Pierluigi Paganini October 16, 2021

The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) linked roughly $5.2 billion worth of Bitcoin transactions to ransomware.

The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) has identified approximately $5.2 billion worth of Bitcoin transactions likely associated with operations of top 10 most commonly reported ransomware variants

FinCEN analyzed a data set composed of 2,184 SARs filed between 1 January 2011 and 30 June 2021 and identified 177 CVC (convertible virtual currency) wallets addresses that were used in ransomware operations associated with the above ransomware variants.

The US agency identified $590 million in ransomware-related SARs, +42 compared to 2020,

“FinCEN identified $590 million in ransomware-related SARs, a 42 percent increase compared to a total of $416 million for all of 2020. If current trends continue, SARs filed in 2021 are projected to have a higher ransomware-related transaction value than SARs filed in the previous 10 years combined, which would represent a continuing trend of substantial increases in reported year-over-year ransomware activity.” reads the report published by FinCEN.

Studying data generated from ransomware-related SARs, the mean average total monthly suspicious amount of ransomware transactions was $66.4 million and the median average was $45 million.

According to the financial trend analysis, the most popular ransomware-related payment method in reported transactions was Bitcoin.

FinCEN identified 68 active ransomware variants, the most commonly reported ones were REvil/Sodinokibi, Conti, DarkSide, Avaddon, and Phobos.

FinCEN also identified most common money laundering techniques used by ransomware operators in 2021, including payments in Anonymity-enhanced Cryptocurrencies (AECs) like Monero, avoiding reusing wallet addresses, “chain hopping” to exchange funds into other cryptocurrency scheme, cashing out at centralized exchanges, and using mixing services and decentralized exchanges.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, FinCEN)

[adrotate banner=”5″]

[adrotate banner=”13″]