Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnWeb3SquareMore
Trade
Spot
Buy and sell crypto with ease
Margin
Amplify your capital and maximize fund efficiency
Onchain
Going Onchain, without going Onchain!
Convert
Zero fees, no slippage
Explore
Launchhub
Gain the edge early and start winning
Copy
Copy elite trader with one click
Bots
Simple, fast, and reliable AI trading bot
Trade
USDT-M Futures
Futures settled in USDT
USDC-M Futures
Futures settled in USDC
Coin-M Futures
Futures settled in cryptocurrencies
Explore
Futures guide
A beginner-to-advanced journey in futures trading
Futures promotions
Generous rewards await
Overview
A variety of products to grow your assets
Simple Earn
Deposit and withdraw anytime to earn flexible returns with zero risk
On-chain Earn
Earn profits daily without risking principal
Structured Earn
Robust financial innovation to navigate market swings
VIP and Wealth Management
Premium services for smart wealth management
Loans
Flexible borrowing with high fund security
60,000 Bitcoin addresses exposed in LockBit ransomware security breach

60,000 Bitcoin addresses exposed in LockBit ransomware security breach

GrafaGrafa2025/05/09 01:20
By:Mahathir Bayena

A hacker breach targeting the LockBit ransomware group has exposed nearly 60,000 Bitcoin (CRYPTO:BTC) addresses linked to its operations, alongside internal negotiation logs and affiliate data.

The leak, discovered on May 7, 2025, revealed a MySQL database dump containing critical details about the gang’s infrastructure and financial activities.

Attackers defaced LockBit’s dark web portal with the message, “Don’t do crime CRIME IS BAD xoxo from Prague,” redirecting visitors to a file named paneldb_dump.sql.

The database included 59,975 unique Bitcoin addresses used for ransom payments, though no private keys were compromised.

Over 4,400 victim negotiation chats from December 2024 to April 2025 were also leaked, exposing tactics and payment demands.

LockBit’s operator, known as LockBitSupp, confirmed the breach but downplayed its impact, stating no decryption keys or victim data were lost.

Analysts identified vulnerabilities in LockBit’s outdated PHP server (version 8.1.2-1ubuntu2.19) as a potential entry point, echoing weaknesses exploited in prior law enforcement operations.

The breach exposed plaintext passwords and usernames for 75 affiliates, including entries like “Weekendlover69,” alongside custom ransomware builds targeting specific companies.

Blockchain investigators now have a roadmap to trace illicit transactions, potentially linking past ransom payments to known wallets.

Notably, the attackers’ methods mirrored a recent breach of the Everest ransomware group, suggesting possible connections.

This incident follows a 2024 multinational crackdown on LockBit, which authorities blamed for billions in infrastructure damages.

While the leak disrupts LockBit’s operations, experts caution that ransomware groups often rebuild.

However, the exposed data provides law enforcement with unprecedented insights into affiliate networks and payment flows.

“This breach is a significant blow to LockBit’s credibility,” said a cybersecurity analyst, highlighting how the gang’s infrastructure became its own liability.

At the time of reporting, the Bitcoin (BTC) price was $103,138.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!