TL;DR: In 2023, Caesars Entertainment was hit by a $15 million ransomware attack carried out by the Scattered Spider group.…
The post How Chainalysis Helped the FBI Track Down and Freeze Millions in t...

TL;DR:<ul><li>In 2023, Caesars Entertainment was hit by a $15 million ransomware attack carried out by the Scattered Spider group.</li><li>Chainalysis tools were instrumental in helping the FBI trace and freeze millions in ransom funds across multiple blockchains and protocols.</li><li>The case illustrates how blockchain’s transparency, paired with the right technology and ecosystem cooperation, can turn ransom payments into recoverable assets — even months after the attack.</li></ul><hr>The 2023 ransomware attack on Caesars Entertainment <a href="https://www.bloomberg.com/news/articles/2023-09-13/mgm-caesars-hacked-by-scattered-spider-in-span-of-few-weeks" rel="nofollow">made international headlines</a>. Scattered Spider, the ransomware group behind the attack, used sophisticated social engineering tactics to infiltrate Caesars’ systems. After gaining entry on August 18, they exfiltrated sensitive customer data and demanded $30 million in ransom, ultimately accepting $15 million in cryptocurrency.The hackers likely believed they would be able to use cryptocurrency to shield their windfall from authorities. But crypto’s inherent transparency ultimately worked against them, as blockchain intelligence helped investigators trace the flow of funds.Newly unsealed court documents reveal how the Federal Bureau of Investigation (FBI) used Chainalysis to track the ransom across multiple blockchains and protocols — freezing millions of dollars worth of cryptocurrency before it could be cashed out.<h2>Inside the social engineering attack</h2>A recently unsealed <a href="https://storage.courtlistener.com/recap/gov.uscourts.nvd.173774/gov.uscourts.nvd.173774.1.0.pdf?ref=404media.co&amp;utm_source=www.courtwatch.news&amp;utm_medium=referral&amp;utm_campaign=how-the-fbi-tracked-down-the-15-million-caesars-casino-ransom" rel="nofollow">filing in Nevada District Court</a> reveals that the United States has initiated a <a href="https://www.chainalysis.com/blog/cryptocurrency-asset-seizure/#:~:text=What%20is%20asset%20seizure%20and%20forfeiture%3F" rel="nofollow">civil forfeiture action involving cryptocurrency</a> tied to the proceeds of a ransomware attack. Although the court document does not explicitly name Caesars, referring instead to “Victim A,” the timeline and details leave no room for doubt: a Las Vegas company hacked on August 18, 2023 (the same date Caesars reported its breach) initially faced a $30 million ransom demand that was negotiated down to $15 million.According to a filing with the Maine attorney general’s office, Scattered Spider targeted an outsourced IT support vendor on August 18, likely using voice-phishing techniques to trick IT support into bypassing multi-factor authentication. By August 23, the attackers had accessed the casino’s customer loyalty database containing Social Security numbers and drivers license information.Caesars only discovered the intrusion on September 7, giving the threat actors nearly three weeks inside their systems. By September 14, Caesars publicly disclosed the hack in an <a href="https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm" rel="nofollow">SEC filing</a> and paid the ransom. MGM Resorts was also hit by the same group, but refused to pay and suffered about $100 million in operational disruptions.<h2>Real-time intervention breaks the flow of illicit proceeds</h2>In January 2024, five months after the initial ransom payment, investigators were alerted to a suspicious movement of about 402 BTC (valued at around $11.8 million at the time) through Avalanche Bridge.The FBI immediately contacted Ava Labs, which froze 277.56 BTC. Though 125 BTC had already moved through the bridge before authorities could act, this intervention still prevented millions from reaching the criminals’ control.Soon after, about $690,000 in cryptocurrency was transferred to another wallet hosted by Gate.io. The assets included around $519,845 in stablecoins and roughly 1,135 Monero (XMR). The following day, the FBI contacted Gate.io with a request to freeze the funds. According to the document, Gate.io confirmed it had complied on February 4.This real-time intelligence and intervention capability is a critical advantage in <a href="https://www.chainalysis.com/solution/crypto-investigations/" rel="nofollow">cryptocurrency investigations</a>. While ransomware groups like Scattered Spider are known for their speed during the initial stages of an attack, blockchain analysis allowed investigators to move with equal agility in tracking the proceeds — turning what criminals viewed as an operational advantage into a liability.The pattern observed in the Caesars case mirrors what we’re seeing across the ransomware ecosystem, where threat actors are shifting away from formerly popular money laundering methods like mixers (which declined significantly in 2024) <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/#:~:text=In%20place%20of%20mixers%2C%20we%20have%20noted%20ransomware%20actors%20increasingly%20rely%20on%20cross-chain%20bridges%20to%20facilitate%20their%20off-ramping.%20In%20contrast%2C%20CEXs%20continue%20to%20be%20a%20mainstay%20of%20the%20ransomware%20offramping%20playbook%2C%20with" rel="nofollow">toward cross-chain bridges in an attempt to obfuscate the source of funds</a>.<h2>Blockchain analytics turns transparency into leverage</h2>Although attackers attempt to exploit the pseudonymity and accessibility of cryptocurrency, its inherent transparency and immutability provided an investigative edge. <a href="https://www.chainalysis.com/blog/how-chainalysis-crypto-investigations-supports-cases/" rel="nofollow">Using Chainalysis tools</a>, the FBI successfully traced the ransom through a web of wallets and blockchains.Case documentation included <a href="https://www.chainalysis.com/product/reactor/" rel="nofollow">Chainalysis Reactor graphs</a> that visualized the flow of funds:<img src="https://static.fwimg.io/img/feed/fa74f7fc5915185e4c5d46956238e31c.jpg" alt="">We can see that the BTC ransom was initially sent to two unique wallets (Extortion Wallet 1 and 2). Funds were then transferred through a series of wallets, described in the document as having no prior transaction history — evidence they were <a href="https://www.chainalysis.com/blog/money-laundering-cryptocurrency/" rel="nofollow">created solely for laundering</a>.The BTC was combined into a single wallet and moved to Avalanche Bridge, converting BTC into wrapped tokens on the Avalanche blockchain.<img src="https://static.fwimg.io/img/feed/489e51f6ea8aee4b7d49fb5b42c37d01.jpg" alt="">These tokens were laundered through multiple wallet hops using the Avalanche and Stargate protocols, further obscuring their origin. The funds eventually landed in a Gate.io wallet, where the FBI intervened.<a href="https://www.chainalysis.com/blog/identifying-and-seizing-illicit-crypto-assets/" rel="nofollow">Reactor helped investigators</a> uncover money laundering patterns, connect crypto addresses to real-world entities, and build the evidence needed for asset forfeiture.<h3>The broader context: A changing ransomware landscape</h3>The Caesars attack wasn’t an isolated event. Scattered Spider also targeted MGM Resorts during the same timeframe as part of a coordinated extortion campaign. However, <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/" rel="nofollow">the ransomware landscape has changed dramatically</a> since then.In 2024, <a href="https://www.chainalysis.com/blog/ransomware-disruptions-impact/" rel="nofollow">global law enforcement action significantly disrupted major ransomware operations</a>. LockBit was dismantled, BlackCat exit scammed, and newer groups scrambled to fill the void. These disruptions contributed to a 35% year-over-year drop in total ransomware payments — down from $1.25 billion in 2023 to approximately $813.6 million in 2024. Notably, fewer than half of ransomware incidents resulted in victim payments, highlighting increased resistance and better victim preparedness.<img src="https://static.fwimg.io/img/feed/23f72b71a3455df91b32d6b8221de30d.jpg" alt="">The Caesars case is more than a singular recovery: it’s a testament to how blockchain intelligence is shaping modern cybercrime enforcement. <a href="https://www.chainalysis.com/blog/chainalysis-spanish-police-crypto-seizure/" rel="nofollow">Each successful trace and seizure</a> helps refine methodologies, build precedent, and affirm that the transparency of blockchain technology works against criminal actors rather than enabling them.<h2>Chainalysis supports our partners in asset recovery</h2>To date, Chainalysis has supported partners around the world in <a href="https://www.chainalysis.com/blog/cryptocurrency-asset-seizure/" rel="nofollow">seizing and freezing over $12.6 billion in cryptocurrency</a>. Every recovery builds not just momentum but confidence that in a crypto-activated world, financial crime can be fought and victim funds can be restored.This case exemplifies how blockchain’s transparency, supported with the right tools and partnerships, can lead to high-value recoveries — even after ransom payments have been made. In many ways, this is a turning point: paying a ransom no longer guarantees impunity for threat actors.The ability to intervene after payment and recover funds before they’re cashed out is what makes blockchain intelligence a powerful game-changer for ransomware response.<div><a href="https://academy.chainalysis.com/pages/casc" rel="nofollow"><h2>Chainalysis Crypto Asset Seizure Certification</h2>Learn how to seize crypto assets with the latest investigative tools and techniquesGet certified</a><a href="https://academy.chainalysis.com/pages/casc" rel="nofollow"><img src="https://static.fwimg.io/img/feed/5c4d201b260deef6aa9d09fdebeb6aff.jpg" alt=""></a></div>This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.The post <a href="https://www.chainalysis.com/blog/chainalysis-fbi-ceasars-ransomware-recovery/" rel="nofollow">How Chainalysis Helped the FBI Track Down and Freeze Millions in the Caesars Casino Ransomware Attack</a> appeared first on <a href="https://www.chainalysis.com/" rel="nofollow">Chainalysis</a>.

How Chainalysis Helped the FBI Track Down and Freeze Millions in the Caesars Casino Ransomware Attack

요약: 2023년, 카이사르 엔터테인먼트는 스캐터드 스파이더 그룹이 수행한 1,500만 달러 규모의 랜섬웨어 공격을 받았습니다.…
게시물 체인애널리시스가 어떻게 FBI가 수백만 달러를 추적하고 동결하는 데 도움을 주었는지...

TL;DR:<ul><li>2023년, 카이사스 엔터테인먼트는 스캐터드 스파이더 그룹이 수행한 1,500만 달러 규모의 랜섬웨어 공격을 받았습니다.</li><li>체인애널리시스 도구는 FBI가 여러 블록체인과 프로토콜에 걸쳐 랜섬 자금을 추적하고 동결하는 데 중요한 역할을 했습니다.</li><li>이 사례는 블록체인의 투명성과 적절한 기술 및 생태계 협력이 랜섬 지불금을 공격 후 몇 달이 지나도 회수 가능한 자산으로 전환할 수 있음을 보여줍니다.</li></ul><hr>

[이하 생략 - 전체 번역은 동일한 방식으로 진행됩니다.]

Chainalysis가 FBI가 Caesars Casino 랜섬웨어 공격에서 수백만 달러를 추적하고 동결하는 데 도움을 준 방법

암호화폐 거래자들이 소셜 미디어에서 시장 바닥을 확인할 만큼 충분한 공포감을 아직 보이지 않았다고 한 암호화폐 분석가는 말하며, 비트코인 가격이 여전히 7만 5천 달러 부근까지 하락할 수 있다고 시사했습니다.
"매우 유혹적으로 보이네요..."

암호화폐 시장은 아직 바닥을 쳤다고 단정짓기에는 ‘충분히 겁먹지 않았다’: 산티먼트

ME 뉴스에 따르면, 12월 21일(UTC+8) 이더 창시자 비탈릭 부테린은 파캐스터(Farcaster)에 글을 올려 예측 시장이 정서 주제에 대한 비이성적인 관점 에 대한 좋은 해결책이 될 수 있다고 주장했습니다. 그는 두 개의 스크린샷을 예시로 들었는데, 일론 머스크가 이전에 영국 내전이 "불가피하다"고 주장했던 것을 보여주면서 예측 시장 폴리마켓(Polymarket)에서는 "2024년에 영국 내전이 일어날 것인가?"라는 질문에 대해 3%의 확률만 제시했다는 것입니다. (비탈릭은 일부 베팅 참여자들이 확률을 부풀렸기 때문에 3%도 너무 높다고 생각합니다.) 비탈릭은...

비탈릭: 예측 시장은 정서 주제에 대한 과격한 관점 분산시켜 소셜 미디어의 "해결책"이 될 수 있습니다.

한 암호화폐 사용자가 대규모 온체인 공격으로 인한 주소 오염 사기에 속아 5천만 달러 상당의 테더 USDT(USDT) 잃었습니다.
웹3 보안 회사인 웹3 안티바이러스가 발견한 이 도용 사건은 사용자가 메시지를 보낸 후에 발생했습니다...