LockBit Hacked: BTC Addresses and Ransom Chats Go Public

Cryptos: 21,330
Exchanges: 1,862
Market Cap: $3.09T 3.23%
24h Vol: $281,840,387,591 22.86%
Dominance: BTC: 63.4% ETH: 7.7%
Gas: 2 GWEI

Connect

Crypto News Exploits

LockBit Hacked: 60,000 Bitcoin Addresses and 4,400 Ransom Chats Go Public

Written by Aaron S.,

Editor-In-Chief

Last Updated: May 08, 2025

Key Takeaways

Hackers leaked LockBit’s MySQL database and exposed nearly 60,000 Bitcoin addresses linked to ransom activities;
The database included ransomware builds, victim negotiations, and clues for tracking LockBit’s past crypto transactions;
Similarities to a past Everest ransomware hack suggest the same attacker or group may be responsible for both breaches.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now ! 🔥

LockBit Hacked: 60,000 Bitcoin Addresses and 4,400 Ransom Chats Go Public

BITDEGREE IN YOUR SOCIAL FEED

Hackers managed to break into the LockBit ransomware group's dark web affiliate site and publicly release a copy of its internal MySQL database, according to Bleeping Computer.

The files contained nearly 60,000 Bitcoin BTC $99,096.39 addresses, which experts believe are linked to the group’s ransom payments.

While no private keys were part of the leak, the exposed information could help blockchain investigators follow the trail of LockBit’s past transactions.

Where to Trade Crypto: 3 Best Approaches Explained (Animated)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The leaked database contained twenty different tables. One, named "builds", listed ransomware files created by LockBit’s partners, along with possible intended targets. Another, labeled "chats", included more than 4,400 negotiation messages between the group and its victims.

These records showed conversations about ransom amounts, payment terms, and proof that stolen data would be deleted after a deal.

After the leak, an X user shared a conversation with an individual claiming to represent LockBit. The person confirmed that the group’s affiliate panel had been hacked but said that no private keys or critical data had been taken.

Analysts from BleepingComputer also pointed out that the message shown on LockBit’s hacked site was almost identical to one seen during a previous attack on the Everest ransomware group. This raised the idea that the same hacker, or a connected group, could be behind both incidents.

Meanwhile, Google Threat Intelligence reported a new malware called LOSTKEYS used by the hacking group COLDRIVER. How does the malware do? Read the full story.