https://qz.com/983186/global-hacking-attack-has-russia-and-korea-paying-out-bitcoin/Users with infected computers in Russia and South Korea are so far the two biggest ransom payers to the hackers who mounted a global ransomware attack, called “Wannacry,” yesterday, according to new data from Chainalysis, a provider of software that works with banks, law enforcement agencies, and bitcoin companies to analyze the blockchain for financial crimes.
All bitcoin transactions are permanently recorded on the blockchain, and anyone can view them. Chainalysis crunches these transactions and assigns them to clusters of “entities,” which could be bitcoin exchanges, wallet providers, or bitcoin miners. The firm found that the hackers, who ask for ransom to be sent to three bitcoin addresses, had received a total of nearly $23,000 so far in dollar terms, converted at the point the transaction was made.
The two entities that sent the most money to the hackers were bitcoin exchanges serving the Russian and Korean markets. “If you look at the infection rates, a lot of it is in Russia, so [the data] is complementing that,” says Jonathan Levin, a Chainalysis co-founder. “Given that we know the infections are also in Russia, I would say, it’s Russian users.”
They traced the coins back to the exchanges where the victims bought their bitcoins too. Btc-e tops the list, but pretty much all the exchanges are listed.