REvil Ransomware: How Crypto Payments Are Made and Laundered
A detailed case study published by blockchain analytics firm Elliptic traces a real REvil ransomware attack from the moment of infection through ransom negotiation, Bitcoin payment, and post-payment laundering. For accounting firms, auditors, and CFOs who manage or advise on digital asset exposure, the findings carry direct AML, sanctions, and financial reporting implications that cannot be ignored.
What REvil Is and Why It Matters for Crypto Accounting Software Users
REvil, also known as Sodinokibi, is a Russia-linked ransomware group responsible for attacks on businesses across multiple sectors. In one high-profile incident, hundreds of firms were compromised through a supply-chain attack targeting Kaseya, an IT management software provider. The group operates at scale, running what amounts to a professional criminal enterprise with its own victim portal, negotiation interface, and technical support infrastructure.
Understanding how REvil collects and moves cryptocurrency is not an academic exercise. Firms that use crypto accounting software to record digital asset transactions need to understand that funds passing through exchanges can carry ransomware taint, and that taint can surface during due diligence, audit, or regulatory review. The lifecycle documented by Elliptic makes that risk concrete.
Inside the Negotiation: From Monero Demand to Bitcoin Payment
The case Elliptic followed began with a standard REvil infection. Once the malware executed on the victim's system, it encrypted files and left a ransom note directing the victim to a Tor-hosted portal. That portal displayed the initial demand: $50,000 payable in Monero (XMR), a privacy-focused cryptocurrency designed to be extremely difficult to trace on the blockchain.
The Monero-to-Bitcoin Switch
Monero is the preferred currency of many ransomware groups precisely because its transaction graph is opaque by design. Obtaining XMR is also harder for most victims, particularly in the United States where fewer exchanges list it. Ransomware response firms that negotiate and pay on behalf of victims frequently decline Monero payments altogether, partly due to sanctions compliance concerns.
In this case, the victim requested to pay in Bitcoin instead. REvil agreed, but applied a 10% surcharge on the negotiated amount. That premium is telling: the group explicitly priced in the additional risk it accepts when receiving a traceable asset. Bitcoin's public ledger means that blockchain analytics firms can follow the money, and REvil's operators know it.
The Negotiation in Practice
The victim portal functions similarly to a commercial customer-service interface, complete with a chat tab where the victim can communicate directly with REvil operators. The documented exchange shows the victim opening negotiations, requesting proof of decryption capability (REvil provided decrypted sample files as evidence), and then pushing the price down aggressively. An opening counter of $10,000 was rejected. After further back-and-forth, both sides settled at $25,000 in Bitcoin, roughly half the original demand after accounting for an earlier 20% discount applied by REvil before negotiations even began.
Before sending funds, the victim asked REvil to confirm the destination Bitcoin address. That caution is operationally important: cryptocurrency payments are irreversible. Once broadcast to the network, a transaction cannot be recalled. Verifying the address before transmission is elementary hygiene, but it is a step that victims under pressure frequently overlook.
Payment Confirmed: What Happens on the Blockchain
Once the victim transferred $25,000 in Bitcoin, the REvil portal updated to confirm receipt and provide access to the decryption tool. For the victim, the incident was effectively over. For compliance and forensic purposes, it was just beginning.
Layering and Wallet Splitting
Elliptic's blockchain tracing showed that REvil immediately began laundering the received funds. The laundering technique used is known as layering: the Bitcoin is split across multiple wallets, combined with funds from other ransom payments, and routed through intermediary addresses to obscure the original source. At the point of publication the laundering process was described as still ongoing, yet blockchain analytics had already traced portions of the funds to exchanges.
Those exchanges hold know-your-customer (KYC) records for the accounts that received the tainted Bitcoin. That data represents actionable intelligence for law enforcement, even if the ultimate cash-out has not yet occurred. The practical implication for exchanges and financial institutions is that screening inbound deposits against known ransomware wallets is not optional; it is a frontline AML control.
Why Exchanges Are the Chokepoint
Most exchanges that convert Bitcoin into fiat currency use blockchain analytics tools to screen customer deposits. Tainted funds identified at this stage can be frozen pending law enforcement review. REvil's layering attempts are partly designed to pass this screen by breaking the direct link between the ransom wallet and the cash-out account. The longer and more complex the layering chain, the harder the attribution, though Elliptic's case study shows that sophisticated analytics can still follow the thread.
For a deeper look at how artificial intelligence is now being applied to detect this kind of laundering behaviour at scale, see our coverage of how AI is being applied to detect Bitcoin money laundering at scale.
AML Implications for Accounting Firms and CFOs
The REvil case study is a practical illustration of how crypto-related financial crime reaches into the balance sheets of otherwise legitimate businesses. There are several distinct compliance pressure points for professional services firms and corporate finance teams.
Ransomware Payments and Sanctions Risk
Paying a ransom to a sanctioned entity, or to a group whose members are subject to sanctions, can itself constitute a sanctions violation, regardless of whether the payment was made under duress. The US Office of Foreign Assets Control (OFAC) has previously issued guidance making clear that ransom payments to sanctioned actors carry regulatory risk for both the victim and any intermediary, including advisors and incident response firms, involved in facilitating the payment. Any client that has suffered a ransomware attack and paid in cryptocurrency needs that payment assessed for sanctions exposure before it appears on a financial statement.
Ledger Treatment of a Ransom Payment
From a pure bookkeeping perspective, a ransom paid in cryptocurrency involves at least two distinct accounting events: the disposal of the cryptocurrency (which may trigger a taxable capital gain or loss depending on the acquisition cost of the Bitcoin used) and the recognition of the ransom as an operating expense or loss. If the Bitcoin used to pay was held on the corporate balance sheet, the disposal must be recorded at fair market value at the time of the transaction. Firms relying on digital asset accounting software should verify that their systems capture the cost basis of the disposed coins and generate the appropriate gain/loss calculation automatically.
Tainted Inflows: The Recipient Side
Accounting firms that provide outsourced bookkeeping or CFO services to cryptocurrency businesses face a different risk: a client may unknowingly receive funds that have passed through ransomware wallets during the laundering chain. If a client's exchange account receives Bitcoin that Elliptic or a comparable analytics tool can link to a REvil wallet, the exchange may freeze the funds, file a suspicious activity report (SAR), or both. Firms using crypto bookkeeping software should ensure their reconciliation process flags any funds subsequently frozen or quarantined by an exchange, and that the relevant disclosure obligations are understood.
This risk is not hypothetical. As we covered previously, AML red flags compliance teams must know after crypto bridge hacks include exactly this kind of downstream taint contamination, where funds from criminal activity pass through multiple hops before landing in a seemingly clean account.
Practical Steps for Firms Advising Crypto-Active Clients
The Elliptic case study is detailed enough to support a set of concrete operational responses for professional services firms.
Pre-Incident Preparation
Firms should review whether their clients have a ransomware response protocol that includes a sanctions check before any payment is made. If a client operates in the US, any payment touching a sanctioned individual or entity carries OFAC exposure. The incident response plan should include a step where legal counsel with sanctions expertise is engaged before funds move, not after.
Post-Payment Accounting Review
If a payment has already been made, the accounting team needs to reconstruct the transaction with precision: the date, the Bitcoin amount, the fiat equivalent at the time of transfer, the cost basis of the coins used, and the wallet addresses involved. These details are needed both for the financial statements and for any subsequent law enforcement cooperation. Robust digital asset accounting software that preserves a full, timestamped audit trail is not a luxury in this scenario; it is a prerequisite for defensible reporting.
Ongoing Wallet Screening
For firms that manage crypto treasuries or process crypto receipts on behalf of clients, wallet screening against known ransomware and sanctions lists should be a standing operational control, not a one-time check. Blockchain analytics capabilities are now commercially available and are increasingly expected by regulators as part of a credible AML framework. The REvil case confirms that even small businesses are targets, and that the ransom amounts involved, though modest compared to headline attacks, are large enough to cause material financial and reputational harm.
Frequently Asked Questions
Can a company legally pay a cryptocurrency ransom?
It depends on who is receiving the payment. In the US, paying a ransom to a person or group designated by OFAC as a sanctioned party can constitute a sanctions violation, even if the payment was made under duress. OFAC has published specific guidance on ransomware payments. Before any ransom is paid, sanctions counsel should be engaged. The fact that the payment is made in cryptocurrency does not change the legal analysis.
How should a Bitcoin ransom payment be recorded in the accounts?
A ransom paid in Bitcoin involves disposing of a capital asset. The disposal should be recorded at the fair market value of the Bitcoin at the time of the transaction. The difference between that value and the cost basis of the Bitcoin held is a capital gain or loss. The ransom itself is typically recorded as an operating expense or an exceptional loss, depending on the accounting framework in use. Both events need to be captured separately in your digital asset accounting software.
Why do ransomware groups prefer Monero over Bitcoin?
Monero uses cryptographic techniques that obscure sender addresses, recipient addresses, and transaction amounts at the protocol level. Unlike Bitcoin, where the transaction graph is publicly visible on the blockchain, Monero transactions are designed to be untraceable. This makes it far harder for blockchain analytics firms to follow the money after a ransom payment. REvil's willingness to accept Bitcoin in the documented case, at a 10% premium, reflects the added traceability risk the group takes on by moving away from Monero.
What is layering in the context of crypto money laundering?
Layering is the second stage of the classic three-stage money laundering model: placement, layering, and integration. In a crypto context, layering typically involves splitting funds across many wallets, mixing them with funds from other sources, and routing them through multiple intermediary addresses to break the transaction trail. The goal is to make it difficult for blockchain analytics tools to connect the original criminal wallet to the eventual cash-out point at an exchange.
What should an accounting firm do if a client's crypto funds are frozen due to ransomware taint?
The first step is to understand the basis for the freeze. Exchanges typically freeze funds when their screening tools flag a connection to a known illicit wallet. The firm should obtain documentation from the exchange, assess whether a SAR has been filed, and engage legal counsel with AML expertise. From an accounting perspective, frozen funds may need to be reclassified as a contingent asset until the freeze is resolved, with appropriate disclosure in the financial statements. The situation should not be treated as a routine reconciliation item.
Source: Elliptic