Deep dive on a “sextortion” spam email scheme that raked in 50.98 BTC, or ~$473K, over five months and, on some days, accounted for 20%+ of all observed spam
Sophos News : Tweets: @sophoslabs and @thepacketrat Tweets: @sophoslabs : “Some recipients of #sextortion emails do fall for this tactic and pay up. But where does the cryptocurrency go? Researchers from SophosLabs, together with analysts from @ciphertrace, decided to find out.” @ZDNet @SecurityCharlie https://www.zdnet.com/... Sean Gallagher / @thepacketrat : My collab with fellow @SophosLabs researcher Tamás Kocsir (who did the lion's share of the work) and @CipherTrace: Following the money in a massive sextortion spam scheme https://news.sophos.com/...
Context & Ripple Effects
SophosLabs and CipherTrace followed the wallets behind a sextortion spam wave that collected 50.98 BTC (~$473K) over five months and on peak days made up more than 20% of all spam Sophos observed. The collaboration extends a line of research that began with mapping raw spam infrastructure — like the unsecured server behind a massive spam operation that sent 5M+ emails in ten days — toward following where the payments actually land.
The money-tracing angle ties this small-scale scam into the same laundering question that dominates ransomware coverage, from Ryuk operators cashing out an estimated $150M+ through Binance and Huobi to the Crylock couple who earned €64M+ in bitcoin over eight years. Sextortion is the low-friction end of that spectrum: no breach required, just fear and a wallet address.
First-order effects
- Recipients who paid the scheme lost funds directly to wallets now mapped by SophosLabs and CipherTrace, giving investigators their first concrete picture of how many victims pay and where the coins pool.
- The finding that one sextortion campaign could reach 20%+ of daily observed spam quantifies how cheaply such campaigns saturate inboxes, sharpening filter-tuning priorities for email providers.
Second-order effects
- Exchanges sit at the cash-out chokepoint: as with Ryuk's Binance and Huobi flows, every traced sextortion wallet raises compliance pressure on platforms to flag and freeze extortion-linked deposits.
- CipherTrace's role here signals a market for blockchain-analytics firms as standard partners to security vendors and law enforcement, alongside efforts like the Secret Service team recovering $244M+ in BEC funds.
Third-order effects
- If tracing keeps closing the cash-out path, the economics of low-effort extortion erode — pushing operators toward either higher-value targets or the industrialized ransomware model where payouts run to tens of millions.
- The widening gap between sextortion's ~$473K take and ransomware's eight-figure hauls points to a consolidating crypto-crime ecosystem in which exchange KYC rules, not email filters, become the binding constraint.
The trend: Crypto-enabled extortion is being systematically de-anonymized as security researchers and blockchain-analytics firms trace payments back to exchange cash-out points.