Follow the Money · 01 — The Ransom: How a Payment Disappears (and Why It Can't)

Follow the Money — Case 01. A new forensic register. The Alphabet of Actors asked who broke in and how; this one asks the question the honeypot can never answer — where did the money go? Each case follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Every actor in the register that came before this one was, when you strip away the technique, moving value. The banking trojan stole it, the ransomware crew extorted it, the state actor spent it on a weapons program, the spyware vendor sold it, the botnet monetized it. The attacks were the visible half of the story — the break-in, the encryption, the exfiltration, the ransom note — and they were the half the platform beneath these words can watch. The honeypot sees the intrusion: the brute-forcing at the door, the foothold, the malware pulled down. What the honeypot never sees is the other half, the half that happens after the crime succeeds: the money. Where it goes. How it is washed. Who ends up spending it, and on what. That second half is a whole forensic domain of its own, and it is the subject of this register.

This is the money side of everything the actor register profiled, and it requires a different instrument. You cannot follow a ransom with a network sensor, because the payment does not travel across the honeypot's wire; it travels across a public ledger the sensor cannot see. So the instrument here is not the honeypot but its opposite — the blockchain itself, and the machinery of financial intelligence built around it: the Suspicious Activity Reports the banking system files, the blockchain-analytics firms that trace transactions, the sanctions designations that name specific wallets. Where the honeypot watched the actor come in, this register watches the value go out.

Case 01 is the archetype — the single most common illicit flow in the modern economy, and the one that teaches the whole method. It is the ransom. Follow one ransomware payment from the moment a hospital wires it to the moment someone converts it into a car, and you have seen the entire machine every later case takes apart. This is the letter about the journey of a ransom, about the six well-documented steps that turn stolen money into spendable money, and about the founding paradox of the whole enterprise: that the criminals who moved to cryptocurrency for anonymity built, instead, the most permanent evidence trail in the history of crime.

1. The Origin: a payment made under duress

Every money trail has a first transaction, and for a ransom that first transaction is an act of coercion, so the register begins where the money does — with the victim, and with the ugly economics of who is chosen to pay. The targets of ransomware are not random. Treasury's own risk assessments note that during the pandemic, attacks on small municipalities and healthcare institutions became more common, and the reason is coldly rational: an organization whose ability to function is a matter of life and death, and which cannot tolerate downtime, is an organization far more likely to pay. A hospital with its clinical systems encrypted, mid-pandemic, is not weighing the decision the way a company weighs a business loss. It is weighing it against cancelled surgeries and diverted ambulances. The extortion economy selects, deliberately, for the victims least able to refuse.

So the money's journey begins with a payment that is not a transaction in any ordinary sense but a hostage ransom — sent, usually in cryptocurrency, to an address the attacker controls, under the duress of a locked and vital system. And this is the first thing the register wants to establish, before a single hop of laundering: the origin of the flow is a harm. The dollars that are about to be washed through mixers and exchanges and cross-chain bridges are not abstract proceeds. They are what a town paid to get its records back, what a hospital paid to keep treating patients, what a small business paid to stay alive. Following the money is not a bloodless accounting exercise. It is following the harm forward, from the victim who bore it to the criminal who will eventually spend it, and the register centers the victim at the start precisely so the sums at the end are never mistaken for anything other than what they are.

The payment lands in the attacker's wallet, and at that instant the money enters a new medium with a strange and, for the criminal, double-edged property. It is now on a public ledger. The transaction that just happened — this wallet paid that wallet this amount at this time — is recorded, openly, permanently, for anyone in the world to see. The criminal has the money. The criminal has also, in the same instant, created a permanent public record of receiving it. Everything that happens next is an attempt to break the connection between that visible receipt and the eventual, spendable cash — and everything that happens next is also recorded, on the same unforgiving ledger, forever.

2. The Machine: six steps from stolen to spendable

The laundering of a ransom is not improvised, and it is not a black box. FinCEN — the US financial-intelligence unit that reads the Suspicious Activity Reports the banking and crypto industries are required to file — analyzed ransomware-related SARs together with blockchain analysis and industry observation, and catalogued the typologies. There are, in FinCEN's account, roughly six recurring moves, and knowing them is what turns an untraceable-seeming payment into a followable one. The machine has a manual, and the regulator wrote it down.

The first move is the choice of currency. Threat actors increasingly demand payment not in Bitcoin but in anonymity-enhanced cryptocurrencies — AECs — most notably Monero, which is engineered to obscure the sender, receiver and amount in a way Bitcoin does not. This is such a meaningful advantage to the launderer that, per FinCEN, actors will sometimes accept a Monero payment at a discount to the Bitcoin equivalent, or charge a surcharge to accept the more-traceable Bitcoin — pricing the privacy directly into the ransom. The second move is discipline about addresses: avoiding the reuse of wallet addresses, so that each payment lands somewhere fresh and no single address accumulates a tell-tale history. The third is chain hopping — swapping the proceeds across different cryptocurrencies and different blockchains, so that a tracer following the money has to jump from ledger to ledger, losing continuity at each boundary. The fourth is mixing, running the funds through services that pool many users' coins together and pay out from the common pot, so the specific coins that came from the crime are blended into an indistinguishable mass. The fifth is the use of decentralized exchanges, swapping assets without the identity checks a regulated exchange imposes. And the sixth, the destination of the whole sequence, is the cash-out: converting the now-obscured proceeds into ordinary money at a centralized virtual-asset exchange, ideally one in a jurisdiction with weak anti-money-laundering controls.

Read those six steps as a single design with a single purpose: to sever the link between the visible ransom payment at the start and the spendable cash at the end, hop by hop, until a tracer following the chain forward loses it in the noise. Each step is a deliberate cut. The AEC hides the transaction's details; the fresh address hides the pattern; the chain hop breaks the continuity; the mixer blends the coins; the decentralized swap skips the identity check; and the cash-out, if it works, delivers clean-looking money to a bank account or a card. This is the machine. And the reason the register can follow the money at all is that the machine is known — every one of these moves has been observed, named, and studied, which means every one of them is also a place to look.

3. The Mixer: the heart of the wash, and its limit

Of the six steps, one deserves its own section because it is the heart of the obfuscation and because it teaches the register's central lesson about the difference between hiding money and erasing its record. That step is mixing, and the mixer is the closest thing the crypto economy has to a laundromat.

A mixer works by pooling. Many users — some legitimate, many not — send their coins into a common service, and the service pays out coins of equal value from the shared pool, so that the coins a user receives are not, on the ledger, the same coins they put in. The chain of custody is broken: the money that comes out cannot be directly linked, transaction by transaction, to the money that went in, because it has been shuffled through the crowd. Treasury's assessments describe ransomware criminals using exactly these services, alongside chain hopping and cross-chain bridges, to hinder tracing and attribution. Specific mixers have become notorious enough to be named and sanctioned — Blender.io, and its assessed successor Sinbad.io, were designated by OFAC as key money-laundering tools, including for state-sponsored theft. The mixer is where a ransom goes to lose its name.

But here is the limit, and it is the whole point of the register. Mixing hides the connection; it does not delete the record. Every deposit into the mixer and every withdrawal from it is still written on the public ledger, forever. The pool obscures which withdrawal corresponds to which deposit, but the fact that this crime wallet deposited into this mixer at this time, and that these withdrawals left the mixer shortly after, are permanent, world-readable facts. Blockchain analysts do not need to break the mixer's cryptography to make progress; they can study the timing, the amounts, the patterns of the pool, the wallets that touch it before and after, and they can often re-establish, with high confidence, the link the mixer was built to sever. Sometimes the mixer's own operators keep records that are later seized. And once a mixer is sanctioned, every interaction with it becomes itself a flag — depositing into a designated mixer is no longer a way to disappear but a way to light up. The mixer buys the launderer time and difficulty. It does not buy permanence, because the one thing a public blockchain will never do is forget that the deposit happened.

4. The Chokepoint: where the money must show its face

Every laundering journey has a moment of maximum vulnerability, and for crypto it is the last step — the cash-out — because that is where the anonymous ledger has to touch the identified world. This section is about that chokepoint, because it is the one place in the whole journey the law can reliably reach, and understanding it is understanding where enforcement actually bites.

The problem for the launderer is simple and inescapable: obscured cryptocurrency, however well washed, is not yet spendable money. You cannot pay rent or buy a car or fund an operation directly with mixer output sitting in an anonymous wallet; at some point it has to become dollars, or euros, or rubles, in an account someone can use. And that conversion, overwhelmingly, runs through a virtual-asset service provider — a crypto exchange — which is precisely where the anonymity of the ledger collides with the identity requirements of the regulated financial system. A compliant exchange demands to know its customers and reports suspicious activity; that is the wall the launderer must get through or around. So the launderer seeks the exchanges with the weakest controls, in the friendliest jurisdictions — and that search is exactly where the state has learned to wait.

The enforcement record is the proof that the chokepoint works. OFAC settled with the exchange Bittrex for over twenty-four million dollars, and FinCEN for roughly twenty-nine million, over failures to enforce sanctions and reporting obligations — the state reaching a business precisely at the point where illicit value tries to become clean. FinCEN identified the exchange Bitzlato as a "primary money laundering concern," and a senior Bitzlato executive was arrested — the takedown of a chokepoint that had been serving the launderers. This is where the abstract lesson becomes concrete consequence: not at the mixer, which is hard to touch, and not in the sheltered country where the criminal sits, but at the exchange, the necessary conversion point, the launderer's structural weakness. The register keeps finding, across every case it will examine, that the money is most catchable not while it is hiding but while it is trying to come home — because to be spent, it must, for one moment, show its face.

5. The Ledger: the anti-honeypot

Now the founding insight of the whole register, the one that justifies the enterprise and inverts the intuition everyone starts with — that cryptocurrency is a tool for anonymous crime. It is, in fact, closer to the opposite, and the reason is the nature of the instrument this register reads instead of a sensor.

Consider what cash does. Cash is the true anonymizer: hand someone a bag of banknotes and the transaction leaves no record at all, no ledger, no trace, nothing to follow. For all of history, the launderer's dream was cash — untraceable, unrecorded, gone the moment it changes hands. Cryptocurrency was adopted by criminals in the belief that it was digital cash, anonymous money for the internet age. But a public blockchain is not digital cash. It is a permanent, open, world-readable ledger that records every transaction that has ever occurred on it, forever, and never forgets. The criminal who takes a ransom in Bitcoin has not made an anonymous transaction; they have written a permanent public entry that says a wallet received this money at this time, and every subsequent move — every hop, every mix, every swap, every cash-out attempt — writes another permanent entry beneath it. The launderer's entire six-step machine is an effort to obscure the connections between those entries, but the entries themselves are indelible.

This is why the register calls the blockchain the anti-honeypot. A honeypot is a trap that captures a moment of malicious activity as it happens; the blockchain is a trap that captures all financial activity, forever, whether anyone is watching in the moment or not — and can be read backward at leisure, years later, with tools that did not exist when the transaction occurred. FinCEN reads it through the SARs the industry files and the blockchain analysis it conducts; specialized analytics firms read it to trace flows through mixers and across chains; OFAC reads it and then designates specific wallet addresses by name, turning the permanent record into a permanent sanction. The obfuscation the launderer buys is real but temporary — it raises the cost and the time of the tracing, and sometimes it defeats the tracing for now. What it can never do is erase the record, because the record is the medium itself. Cash leaves no trail. The ledger leaves nothing but trail. The criminals traded the traceability of banks for a witness that never dies, and this register exists because that witness can be called.

6. The counter-narrative, steelmanned

The strongest objections to this register's optimism about the ledger deserve their hearing at the outset, because they will recur across every case, and honesty requires meeting them now.

The argument runs on two fronts. First, on the limits of tracing: the "immutability" story oversells what analysts can actually do, because privacy coins like Monero are specifically engineered to defeat blockchain analysis — they hide sender, receiver and amount by design — so an actor disciplined enough to demand Monero, avoid Bitcoin entirely, and cash out through a genuinely non-compliant exchange in a non-cooperating jurisdiction may leave a trail that is, in practice, cold. The famous tracing successes, the argument goes, are the cases where criminals made mistakes or used transparent chains like Bitcoin; the careful ones are not in the statistics because they were never caught. Second, on the framing: treating "crypto" as a crime medium is a distortion that tars a legitimate technology and its millions of lawful users with the acts of a criminal minority, and privacy in financial transactions is a legitimate value, not a confession — the same mixers and privacy tools that launder ransoms also protect ordinary people from surveillance, and a register that follows illicit flows risks writing as though every transaction it cannot see is a crime.

The register grants both points and holds its core. On tracing limits: yes, Monero and disciplined operational security can defeat analysis, and the register will say so case by case rather than pretending the ledger always gives up its secrets — but two things survive. The chokepoint remains: even perfectly-traced-or-not, the money must eventually become spendable, and that conversion is a vulnerability privacy coins do not remove, which is why enforcement clusters at exchanges. And the discipline required is real: the six-step machine exists because most launderers are not perfect, most flows touch transparent chains somewhere, and the permanent record punishes any lapse forever, so the practical tracing rate is far higher than the "perfect Monero operator" thought-experiment implies. On the framing: the register agrees that crypto is a technology, not a crime, and that financial privacy is a legitimate value — it does not treat the ledger as a ledger of guilt, only of transactions, and it follows the specific flows that documented harm produced, not "crypto" in the abstract. The point is not that every unseen transaction is a crime. The point is that the specific ransom this case follows was a crime, its journey is a documented pattern, and the medium that carried it happens to remember. The counter-narrative is right that the ledger is not omniscient and privacy is not guilt. It is wrong that this makes following a specific, harmful flow either futile or unfair.

7. Disposition — LAUNDERED

Case 01 followed a ransom from the coerced payment of a hospital or a town, through the six-step machine that turns stolen crypto into spendable cash — the AEC, the fresh address, the chain hop, the mixer, the decentralized swap, the cash-out — and to the chokepoint where the money must show its face at an exchange, the one place the law reliably reaches. It is the archetype, the flow every later case varies, and it establishes the register's instrument: not the sensor but the ledger, the anti-honeypot that records the exit the honeypot never sees.

The disposition — this register's verdict, rendered on the money's fate rather than the actor's — is the archetype's own: LAUNDERED. The ransom was obscured. The six steps did their work; the connection between the visible payment and the eventual cash was broken, hop by hop, well enough that the funds could be spent. On the surface, the launderer won: the money became usable, and much of it, per FinCEN's geography, flowed toward Russia and its proxies, the sheltered borders where the actor register already found that consequence stops. This is the honest, common outcome, and the register will not pretend otherwise — most ransoms are laundered, and most launderers, for now, get to spend the money.

But "laundered" is not "erased," and the distinction is the register's founding hope. The washing hid the connection; it did not delete the record. Every step of the journey — the receipt, the mix, the swap, the cash-out — is written permanently on a public ledger that will still be readable in a decade, with tools better than today's, by investigators who can work backward at leisure toward the one moment the money had to become spendable. Laundered money is money that got away for now, from a witness that does not forget. The honeypot beneath these words will never see the payout, but the ledger is the anti-honeypot, and it is still recording, right now, the next ransom's first transaction. The vectors do not lie, and here the vectors are transactions — indelible, public, waiting to be read. Judge the machine that turns a hospital's ransom into a launderer's spendable cash. Then remember that the machine leaves a permanent trail, and that "for now" is the most temporary word in finance.

Follow the Money continues. Case 01 disposition: LAUNDERED. Confidence: HIGH on the laundering typologies and enforcement facts — the six FinCEN typologies, the SAR volumes and values, the Bittrex and Bitzlato actions, and the 75%-to-Russia finding are documented in the financial-intelligence record (FinCEN, US Treasury, Europol); this case describes the archetypal pattern, not any single named victim's transaction, and privacy coins' limits on tracing are stated plainly. Hospitals and municipalities are centered as the harm at the origin of the flow. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the machine that washes a ransom, the ledger that never forgets it, and the chokepoint where the money must, one day, come home.