TL;DR: In 2023, Caesars Entertainment was hit by a $15 million ransomware attack carried out by the Scattered Spider group.…
The post How Chainalysis Helped the FBI Track Down and Freeze Millions in t...

TL;DR:<ul><li>In 2023, Caesars Entertainment was hit by a $15 million ransomware attack carried out by the Scattered Spider group.</li><li>Chainalysis tools were instrumental in helping the FBI trace and freeze millions in ransom funds across multiple blockchains and protocols.</li><li>The case illustrates how blockchain’s transparency, paired with the right technology and ecosystem cooperation, can turn ransom payments into recoverable assets — even months after the attack.</li></ul><hr>The 2023 ransomware attack on Caesars Entertainment <a href="https://www.bloomberg.com/news/articles/2023-09-13/mgm-caesars-hacked-by-scattered-spider-in-span-of-few-weeks" rel="nofollow">made international headlines</a>. Scattered Spider, the ransomware group behind the attack, used sophisticated social engineering tactics to infiltrate Caesars’ systems. After gaining entry on August 18, they exfiltrated sensitive customer data and demanded $30 million in ransom, ultimately accepting $15 million in cryptocurrency.The hackers likely believed they would be able to use cryptocurrency to shield their windfall from authorities. But crypto’s inherent transparency ultimately worked against them, as blockchain intelligence helped investigators trace the flow of funds.Newly unsealed court documents reveal how the Federal Bureau of Investigation (FBI) used Chainalysis to track the ransom across multiple blockchains and protocols — freezing millions of dollars worth of cryptocurrency before it could be cashed out.<h2>Inside the social engineering attack</h2>A recently unsealed <a href="https://storage.courtlistener.com/recap/gov.uscourts.nvd.173774/gov.uscourts.nvd.173774.1.0.pdf?ref=404media.co&amp;utm_source=www.courtwatch.news&amp;utm_medium=referral&amp;utm_campaign=how-the-fbi-tracked-down-the-15-million-caesars-casino-ransom" rel="nofollow">filing in Nevada District Court</a> reveals that the United States has initiated a <a href="https://www.chainalysis.com/blog/cryptocurrency-asset-seizure/#:~:text=What%20is%20asset%20seizure%20and%20forfeiture%3F" rel="nofollow">civil forfeiture action involving cryptocurrency</a> tied to the proceeds of a ransomware attack. Although the court document does not explicitly name Caesars, referring instead to “Victim A,” the timeline and details leave no room for doubt: a Las Vegas company hacked on August 18, 2023 (the same date Caesars reported its breach) initially faced a $30 million ransom demand that was negotiated down to $15 million.According to a filing with the Maine attorney general’s office, Scattered Spider targeted an outsourced IT support vendor on August 18, likely using voice-phishing techniques to trick IT support into bypassing multi-factor authentication. By August 23, the attackers had accessed the casino’s customer loyalty database containing Social Security numbers and drivers license information.Caesars only discovered the intrusion on September 7, giving the threat actors nearly three weeks inside their systems. By September 14, Caesars publicly disclosed the hack in an <a href="https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm" rel="nofollow">SEC filing</a> and paid the ransom. MGM Resorts was also hit by the same group, but refused to pay and suffered about $100 million in operational disruptions.<h2>Real-time intervention breaks the flow of illicit proceeds</h2>In January 2024, five months after the initial ransom payment, investigators were alerted to a suspicious movement of about 402 BTC (valued at around $11.8 million at the time) through Avalanche Bridge.The FBI immediately contacted Ava Labs, which froze 277.56 BTC. Though 125 BTC had already moved through the bridge before authorities could act, this intervention still prevented millions from reaching the criminals’ control.Soon after, about $690,000 in cryptocurrency was transferred to another wallet hosted by Gate.io. The assets included around $519,845 in stablecoins and roughly 1,135 Monero (XMR). The following day, the FBI contacted Gate.io with a request to freeze the funds. According to the document, Gate.io confirmed it had complied on February 4.This real-time intelligence and intervention capability is a critical advantage in <a href="https://www.chainalysis.com/solution/crypto-investigations/" rel="nofollow">cryptocurrency investigations</a>. While ransomware groups like Scattered Spider are known for their speed during the initial stages of an attack, blockchain analysis allowed investigators to move with equal agility in tracking the proceeds — turning what criminals viewed as an operational advantage into a liability.The pattern observed in the Caesars case mirrors what we’re seeing across the ransomware ecosystem, where threat actors are shifting away from formerly popular money laundering methods like mixers (which declined significantly in 2024) <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/#:~:text=In%20place%20of%20mixers%2C%20we%20have%20noted%20ransomware%20actors%20increasingly%20rely%20on%20cross-chain%20bridges%20to%20facilitate%20their%20off-ramping.%20In%20contrast%2C%20CEXs%20continue%20to%20be%20a%20mainstay%20of%20the%20ransomware%20offramping%20playbook%2C%20with" rel="nofollow">toward cross-chain bridges in an attempt to obfuscate the source of funds</a>.<h2>Blockchain analytics turns transparency into leverage</h2>Although attackers attempt to exploit the pseudonymity and accessibility of cryptocurrency, its inherent transparency and immutability provided an investigative edge. <a href="https://www.chainalysis.com/blog/how-chainalysis-crypto-investigations-supports-cases/" rel="nofollow">Using Chainalysis tools</a>, the FBI successfully traced the ransom through a web of wallets and blockchains.Case documentation included <a href="https://www.chainalysis.com/product/reactor/" rel="nofollow">Chainalysis Reactor graphs</a> that visualized the flow of funds:<img src="https://static.fwimg.io/img/feed/fa74f7fc5915185e4c5d46956238e31c.jpg" alt="">We can see that the BTC ransom was initially sent to two unique wallets (Extortion Wallet 1 and 2). Funds were then transferred through a series of wallets, described in the document as having no prior transaction history — evidence they were <a href="https://www.chainalysis.com/blog/money-laundering-cryptocurrency/" rel="nofollow">created solely for laundering</a>.The BTC was combined into a single wallet and moved to Avalanche Bridge, converting BTC into wrapped tokens on the Avalanche blockchain.<img src="https://static.fwimg.io/img/feed/489e51f6ea8aee4b7d49fb5b42c37d01.jpg" alt="">These tokens were laundered through multiple wallet hops using the Avalanche and Stargate protocols, further obscuring their origin. The funds eventually landed in a Gate.io wallet, where the FBI intervened.<a href="https://www.chainalysis.com/blog/identifying-and-seizing-illicit-crypto-assets/" rel="nofollow">Reactor helped investigators</a> uncover money laundering patterns, connect crypto addresses to real-world entities, and build the evidence needed for asset forfeiture.<h3>The broader context: A changing ransomware landscape</h3>The Caesars attack wasn’t an isolated event. Scattered Spider also targeted MGM Resorts during the same timeframe as part of a coordinated extortion campaign. However, <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/" rel="nofollow">the ransomware landscape has changed dramatically</a> since then.In 2024, <a href="https://www.chainalysis.com/blog/ransomware-disruptions-impact/" rel="nofollow">global law enforcement action significantly disrupted major ransomware operations</a>. LockBit was dismantled, BlackCat exit scammed, and newer groups scrambled to fill the void. These disruptions contributed to a 35% year-over-year drop in total ransomware payments — down from $1.25 billion in 2023 to approximately $813.6 million in 2024. Notably, fewer than half of ransomware incidents resulted in victim payments, highlighting increased resistance and better victim preparedness.<img src="https://static.fwimg.io/img/feed/23f72b71a3455df91b32d6b8221de30d.jpg" alt="">The Caesars case is more than a singular recovery: it’s a testament to how blockchain intelligence is shaping modern cybercrime enforcement. <a href="https://www.chainalysis.com/blog/chainalysis-spanish-police-crypto-seizure/" rel="nofollow">Each successful trace and seizure</a> helps refine methodologies, build precedent, and affirm that the transparency of blockchain technology works against criminal actors rather than enabling them.<h2>Chainalysis supports our partners in asset recovery</h2>To date, Chainalysis has supported partners around the world in <a href="https://www.chainalysis.com/blog/cryptocurrency-asset-seizure/" rel="nofollow">seizing and freezing over $12.6 billion in cryptocurrency</a>. Every recovery builds not just momentum but confidence that in a crypto-activated world, financial crime can be fought and victim funds can be restored.This case exemplifies how blockchain’s transparency, supported with the right tools and partnerships, can lead to high-value recoveries — even after ransom payments have been made. In many ways, this is a turning point: paying a ransom no longer guarantees impunity for threat actors.The ability to intervene after payment and recover funds before they’re cashed out is what makes blockchain intelligence a powerful game-changer for ransomware response.<div><a href="https://academy.chainalysis.com/pages/casc" rel="nofollow"><h2>Chainalysis Crypto Asset Seizure Certification</h2>Learn how to seize crypto assets with the latest investigative tools and techniquesGet certified</a><a href="https://academy.chainalysis.com/pages/casc" rel="nofollow"><img src="https://static.fwimg.io/img/feed/5c4d201b260deef6aa9d09fdebeb6aff.jpg" alt=""></a></div>This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.The post <a href="https://www.chainalysis.com/blog/chainalysis-fbi-ceasars-ransomware-recovery/" rel="nofollow">How Chainalysis Helped the FBI Track Down and Freeze Millions in the Caesars Casino Ransomware Attack</a> appeared first on <a href="https://www.chainalysis.com/" rel="nofollow">Chainalysis</a>.

How Chainalysis Helped the FBI Track Down and Freeze Millions in the Caesars Casino Ransomware Attack

TL;DR: Trong năm 2023, Caesars Entertainment đã bị tấn công bởi Mã độc tống tiền trị giá 15 triệu đô la do nhóm Scattered Spider thực hiện.…
Bài viết Cách <Chainalysis> Đã Giúp FBI Theo Dõi và Đóng Băng Hàng Triệu Đô La trong...

TL;DR:<ul><li>Năm 2023, Caesars Entertainment đã bị tấn công bằng mã độc tống tiền trị giá 15 triệu đô la do nhóm Scattered Spider thực hiện.</li><li>Các công cụ của Chainalysis đã giúp FBI truy tìm và đóng băng hàng triệu đô la tiền chuộc trên nhiều blockchain và giao thức.</li><li>Vụ việc minh họa cách tính minh bạch của blockchain, kết hợp với công nghệ và sự hợp tác của hệ sinh thái, có thể biến các khoản thanh toán tiền chuộc thành tài sản có thể thu hồi - thậm chí nhiều tháng sau vụ tấn công.</li></ul><hr>

(Phần còn lại của văn bản được dịch tương tự, tuân thủ các quy tắc dịch thuật đã nêu)

Chainalysis đã giúp FBI theo dõi và đóng băng hàng triệu đô la trong cuộc tấn công Mã độc tống tiền Caesars Casino như thế nào

Tác giả | Mười bốn tháng Sáu
1. Giới thiệu Thoáng chốc, tôi đã làm việc trong ngành ví điện tử được bốn năm. Nhiều người cho rằng thị trường ví điện tử đã ổn định vào năm 2025, nhưng thực tế không phải vậy — nó vẫn đang âm thầm phát triển. Trong năm vừa qua:
Coinbase vừa ra mắt ví CDP mới, được xây dựng trên nền tảng công nghệ TEE.
Ví MPC của Binance giới thiệu tính năng phân mảnh khóa và lưu trữ vào hoàn cảnh TEE;
Bitget vừa ra mắt tính năng đăng nhập bằng tài khoản mạng xã hội vào tuần trước, được lưu trữ trên nền tảng TEE.
· ...

Tổng quan ngắn gọn lịch sử ví blockchain và bối cảnh thị trường năm 2025.

Sau những tranh cãi xung quanh quan điểm của Fundstrat Bitcoin , người đồng sáng lập TomLee đã lên tiếng phản hồi, khẳng định rằng những "dự đoán trái chiều" mà người ngoài nhìn thấy thực chất là kết luận nghiên cứu từ các quan điểm và mốc thời gian khác nhau, chứ không phải là bất đồng nội bộ. Trước đó, Sean Farrell, người đứng đầu chiến lược tài sản kỹ thuật số tại Fundstrat, cho rằng Bitcoin có thể giảm xuống mức 60.000-65.000 đô la trong nửa đầu năm 2026; trong khi TomLee cho rằng Bitcoin có thể đạt mức cao mới, thậm chí tăng vọt lên 200.000 đô la ngay từ đầu năm 2026. Một điều thú vị...

Tom Lee phản hồi về những tranh cãi xung quanh quan điểm Bitcoin : Quan điểm khác nhau, mốc thời gian khác nhau, chứ không phải bất đồng nội bộ.

Một người dùng tiền điện tử đã mất 50 triệu USDT sau khi trở thành nạn nhân của một vụ lừa đảo đánh cắp địa chỉ trong một cuộc tấn công mạng quy mô lớn.
Vụ trộm, được phát hiện bởi công ty bảo mật Web3 Antivirus, xảy ra sau khi người dùng gửi...