ransomwhe.re ransomware addresses

JSON

Cryptocurrency addresses linked to payments for ransomware attacks

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.

Cryptocurrencies have, in recent years, become a common method to transact ransom payments in such attacks. The ransomwhe.re site collects addresses (accounts) that are known to be linked to these payments.

Data overview 

Entities:
Total11,186
Searchable11,186
Targets11,186
Entity types:
Cryptocurrency wallets11,186
Publisher:Jack Cable · United States non-official source
Collections:in OpenSanctions Default · Warrants and Criminal Entities
Information:ransomwhe.re
Source data:api.ransomwhe.re · JSON
Coverage:added · frequency: weekly
Last processed:2026-07-20 02:02:01 · v. 20260720020201-kkb
Last change:

Bulk download 

Downloads contain the full set of entities contained in this dataset. You can fetch a simplified tabular form, or detailed, structured data in JSON format. Updated files will be provided once a day at the same location.

File nameExport typeSize
entities.ftm.jsonFollowTheMoney entities5.72 MB
names.txtTarget names text file0 B
senzing.jsonSenzing entity format5.79 MB
source.jsonSource data5.32 MB
targets.nested.jsonTargets as nested JSON5.72 MB
targets.simple.csvTargets as simplified CSV2.75 MB

Help: Using the data · model reference · delta updates · support · change log · licensing

Using the API 

You can query the data in this dataset via these API endpoints:

For entity matching, use the /match endpoint:
For full-text search, use the /search endpoint:
Use the Reconciliation API in OpenRefine:
Read the API docs
Authentication, endpoints and usage examples

Recent additions 

The following targeted entities have been added to this data source most recently:

AddedNameTypeCountries
bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mcCryptocurrency wallet
bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkydCryptocurrency wallet
bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2Cryptocurrency wallet
bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdajCryptocurrency wallet
bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8Cryptocurrency wallet
bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6hCryptocurrency wallet
bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtahCryptocurrency wallet
bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24Cryptocurrency wallet
1261hYzcQ3gz8c57a8SVuwRqUYWKRcoLzoCryptocurrency wallet
12A7aeXy8gXU5cfxfuVojwnUth1bS7uAU9Cryptocurrency wallet
12FLPnExSQEpbhdtcFNChWniZ9PhXtu7fSCryptocurrency wallet
12ua6vu4ty14dmWTQavbeDqUzUuX1t5kfbCryptocurrency wallet
12Z7w1USU8f3u6uAzRQxK2bXxvNf48vC1hCryptocurrency wallet
13fjdVAsFjHaSSBdhWpQ1WgmPZV2hKba53Cryptocurrency wallet
13RCG5pSvANFiojjembTQpN7DqS5uZLvDoCryptocurrency wallet
Code on GitHub
OverviewDownloadAPIRecent additions
OpenSanctions · Supreme Data on Supreme Leaders
OpenSanctions Datenbanken GmbH · info@opensanctions.org · https://opensanctions.org/meeting