Analysis: the wallet used by DarkSide received a total of $17.5M in Bitcoin transactions since March, including a 75 BTC payment made by Colonial
Elliptic BlogDr. Tom Robinson
Context & Ripple Effects
DarkSide's claimed loss of control over its servers and funds came just as blockchain analysis identified a wallet that had received $17.5M since March, including Colonial's 75 BTC payment. The two reports make the group’s payment infrastructure, rather than only its public-facing extortion operation, central to the story.
The reported wallet total gives a concrete scale to the group’s collection activity while its operators were asserting that funds were no longer under their control. Earlier reporting on DarkSide’s claimed loss of servers and funds frames the wallet trail as evidence relevant to the disruption’s financial impact.
First-order effects
Colonial’s 75 BTC payment is tied to a specific DarkSide-associated wallet, making that transfer part of a documented $17.5M transaction history.
DarkSide’s claim that it lost access to funds is more consequential because the associated wallet’s inflows are publicly traceable even if control of the funds is disputed.
Second-order effects
Organizations responding to DarkSide-linked incidents gain a shared on-chain reference point for tracking payments associated with the group’s collection infrastructure.
DarkSide’s loss-of-control claim undermines the reliability of its payment channel for victims and affiliates, because both the wallet activity and the reported disruption are now visible to outside researchers.
Third-order effects
The episode points to ransomware payment operations becoming easier to map financially when groups reuse identifiable wallet infrastructure, even as their hosting and communication systems can disappear quickly.
If public wallet attribution continues to accompany ransomware investigations, operational resilience will depend increasingly on whether groups can separate payment collection from the infrastructure that exposes their identity and access.
The trend: Ransomware disruption is increasingly being assessed through the collision of public blockchain payment trails and the fragility of criminal groups’ online infrastructure.
H/t @AShoutOutfromMN “The wallet has been active since 4th March 2021 and has received 57 payments from 21 different wallets. Some of these payments directly match ransoms known to have been paid to DarkSide by other victims ...” https://twitter.com/...
“DarkSide's criminal efforts brought in at least $60 million in the first 7 months of operation, with $46 million of it coming in the first quarter of 2021...[but] the ransomware gang's total haul was likely larger” https://www.wsj.com/...
“The hosting support service doesn't provide any info except ‘at the request of law enforcement authorities.’ [Also], a couple of hours after the seizure, funds from the payment server (belonging to us & our clients) were withdrawn to an unknown account.” https://arstechnica.com/…
Darkside's operators have received $17.5 million in Bitcoin payments since March per @elliptic Those funds appear to have been laundered through Hydra which converts the cryptocurrency into gift vouchers, prepaid debit cards etc. https://twitter.com/...
BREAKING: @elliptic has identified the Bitcoin wallet used by the DarkSide ransomware group to receive ransoms from Colonial Pipeline and other victims. Learn more, including where the bitcoins ended up.. https://www.elliptic.co/...
Research from @elliptic into the payments made into DarkSide's Bitcoin wallets. $17m since March. Since. March. https://www.elliptic.co/... https://twitter.com/...
“Elliptic has identified the Bitcoin wallet used by the DarkSide... this wallet received the 75 BTC payment made by Colonial Pipeline on May 8, following the crippling cyberattack on its operations.” So CP paid ransom on Saturday (depending on which timezone this uses) https://tw…
DarkSide releases a msg saying they are done, adding that their infrastructure was seized — Victim blog, CDN, ransom collection site — and their crypto wallets were emptied. Also sent affiliates decryption tools to unlock any ongoing ransom incidents. https://www.intel471.com/...