FBI seized $2.3 million in cryptocurrency from REvil ransomware affiliate

It's the second time in the span of just two months the FBI has taken back stolen funds from a REvil affiliate.
The FBI seal is seen outside the headquarters building in Washington, DC on July 5, 2016. (Photo credit YURI GRIPAS/AFP via Getty Images)

The FBI in August seized approximately $2.3 million worth of cryptocurrency from a hacker affiliated with the REvil ransomware gang, according to a court filing unsealed Tuesday.

The money seized was derived from payments to ransomware attacks involving REvil malware between April 2019 and June 2021 in the U.S. and elsewhere.  REvil affiliates generated some $200 million during that time from in ransom payments, according to the FBI. The attacks were allegedly carried out by Aleksandr Sikerin, who is charged with multiple counts of conspiracy and money laundering.

Bleeping Computer first reported on the court documents.

It’s unclear if the seizure is related to  the U.S. actions in November, in which officials seized $6 million in ransom payments from alleged Russian hacker Yevgeniy Polyanin. Authorities also arrested Yaroslav Vasinksyi, a 22-year-old Ukrainian national, when he was entering Poland. Vasinskyi is accused of involvement in the July REvil attack against Florida-based IT firm Kaseya. Kaseya estimated that the attack breached as many as 1500 of its clients.


“When I met with President Putin in June, I made clear that the United States would take action to hold cybercriminals accountable,” President Joe Biden said in a statement at the time. “That’s what we have done today.”

The FBI did not return multiple requests for comment from CyberScoop. Court documents do not connect Sikerin with any specific ransomware attacks.

REvil was one of the most popular strains of ransomware mentioned in ransomware-related activities in 2021 according to an October report from the Treasury Department. REvil’s extortion website went dark in July though experts suggest that members of the group may now be operating under the mantle BlackMatter. BlackMatter also claimed to be shutting down in early November due to pressure from law enforcement.

Tonya Riley

Written by Tonya Riley

Tonya Riley covers privacy, surveillance and cryptocurrency for CyberScoop News. She previously wrote the Cybersecurity 202 newsletter for The Washington Post and before that worked as a fellow at Mother Jones magazine. Her work has appeared in Wired, CNBC, Esquire and other outlets. She received a BA in history from Brown University. You can reach Tonya with sensitive tips on Signal at 202-643-0931. PR pitches to Signal will be ignored and should be sent via email.

Latest Podcasts