Share this article
NetWalker Ransomware Gang Is Storing $7M in Bitcoin in SegWit Cold Storage
The organization that’s encrypting computers and extorting companies has taken to SegWit addresses, according to McAfee and CipherTrace.
By Danny Nelson
Updated Sep 14, 2021, 9:39 a.m. Published Aug 3, 2020, 8:53 p.m.
Make us preferred on Google
NetWalker ransomware, which last week triggered cybersecurity flash warnings from the Federal Bureau of Investigation (FBI), has extorted $25 million in bitcoin from its victims during the months of the pandemic, according to a report by McAfee and CipherTrace.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
- NetWalker is a “ransomware-as-a-service” that gains its access through COVID-19 phishing emails, encrypts infected systems and steals internal documents. Ransomware operators then threaten to publish victims’ documents if they fail to pay up.
- Victims, most of whom are large organizations such as companies and governments, appear to been obliging the hackers throughout the pandemic. McAfee and CipherTrace traced 2,795 bitcoin ($25 million) to NetWalker wallet addresses from March 1 through July 27.
- NetWalker’s developers refined their handling of bitcoin payments months before the pandemic began by swapping in SegWit addresses in place of legacy wallets, the report said.
- “This transition into SegWit could indicate that they are utilizing a new hardware wallet to store their BTC or just an indication of a desire for cheaper transactions,” said Pamela Clegg, director of financial investigations at CipherTrace.
- Clegg told CoinDesk that “large amounts of bitcoin” – up to 640 – appear to be sitting in cold storage. She said smaller amounts have been deposited at Russian crypto exchange CointoCard.org.
- The cybersecurity report follows last week’s warning from the FBI that NetWalker has been successfully exploiting COVID-19 in recent months. The FBI warns targeted institutions against paying hackers’ bitcoin ransom payments.
See also: Travel Management Firm CWT Pays Out $4.5M in Bitcoin After Ransomware Attack
More For You
KuCoin captured a record share of centralised exchange volume in 2025, with more than $1.25tn traded as its volumes grew faster than the wider crypto market.
What to know:
- KuCoin recorded over $1.25 trillion in total trading volume in 2025, equivalent to an average of roughly $114 billion per month, marking its strongest year on record.
- This performance translated into an all-time high share of centralised exchange volume, as KuCoin’s activity expanded faster than aggregate CEX volumes, which slowed during periods of lower market volatility.
- Spot and derivatives volumes were evenly split, each exceeding $500 billion for the year, signalling broad-based usage rather than reliance on a single product line.
- Altcoins accounted for the majority of trading activity, reinforcing KuCoin’s role as a primary liquidity venue beyond BTC and ETH at a time when majors saw more muted turnover.
- Even as overall crypto volumes softened mid-year, KuCoin maintained elevated baseline activity, indicating structurally higher user engagement rather than short-lived volume spikes.
More For You
How a 'perpetual’ stock trick could solve Michael Saylor’s $8 billion debt problem
The bitcoin treasury firm is using perpetual preferreds to retire convertibles, offering a potential framework for managing long-dated leverage.
What to know:
- Strive upsized its SATA follow on offering beyond $150 million, pricing the perpetual preferred at $90.
- The structure offers a blueprint for replacing fixed maturity convertibles with perpetual equity capital that removes refinancing risk.
- Strategy has a $3 billion convertible tranche due in June 2028 with a $672.40 conversion price, which could be addressed using a similar preferred equity approach.
Top Stories
