Hackers Turn the Tables on LockBit, Leak Thousands of Bitcoin Wallets
The breach targeted LockBit’s affiliate panel, revealing 20 database tables, including one containing custom ransomware builds tied to specific targets. Another table, labeled “chats,” held over 4,400 messages documenting negotiations between the cybercriminals and their victims.
Despite the large number of wallet addresses leaked, no Bitcoin private keys were compromised. A LockBit affiliate confirmed the breach in a conversation shared on X (formerly Twitter), while insisting that no sensitive access credentials were lost.
LockBit, considered one of the most dangerous ransomware syndicates globally, has previously been the focus of a multi-nation crackdown. In February 2024, a coalition of 10 countries coordinated an operation that severely disrupted its operations.
Security researchers at Bleeping Computer noted similarities between this breach and a prior compromise of the Everest ransomware site, suggesting a potential connection between the two incidents. The same defiant message “Don’t do crime. CRIME IS BAD xoxo from Prague” appeared in both hacks.
The exposure of these addresses provides investigators with a new avenue to track ransomware payments and potentially link them to real-world identities, underscoring the critical role of cryptocurrency in modern cybercrime.
