DarkSide Bitcoin Moves as REvil Faces Government Action
What DarkSide Is and Why the Colonial Pipeline Attack Matters
DarkSide operated as a ransomware-as-a-service (RaaS) platform. Under that model, the group's developers created and maintained the malware while separate "affiliates" were responsible for selecting targets, breaching their systems, and negotiating ransom payments directly with victim organisations. Revenue was then split between the developer and the affiliate, with each party controlling its own wallet.
The Colonial Pipeline ransom and the developer wallet
The most prominent DarkSide attack struck Colonial Pipeline, the operator of a major fuel distribution artery along the US East Coast. The disruption caused widespread fuel shortages and prompted a federal emergency declaration. Colonial Pipeline paid a ransom of 75 Bitcoin. Of that total, 63.7 Bitcoin represented the affiliate's cut; US authorities subsequently recovered those coins. The remaining 11.3 Bitcoin went to the DarkSide developer wallet, joining proceeds from approximately 50 other victims the group had attacked before going dark.
The May 13 shutdown and first wallet movement
On 13 May, DarkSide announced that its infrastructure, including the wallet holding developer-side proceeds, had been seized by an unknown third party. On the same day, 107.8 Bitcoin (valued at approximately $5.3 million at the time) left that wallet and moved to a new Bitcoin address. From that point, the funds sat untouched for months, bringing the total to roughly 107.8 Bitcoin now worth around $7 million given price appreciation.
The October Movement: Peel Chains and Exchange Deposits
Beginning at 07:00 GMT on 21 October, the dormant funds began moving. Over the course of several hours, they were routed through a succession of new wallet addresses, with small amounts being separated at each step before the remainder moved forward. Blockchain analysts refer to this as a peel chain, and it is a well-established money laundering technique. The logic is straightforward: by breaking a large sum into smaller parcels across multiple addresses, the launderer makes automated clustering harder and creates friction for any manual tracing effort. Each peel can also send a fragment toward an exchange, mixing it with legitimate transaction flow.
Exchange deposits already detected
Even at the early stage of the movement, small portions of the funds had already reached addresses associated with known cryptocurrency exchanges. That is the critical operational detail for compliance teams: the funds are not simply circulating through unhosted wallets. They are entering regulated infrastructure. Any exchange or financial institution that receives a deposit without a blockchain analytics alert tied to the DarkSide wallet cluster is, at that moment, potentially processing sanctioned or criminally derived proceeds.
The REvil Connection and Why Both Groups Matter Together
The timing of the DarkSide movement aligning with the government operation against REvil is significant beyond coincidence. Security researchers, including those at Elliptic, have noted structural similarities between DarkSide and REvil: comparable ransom note formatting and overlapping code. The two groups are widely considered to be linked, possibly sharing developers or infrastructure. When a government action destabilises one group, affiliated actors often accelerate the liquidation of dormant proceeds, either to front-run anticipated seizure or because the disruption collapses the trust that was keeping funds idle.
What a government cyberattack on REvil signals for laundering behaviour
A state-level offensive cyber operation against a ransomware group is a significant escalation. Rather than waiting for an arrest or a traditional law-enforcement seizure, the operation reportedly forced REvil offline directly. For actors holding dormant ransomware proceeds, that kind of intervention is a credible signal that waiting is no longer safe. The pattern compliance teams should internalise: government cyber actions against ransomware groups tend to trigger on-chain movement of previously dormant funds across the broader ecosystem, not just within the targeted group.
AML and Compliance Obligations for Firms and Exchanges
Under the Bank Secrecy Act and FinCEN guidance, US-based financial institutions and money services businesses (which include most regulated crypto exchanges) are required to maintain AML programmes that include transaction monitoring capable of detecting suspicious activity. When funds with a documented ransomware provenance reach a customer deposit address, several obligations are triggered simultaneously.
Screening and transaction monitoring
Blockchain analytics screening must cover not just the originating DarkSide wallet but the entire downstream cluster, including peel-chain addresses. A peel chain specifically exists to create distance from the origin address, so a screening tool that only checks direct senders will miss fragments routed through two or three intermediate hops. Compliance teams should confirm their current screening configuration covers second- and third-degree wallet associations for known ransomware clusters.
OFAC considerations
The US Treasury's Office of Foreign Assets Control (OFAC) has previously designated ransomware actors and associated wallets. Any deposit that traces back to a designated wallet, even indirectly, creates potential sanctions exposure. Firms should check current OFAC designations against the wallet addresses appearing in blockchain analytics reports as the DarkSide movement progresses. The fact that funds are moving now means the designated address list may be updated in the near term as authorities track the new wallet cluster.
Suspicious activity reporting
If a customer deposit is flagged as potentially connected to the DarkSide cluster, the standard SAR filing obligation applies. The relevant detail to document is not only the deposit amount but the blockchain analytics evidence: the wallet path, the number of hops from the known DarkSide address, and any exchange addresses identified as intermediate stops. Thorough documentation here protects the firm in any subsequent regulatory review.
Implications for Accounting Firms and CFOs Using Crypto Accounting Software
For accounting firms that manage digital asset portfolios or treasury functions on behalf of clients, and for CFOs whose organisations hold or transact in Bitcoin, the DarkSide movement creates two distinct but related concerns.
Tainted asset risk in portfolio accounting
If a firm's client holds Bitcoin purchased on an exchange that received DarkSide-linked deposits, the client's coins are not automatically tainted. Bitcoin's fungibility means that, in most cases, coins commingled at an exchange are not individually traceable to a criminal source. However, if a client transacted directly with a wallet that is subsequently identified as part of the peel-chain cluster, the accounting treatment and the regulatory disclosure requirement change materially. Good crypto accounting software should flag assets received from addresses appearing on sanctions lists, and compliance teams should verify that their tools update wallet designation data in near real-time rather than on a weekly or monthly cycle.
Audit trail and documentation standards
Auditors reviewing digital asset holdings for the period covering this movement will want to see evidence that the entity's AML screening was active and contemporaneous. A gap in screening logs, or a screening configuration that was not updated to include the new DarkSide wallet cluster, is an audit finding waiting to happen. The practical step is straightforward: pull the screening configuration now, document the date and scope, and retain that record as part of the AML audit file. If your firm uses digital asset accounting software to reconcile on-chain transactions, confirm that the software's data feed includes blockchain analytics outputs, not just price and quantity data.
For additional context on how advanced analytics tools are being applied to detect these patterns, see our coverage of how AI is being applied to Bitcoin money laundering detection at scale. For a broader framework on the on-chain red flags that compliance teams need to recognise, the AML red flags compliance teams must recognise after crypto bridge hacks piece covers overlapping typologies.
Frequently Asked Questions
What is a peel chain and why does it matter for AML screening?
A peel chain is a layering technique where a large amount of cryptocurrency is moved through a sequence of wallet addresses, with a small portion "peeled off" at each step. The result is that the original sum is fragmented and the distance between the source address and any eventual exchange deposit increases with each hop. For AML screening, this means a tool that only checks the immediate sender of a deposit will miss funds that have been peeled through intermediate addresses. Effective screening requires analysis of the full transaction graph, not just the direct predecessor address.
Are exchanges legally required to block deposits from ransomware wallets?
The obligation depends on the regulatory status of the specific wallet. If the wallet or its owner has been formally designated by OFAC, then processing a transaction involving that wallet, even indirectly, can constitute a sanctions violation under the International Emergency Economic Powers Act. Beyond sanctions, exchanges subject to the Bank Secrecy Act must file a SAR if they have reason to know a deposit is connected to criminal activity, even if the wallet is not formally designated. The two obligations operate in parallel, not as alternatives.
How quickly should a compliance team act when dormant ransomware funds start moving?
Immediately. A peel chain can route funds to an exchange deposit address within hours of the initial movement, as the DarkSide case illustrates. Compliance teams should treat a credible report of dormant ransomware funds moving as a trigger to review and, if necessary, update their blockchain analytics screening configuration that same day. Waiting for a formal OFAC designation update before acting creates a window of exposure.
Does holding Bitcoin bought on a legitimate exchange create ransomware exposure for a corporate treasury?
In most cases, no. Bitcoin acquired through a regulated exchange's ordinary market-making process is not individually traceable to a criminal source after it has been commingled in an exchange's liquidity pool. The risk is specific: if a treasury wallet received Bitcoin directly from an address that is subsequently identified as part of a ransomware laundering cluster, that holding warrants review. Corporate treasurers should retain transaction records and blockchain analytics reports to demonstrate the provenance of holdings, particularly for assets acquired during periods of active ransomware laundering activity.
What should an accounting firm do if a client's digital asset audit covers the period of this movement?
The firm should document that the client's AML screening was active and appropriately configured during the relevant period, verify that no client wallet received deposits traceable to the DarkSide cluster, and retain blockchain analytics reports as part of the audit workpapers. If any exposure is identified, the firm should assess whether a SAR obligation is triggered and whether OFAC reporting requirements apply. The audit opinion itself may need to reference the adequacy of the client's AML controls over digital asset transactions as a going-concern or internal-control matter.
Source: Elliptic
]]>