Attribution in practice: ransomware, scams and DPRK thefts

Three kinds of case dominate attribution work: ransomware, scams run at industrial scale, and large thefts that authorities attribute to state-linked groups such as those of the Democratic People's Republic of Korea (DPRK). Each has a recognizable on-chain shape, typical cash-out infrastructure and a typical way in which attribution reaches the public. Knowing these patterns speeds an investigation; leaning on them too hard produces over-attribution, the most common attribution error in practice. This lesson applies the layers, sources and link tests from the previous lessons to these three typologies and ends with a fictional worked example.

Three typologies at a glance

The last row matters most. In ransomware and scams, identity is often reachable through records at the cash-out points. In DPRK-attributed thefts, the investigator's job is usually tracing, freezing and recovery, with actor attribution taken from authorities.

Ransomware

Most ransomware is run as a service: developers supply the malware and payment infrastructure, affiliates break into victims and deploy it, and each payment is split. For the DarkSide group, analysts reported in 2021 that affiliates kept 75% to 90% depending on ransom size, and that the split was visible on-chain as two outputs of predictable proportion. After the Colonial Pipeline attack (May 2021), investigators traced the roughly 75 BTC ransom and seized 63.7 BTC from one address (see the lesson Tracing to an evidential standard). Public analyses noted that the seized amount was about 85% of the payment, consistent with an affiliate share; the official announcement did not say so, and a careful report would describe that reading as an inference.

Useful attribution features:

• Payment addresses are usually unique per victim, so the victim's payment record and the negotiation transcript fix the seed with certainty.
• Developer wallets receive shares from many victims. When one of those payments is named in an authority release, the developer wallet can be linked to the group, as your own inference from the release.
• Leak sites where groups publish stolen data are open sources that date incidents and name victims. They contain victims' personal data: collect only what the case needs, under the precautions in the lesson OSINT methodology.

Scams and money-mule networks

Investment and romance scams, sometimes called "pig butchering", draw victims into fake trading platforms. On-chain, they show many victim deposits from regulated exchanges converging on collector addresses, then movement into stablecoins and onward to cash-out points. Typologies are covered in the IDFE-CC lesson Red flags and typologies; the forensic interest here is the cash-out layer.

Cash-out commonly runs through money mules: people who open exchange or bank accounts in their own names, or sell their identities, and pass funds on for a fee. The account holder in the records is therefore often not the controller (see the lesson From address to entity to person). Signs of a mule network appear in the service's records rather than on-chain:

• Many accounts opened within a short period, with different names but the same device identifiers, IP ranges or phone numbers.
• Deposits withdrawn quickly to the same few addresses or bank accounts.
• Logins from locations that do not match the account holders' stated addresses.

Requests to services should therefore ask for device and login data, linked accounts and withdrawal destinations, not only KYC (see the lesson Working with service providers). Stablecoin issuers can freeze addresses at the contract level, which makes speed decisive (see the lesson Freezing and seizure options).

DPRK-attributed thefts

Large thefts attributed by authorities to DPRK-linked groups follow a recognizable pattern: rapid dispersal, swaps out of freezable tokens, cross-chain movement (often ending in bitcoin), mixers and over-the-counter brokers. Two public cases show how attribution was published:

• Ronin bridge (March 2022): about USD 620 million in ETH and USDC was taken. In April 2022 the attacker's address was added to a sanctions list, and the theft was publicly attributed to a DPRK-linked group.
• Bybit (21 February 2025): about USD 1.5 billion in virtual assets was stolen. Five days later a national law-enforcement agency issued a public service announcement attributing the theft to a DPRK actor it calls TraderTraitor, listing 51 Ethereum addresses, describing conversion to bitcoin and dispersal across thousands of addresses on multiple blockchains, and asking node operators, exchanges and bridges to block related transactions.

Multilateral bodies also publish. The UN Security Council's Panel of Experts on the DPRK reported on cyber thefts until its mandate ended in April 2024; a Multilateral Sanctions Monitoring Team formed by eleven states published a report in October 2025 estimating about USD 2.84 billion in crypto-assets stolen between January 2024 and September 2025 and describing cash-out through overseas brokers and networks (figures dated, for illustration).

Actor attribution in these cases rests on intelligence, malware analysis and infrastructure evidence that lie outside on-chain work. The examiner cites it as the authority's attribution and adds the tracing.

How public-sector attributions are published, and how to cite them

Cite each with its title, issuer, date and, where possible, an archived copy and hash. State which addresses the authority named, and mark every extension (cluster members, downstream addresses) as your own inference with its grade.

Avoiding over-attribution

• Actor versus address: "the theft was attributed by the competent authority to Group X" is a citation; "address Y belongs to Group X" is an attribution that needs its own basis.
• Downstream is not the actor: an exchange hot wallet, a bridge contract or a mixer pool that received stolen funds is not part of the actor's infrastructure. Stop label propagation at services.
• Pattern is not identity: a laundering sequence that resembles a known group's style is a reason to look, not an attribution. Copycats and shared services produce similar patterns.
• One group, many labels: the same activity appears under different names in different reports. Record the names used by each source rather than merging them.
• Correct promptly: if a public attribution is revised, update the case file and any shared alerts.

Worked example (fictional)

A company paid 12.00000000 BTC to bc1q…r4n5, the address given in its negotiation portal. The examiner records:

The report states that funds reached Exchange K (grade B), that Exchange K's records show three accounts with shared device data (grade A as records), and that the developer wallet is linked to Group R through common spending with an address the authority named (grade C). It does not state that the account holders are the affiliates. The next steps follow from the weakest links: bank records for the common account, device evidence, and a request to Exchange K for login IP history.

Exam focus: the typical on-chain shape, cash-out and attribution source for ransomware, scams and DPRK-attributed thefts; the ransomware-as-a-service split and why reading a split as roles is an inference; unique ransom addresses as certain seeds; money-mule signs in service records and what to request; how Ronin (2022) and Bybit (2025) attributions were published; formats of public-sector attribution and how to cite them, separating named addresses from your own extensions; the main over-attribution errors (actor versus address, downstream services, pattern versus identity); grading a mixed chain in a worked example.