Ransomware in an AML report
Payments extorted by locking or threatening to leak a victim’s data.
What it means
Ransomware groups lock or steal victims’ data and demand payment in crypto. Their payment addresses and the wallets they cash out through are tracked by analytics firms and law enforcement.
Why it is a risk for you as the recipient
Ransom payments are proceeds of crime, and some groups are sanctioned. Coins with ransomware history are among the most likely to be frozen and reported.
- Chainalysis estimates ransomware groups received about USD 820 million in on-chain payments in 2025, down from a revised USD 892 million in 2024.[1]
- The first crypto addresses OFAC ever published were linked to people who helped cash out SamSam ransomware payments.[2]
Example situation
Illustrative scenario, not a real case. An address offering USDT in exchange for cash received funds that were converted from bitcoin paid to a known ransomware wallet. The chain is several hops long — which is exactly what a check is for.
What to do if it shows up in a report
- Decline the transfer.
- If you are a ransomware victim, contact law enforcement before paying anything.
FAQ
Why do some reports say “Ransom” instead of “Ransomware”?
Labels differ between providers. AMLBot, for example, uses “Ransom” for coins obtained by extortion or blackmail.
Sources
- Chainalysis (original research report) — Crypto Ransomware: 2026 Crypto Crime Report. Checked 4 Nov 2026.
- U.S. Department of the Treasury — Treasury Designates Iran-Based Financial Facilitators of Malicious Cyber Activity and for the First Time Identifies Associated Digital Currency Addresses (sm556) (28 Nov 2018). Checked 4 Nov 2026.