Hackers Get Hacked: LockBit Breach Exposes 60K BTC Wallets and Secrets

Key Insights

• LockBit, one of the most feared cybercriminal groups in the last few years, just got hacked.
• The third-party hackers not only exposed the group’s schemes, they also released chats, Bitcoin addresses and even mocked them.
• While Bitcoin addresses were exposed, none of the private keys were included.
• This means the funds in those wallets are still under the gang’s control, for now at least.
• Still, the exposed data will be important for arrests in the future, as LockBit’s days as a top RaaS service are being numbered.

LockBit, one of the most feared cybercriminal groups in the last few years, has just been hit with a taste of its own medicine.

Nearly 60,000 Bitcoin addresses associated with this ransomware group have been leaked, after another anonymous hacker (or group of hackers) broke into LockBit’s affiliate panel.

The hackers not only exposed the group’s schemes, they also mocked them by leaving them a message:

“Don’t do crime. CRIME IS BAD. xoxo from Prague.”

Here are the details of the hack as they unfolded.

Inside the Hack

The attackers not only broke into LockBit’s affiliate panel, they also released a MySQL database dump with around 20 tables from LockBit’s backend systems.

According to insights from BleepingComputer, this dump contained a rare (and detailed) look at how LockBit worked.

Some of the most interesting kinds of data leaked included nearly 60,000 Bitcoin wallet addresses believed to be used for ransom transactions.

Another part of the leaked data included custom ransomware tools being developed by the group, including associated public keys and targeted victims.

The data even contained over 4,400 negotiation messages between LockBit affiliates and victims, dating from December of last year to April of this one.

Finally, the data contained a list of 75 usernames and plaintext passwords, many of which were embarrassingly weak (like “Weekendlover69” and “Lockbitproud231.”)

The gang storing important credentials in plaintext was likely the amateur mistake that left them wide open to being hacked.

No Private Keys Leaked, But Damage Done

The report from Bleeping Computer shows that Bitcoin addresses were exposed, but none of the associated private keys were included.

This means the funds in those wallets are still under the gang’s control, for now at least.

Still, the leak remains a goldmine for blockchain analysts and law enforcement, who can now start tracing ransom payment flows and connecting them to suspects.

Security researcher Rey shared a direct exchange with a LockBit representative, who acknowledged that the hack happened , but LockBit is already “working on getting back to work”

However, the hacker group has suffered damage to its reputation, and arrests are likely to start happening soon.

The Fallout from Operation Cronos

This hack came just months after a major international law enforcement operation known as Operation Cronos took down 34 of LockBit’s servers and seized data like decryption keys and crypto.

While LockBit was able to partially recover from that crackdown, the latest attack on them shows that their infrastructure had always been weak to begin with.

Operation Cronos had already dealt a serious blow to LockBit’s credibility among its criminal partners, and this latest hack drives the nail further in.

Overall, LockBit’s model relied strongly on affiliates (or cybercriminals who would use LockBit’s ransomware tools in exchange for a share of the ransom profits).

With their internal tools, builds, usernames and negotiation chats now exposed, the affiliate network just might collapse under the weight of mistrust and fear.

On the other hand, other major Ransomware Services like ALPHV/BlackCat and RansomHub are also facing demise in a major win for the crypto (and trad-fi) space.

It is still too early to determine whether LockBit is truly finished.

However, this hack will make rebuilding a lot more difficult, with LockBit’s days as a top-tier ransomware service likely being over.

Disclaimer: Voice of Crypto aims to deliver accurate and up-to-date information, but it will not be responsible for any missing facts or inaccurate information. Cryptocurrencies are highly volatile financial assets, so research and make your own financial decisions.