LockBit Suffers Major Breach, 60,000 Bitcoin Addresses Compromised

LockBit, a prominent Ransomware-as-a-Service (RaaS) group, recently experienced a significant security breach that compromised approximately 60,000 Bitcoin addresses. The incident was reported by blockchain security firm SlowMist on May 8, who revealed that hackers exploited a PHP 0-day or 1-day vulnerability to gain unauthorized access to LockBit’s backend systems and admin console.

As a result of the breach, a compressed file containing sensitive data was leaked. The exposed information included private keys, internal chat records, and details of affiliated entities. The hackers left a message on the website stating, “Don’t do crime CRIME IS BAD crime is bad xoxo from Prague.”

Ask Aime: How does the LockBit ransomware breach impact Bitcoin holders?

LockBit, in a message to threat researcher Rey, clarified that only wallet addresses and chat logs were published from the attack. The platform asserted that no decryptors or source code were stolen during the breach. However, SlowMist, using its Mistrack system, traced one of LockBit’s Bitcoin wallet addresses and found that the transaction trail led directly to known crypto exchanges, suggesting that the attacker may have already attempted to cash out or launder the stolen funds.

LockBit has since offered a bounty for information on the hacker, claiming that the attacker may be someone called “xoxo” based in Prague. The group stated, “If you can provide accurate and reliable information about this person’s identity — I’m willing to pay for it.” This bounty offer is ironic, given that LockBit is itself a target of a US government bounty program. The US authorities accuse the group of executing over 2,500 ransomware attacks in more than 120 countries, with nearly 1,800 of those victims reportedly based in the United States. The Department of Justice claims the LockBit group extorted more than $500 million in ransom payments, with total losses, factoring in recovery and downtime, reaching into the billions.

Despite LockBit’s claims that only a lightweight management panel had been breached and that core tools like the locker builder, decryptors, and source code remained secure, the incident marks a significant blow to its criminal credibility among affiliates and clients. The breach highlights the vulnerabilities within the RaaS ecosystem and the potential for internal threats to disrupt operations. As the investigation continues, the impact of this breach on LockBit’s operations and the broader ransomware landscape remains to be seen.