Follow the Ransom BTC: Tracing Coins to a Tagged Exchange Wallet
The challenge
A victim paid a ransom to a Bitcoin address and you want to know where the attacker cashed out. Open the sources and correlate them: the ransom note holds the payment address, a block explorer traces the coins through two hops, and a chain-analysis tag labels the final destination. Name the exchange where the funds landed and submit it.
What you'll learn
- Read a payment address out of a ransom note
- Follow a Bitcoin trail across multiple hops on a block explorer
- Recognise a deposit address as the end of the on-chain trail
- Use a chain-analysis cluster tag to attribute an address to an exchange
- Understand that Bitcoin is pseudonymous, not anonymous
Skills tested
Prerequisites
- Basic understanding of Bitcoin addresses and transactions
- Awareness of what an exchange deposit address is
How it works
Every Bitcoin transaction is public, so a payment is not the end of the story - it is the start of a trail. Investigators follow the flow of coins from one address to the next, and the goal in a ransomware case is to reach the point where the attacker converts crypto to cash. That almost always means a deposit address at a centralised exchange, because exchanges are where coins meet identity through KYC.
The ransom note here only contains the attacker's payment address, bc1qr4ns0m.... The block explorer trace does the heavy lifting: the 0.50 BTC moves through one intermediate hop and lands on 1DepositHotWallet000exchange0addr3, which the explorer flags as a deposit address. Knowing it is a deposit address is not enough - you need to know whose. The chain-analysis tag supplies that: the destination is in a known cluster labelled Binance hot wallet (customer deposits) with high confidence, because that address has been reused across thousands of deposits. The forum brag, where the attacker boasts about moving funds through one mixer into an exchange account, corroborates the path.
The OSINT board presents each artifact as a card. No card names the exchange by itself: the note gives an address, the explorer gives a destination, the tag gives the attribution. They converge on Binance.
Common mistakes
- Submitting a Bitcoin address. The question asks for the exchange, not the deposit address the funds landed on.
- Stopping at the deposit address. Knowing it is a deposit address is not enough - the cluster tag tells you which exchange owns it.
- Ignoring the hops. The funds pass through an intermediate address before reaching the exchange; follow the whole trace.
- Trusting the forum brag alone. The brag corroborates but does not name the exchange - the on-chain tag does.
How to defend against it
For investigators and defenders, the public ledger is the advantage: ransom funds can be traced and the cash-out point reported to the exchange for freezing and law-enforcement follow-up. The same transparency that lets attackers move money lets you follow it.
- Report the traced deposit address and exchange to enable an account freeze and KYC subpoena.
- Use reputable chain-analysis tooling to cluster addresses and attribute wallets.
- Preserve the full transaction graph as evidence, including intermediate hops.
- Never assume mixers fully break the trail - many flows remain traceable to a tagged exchange.