Following a ransom payment on-chain is one of the few investigative advantages defenders hold over ransomware crews, because a public blockchain never forgets. In 2026, total on-chain ransomware payments fell to roughly 820 million dollars even as claimed attacks kept rising, and the gap between the two numbers is where tracing work lives. This walkthrough covers how to take a single ransom address and follow the money to the point where it hits an exchange, using open tooling and disciplined method rather than a six-figure forensics licence.
A note on scope before we start. Payment tracing is investigative context, not attribution on its own, and the laundering countermeasures crews now use are real. Treat every finding as a lead to corroborate, not a verdict.
Where does a ransom address come from?
You need a starting selector, and there are legitimate open sources for one. Ransom notes recovered during incident response contain payment addresses. Victim disclosures and court filings sometimes publish them. Community trackers such as Ransomwhere crowdsource reported ransom wallets, and the Ransomnews victim feed gives you the victim and group context to tie an address to a campaign. Start with a confirmed address, record where you got it, and note the chain: most ransomware payments still settle in Bitcoin, with a growing share in Monero, which as a privacy coin resists this entire method by design.
How do you follow the first hops?
Open a block explorer and load the address. For Bitcoin, mempool.space and Blockstream.info show inputs, outputs and transaction timing. Read the transaction graph outward hop by hop, noting each split and merge. Two heuristics do most of the early work. The common-input-ownership heuristic assumes that addresses used together as inputs to one transaction are controlled by the same entity, which lets you cluster wallets. The change-address heuristic helps you tell the payment forward from the change coming back. Together these turn a single address into a probable wallet cluster.
What do the obfuscation layers look like?
Modern ransomware laundering is not lazy. Expect mixers and coinjoin services that pool many users’ coins to break the input-ownership heuristic, chain-hopping through cross-chain bridges that move value from Bitcoin to another network, and nested exchange deposits that hide behind a legitimate exchange’s own wallets. Each layer degrades certainty. When your trace enters a high-volume mixer and comes out the other side, you generally cannot re-link the specific coins without additional intelligence such as timing analysis, amount correlation, or data the mixer operator was compelled to hand over. Document where the trail goes cold, because that boundary is itself a finding.
Which tools do you actually use?
You can get a long way on the free and open tier before any paid platform enters the picture. For reading the Bitcoin chain itself, mempool.space and Blockstream.info are the two explorers most investigators keep open: both show a transaction’s inputs, outputs, fees and timing, which is everything the early hop-by-hop work needs. When a trace crosses chains, Blockchair covers many networks in one interface and surfaces some entity tags, and Etherscan is the standard tool for following funds once they land on Ethereum via a bridge.
For the investigative layer on top of the raw chain, three open resources matter. Ransomwhere is a crowdsourced, openly downloadable dataset of reported ransom addresses, which is often where a starting selector comes from. GraphSense is an open-source cryptocurrency forensics platform that automates clustering and flow analysis at scale, and it is the closest free equivalent to the commercial suites. And Maltego, whose community edition is free, is the canvas most analysts use to hold the whole link chart together, stitching on-chain clusters to the off-chain selectors around them. Each of these deserves its own hands-on tutorial, so we published dedicated walkthroughs for GraphSense and Maltego; this piece is the map, not the manual.
How do you attribute a cluster to an entity?
Attribution is where OSINT stops being pure graph-walking. Public exchange deposit addresses, service wallets and known-actor tags let you say a cluster interacted with a named entity, and open datasets plus explorers’ own entity labels give you a starting map. Cross-reference the cluster against Bitcoin address selectors that appear elsewhere: a tip jar reused on a forum, a wallet posted in a Telegram channel, or an address a victim negotiator recorded. The goal is not to unmask a person from the chain alone, which is rarely possible, but to build a corroborated picture where on-chain flows line up with off-chain identifiers.
Where does law enforcement pick up the thread?
The reason tracing matters even when the trail runs through mixers is the off-ramp. Ransomware actors still cash out through centralised exchanges more than any other route, and a regulated exchange holds the identity data a blockchain address never will. When a cluster deposits into an exchange, investigators with legal process can request the account records behind that deposit. This is why the choke point in the diagram above is the exchange, not the mixer. Your open-source trace builds the map; a subpoena or MLAT request turns the last hop into a name. This same method underpins the leak-site work in our ransomware leak-site OSINT walkthrough.
Frequently asked questions
Can you trace a ransomware Bitcoin payment for free?
Yes, up to a point. Free block explorers like mempool.space and open tools such as GraphSense and Maltego CE let you follow flows and build a wallet cluster. What free tools lack is the large labelled attribution database that commercial platforms use to name the entities behind clusters.
Why can’t you trace Monero ransom payments?
Monero uses ring signatures, stealth addresses and confidential transactions that hide sender, receiver and amount by design. That removes the public transaction graph tracing depends on, which is why a growing number of crews now demand Monero.
What is wallet clustering?
Wallet clustering groups addresses likely controlled by one entity, mainly using the common-input-ownership heuristic, which treats addresses spent together in a transaction as co-owned. It turns a single ransom address into a broader picture of an actor’s holdings and behaviour.
Do mixers make tracing impossible?
They make it much harder, not always impossible. High-volume mixers break the direct link between input and output coins, but timing analysis, amount correlation and legal action against mixer operators can sometimes re-establish parts of the trail.
Is blockchain tracing admissible in court?
Blockchain forensics has been accepted in numerous cases, and methods are designed against evidentiary standards. Admissibility depends on methodology and documentation, so record every step, source and assumption as you go.
Sources and further reading
- Ransomwhere — open crowdsourced ransom-payment dataset
- GraphSense — open-source cryptocurrency forensics
- Huang et al. — Ransomware Payments in the Bitcoin Ecosystem (arXiv, peer research)
- Chainalysis — Crypto Ransomware: 2026 Crime Report (payment data)
- Ransomnews — Ransomware leak-site OSINT walkthrough