payment. According to the supporting affidavit, agents reviewed the public bitcoin ledger, tracked multiple transfers, and found the 63.7 bitcoins at an address for which the FBI held the private key. DOJ credited Colonial’s quick notice to the FBI. The case shows two things: a public ledger can work against the launderer, and early reporting matters.

The exchanges. Enforcement has also targeted the cash-out layer:

• On September 21, 2021, OFAC designated Suex, the first sanctions action against a virtual currency exchange. Treasury said it had handled proceeds from at least eight ransomware variants and that over 40% of its known transactions were tied to illicit actors.
• On November 8, 2021, OFAC designated Chatex and related companies, saying over half of Chatex’s known transactions traced to illicit or high-risk activity, and tying it to Suex.
• On April 5, 2022, OFAC designated Garantex and said nearly $6 million of its transactions came from the Conti ransomware gang. See the Garantex case for what followed.
• On January 18, 2023, FinCEN named Bitzlato a primary money laundering concern, the first use of a new Russia-related power. FinCEN said it played a critical role in laundering crypto for ransomware actors in Russia, including Conti, and barred US financial institutions from transmittals to it.
• On September 26, 2024, Treasury sanctioned Cryptex, which it said had received over $51.2 million from ransomware attacks, and named Sergey Ivanov, who is alleged to have laundered hundreds of millions of dollars for ransomware actors and others. The State Department offered up to $10 million for information on him. His indictment is an allegation.

Smaller seizures continue. In July 2025 DOJ filed a civil complaint to forfeit 20.2891382 bitcoin, seized in April 2025, that it alleges was traced to an address tied to a member of the Chaos ransomware group. For a mixer that investigators traced to ransomware and other crime, see the ChipMixer case, and for a darknet market that took ransomware money, see Hydra.

How does it get caught?

• Following the ledger. Bitcoin transactions are public and permanent, so analysts can follow transfers from a known ransom address, as in the Colonial and Chaos seizures. Wallet addresses supplied in reports give investigators starting points to follow.
• Reports from banks and exchanges. FinCEN asks institutions to report suspected ransomware payments in suspicious activity reports using the key term “CYBER FIN-2021-A004,” and to include technical details such as wallet addresses, IP addresses and email addresses. A suspicious activity report is required from $5,000 where there is suspicion of illegal funds or no apparent lawful purpose. Reports on attempted payments count too.
• Targeting the cash-out. Sanctions, FinCEN orders and domain seizures go after the exchanges the gangs rely on. They also put every other business on notice that dealing with a named exchange creates legal risk. Cryptex’s infrastructure was seized by US and Dutch authorities.
• Disrupting the groups. FinCEN’s 2025 analysis notes that reported incidents fell in 2024 after US authorities disrupted the ALPHV/BlackCat group in December 2023 and, with the UK, the LockBit group in February 2024.
• International cooperation. The FATF’s 2023 report urges countries to build on existing cooperation channels and to bring cyber-security and data protection agencies into financial investigations.

The pattern across these records is that the gangs are strongest at the attack and weakest where crypto meets a business that keeps customer records. For how tips, analytics and reports turn into cases, see the detection overview.

First published November 7, 2026 · Last updated November 7, 2026 · Legal statuses current as of November 2026