WannaCry operator empties Bitcoin wallets connected to ransomware

Bot set up by Quartz reporter Keith Collins catches linked wallets being emptied.

Whoever was behind the WannaCry cryptoransomware worm that ravaged networks worldwide in May has finally collected the ransom paid by some of the worm's victims. The value of bitcoins had grown to about $140,000, but the currency's value got about a 20 percent boost on August 1 triggered by a split in the Bitcoin market, as Quartz reports.

After the initial wave of infections in May 2017, the three wallets identified by security researchers as being associated with ransomware's code collected an estimated $70,000 in bitcoin. The ransom payments continued to roll in over the summer, but the value of the gains amassed by the ransomware—which spread with the aid of a National Security Agency exploit leaked by the Shadowbrokers—got that 20 percent bump on August 1. That surge is because a project called Bitcoin Cash managed to recently "fork" the Bitcoin blockchain, creating what is effectively a new cryptocurrency that bypasses the transaction limits on the established Bitcoin blockchain.
The movement of the WannaCry-related bitcoins was first reported by Quartz' Keith Collins, who had set up a "bot" to track transactions involving the wallets.

However, the movement of the bitcoin out of the wallets does not indicate that the operators of WannaCry have been able to totally cash out. To launder the blockchains acquired through the ransomware, they would have to use a "bitcoin mixer" service to try to conceal the transaction record in order to prevent the cashout from being connected with the malware outbreak.

That might be made more difficult by the recent arrest in Greece of Alexander Vinnik, who operated and owned a stake in the BTC-e bitcoin exchange. The Justice Department claimed in an indictment that Vinnik was involved in an over $4 billion money-laundering operation through BTC-e.