ransomwhe.re ransomware addresses

JSON

Cryptocurrency addresses linked to payments for ransomware attacks

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.

Cryptocurrencies have, in recent years, become a common method to transact ransom payments in such attacks. The ransomwhe.re site collects addresses (accounts) that are known to be linked to these payments.

Data overview

Entities:
Total11,186
Searchable11,186
Targets11,186
Entity types:
Cryptocurrency wallets11,186
Publisher:Jack Cable · United States non-official source
Collections:in OpenSanctions Default · Warrants and Criminal Entities
Information:ransomwhe.re
Source data:api.ransomwhe.re · JSON
Coverage:added · frequency: weekly
Last processed:2025-10-20 02:02:02 · v. 20251020020202-cxa
Last change:

Bulk download

Downloads contain the full set of entities contained in this dataset. You can fetch a simplified tabular form, or detailed, structured data in JSON format. Updated files will be provided once a day at the same location.

File nameExport typeSize
entities.ftm.jsonFollowTheMoney entities5.48 MB
names.txtTarget names text file1.27 KB
senzing.jsonSenzing entity format6.26 MB
source.jsonSource data5.32 MB
targets.nested.jsonTargets as nested JSON5.48 MB
targets.simple.csvTargets as simplified CSV2.82 MB

Help: Using the data · model reference · delta updates · support · change log · licensing

Using the API

You can query the data in this dataset via the application programming interface (API) endpoints below. Please read the introduction for documentation and terms of service.

Use the Reconciliation API in OpenRefine:
For full-text search, use the /search endpoint:
For entity matching, use the /match endpoint:

Recent additions

The following targeted entities have been added to this data source most recently:

AddedNameTypeCountries
bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mcCryptocurrency wallet
bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkydCryptocurrency wallet
bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2Cryptocurrency wallet
bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdajCryptocurrency wallet
bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8Cryptocurrency wallet
bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6hCryptocurrency wallet
bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtahCryptocurrency wallet
bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24Cryptocurrency wallet
1261hYzcQ3gz8c57a8SVuwRqUYWKRcoLzoCryptocurrency wallet
12A7aeXy8gXU5cfxfuVojwnUth1bS7uAU9Cryptocurrency wallet
12FLPnExSQEpbhdtcFNChWniZ9PhXtu7fSCryptocurrency wallet
12ua6vu4ty14dmWTQavbeDqUzUuX1t5kfbCryptocurrency wallet
12Z7w1USU8f3u6uAzRQxK2bXxvNf48vC1hCryptocurrency wallet
13fjdVAsFjHaSSBdhWpQ1WgmPZV2hKba53Cryptocurrency wallet
13RCG5pSvANFiojjembTQpN7DqS5uZLvDoCryptocurrency wallet
Code on GitHub
OverviewDownloadAPIRecent additions
OpenSanctions · Data you can trust, on people you can’t
OpenSanctions Datenbanken GmbH · info@opensanctions.org · https://opensanctions.org/meeting