How Monero, a cryptocurrency that obscures the sender and receiver, is increasingly being used by ransomware gangs wary of bitcoin's traceability
Untraceable ‘privacy coin’ is rising in popularity among ransomware gangs, posing problems for law enforcement Tweets: @tomhillenbrand , @katie_martin_fx , and @financialtimes Tweets: @tomhillenbrand : Did you know ransomware “providers” offer their victims different payment options? You can send bitcoin, but if you wire them monero, you get a discount: https://www.ft.com/... Katie Martin / @katie_martin_fx : Inside monero, emerging crypto of choice for cybercriminals https://www.ft.com/... via @financialtimes @financialtimes : ‘Privacy coin’ has become a sought-after tool for criminals such as ransomware gangs, posing new problems for law enforcement https://www.ft.com/...
Context & Ripple Effects
The migration away from bitcoin has been building since 2018, when high fees and limited anonymity pushed cybercriminals toward altcoins like Monero. What the FT adds now is the commercial detail: ransomware 'providers' price the choice directly, offering victims a discount for wiring Monero instead of bitcoin.
The story lands between two other threads in this coverage: forensic firms tracking how criminals cash out through unlicensed exchanges and OTC brokers, and US investigators tracing payments back to Moscow's Federation Tower East. Monero attacks the first link in that chain — the payment itself — before any exchange or broker is involved.
First-order effects
- Ransomware gangs now steer victims toward Monero with explicit pricing incentives, making the privacy coin a default rather than an alternative for groups like those tracked in the NetWalker revenue reports.
Second-order effects
- Law-enforcement tracing work shifts downstream: with on-chain payment analysis blunted, investigators lean harder on the cash-out layer — unlicensed exchanges, OTC brokers, and the forensic firms that monitor them — while ransomware negotiators like Kurtis Minder lose the leverage that traceable bitcoin wallets once provided.
Third-order effects
- If discount-for-Monero becomes standard across ransomware kits, pressure builds for regulators and exchanges to restrict privacy coins outright, pushing criminal liquidity further into unlicensed channels and jurisdictions like those implicated by the Moscow tracing findings.
The trend: Ransomware economics are consolidating around privacy coins as bitcoin's public ledger turns from asset into liability for criminal operators.