Crypto enforcement: ransomware

6 US enforcement actions involving ransomware in crypto since January 2024.

6 actions since January 2024

0 so far in 2026, against 3 by this date in 2025 and 2 in 2024.

Date	Agency	Action	Stage	Figure
19 Nov 2025	OFAC	OFAC sanctioned Russian bulletproof hosting firms and individuals supporting ransomware, including a listed bitcoin address.	Sanction	—
14 Aug 2025	DOJ	DOJ unsealed warrants seizing over $2.8 million in crypto, cash and a vehicle tied to an alleged Zeppelin ransomware operator.	Seizure or forfeiture	$2.8m forfeiture
28 Jul 2025	DOJ	US filed a civil forfeiture complaint for over $1.7 million in bitcoin seized from a Chaos ransomware group member's address.	Civil action	$1.7m forfeiture
11 Feb 2025	OFAC	OFAC sanctioned Russian hosting provider Zservers and two Russian nationals for providing infrastructure enabling ransomware attacks.	Sanction	—
07 May 2024	OFAC	OFAC added a Russian national described as a senior leader of the LockBit ransomware group to the SDN List, including a bitcoin address.	Sanction	—
20 Feb 2024	OFAC	OFAC added two Russian nationals tied to the LockBit ransomware group to the SDN List, listing their bitcoin and ether addresses.	Sanction	—

Each row is one published step in a case, linked to its source document, so a case can appear again as it moves from charge to plea to sentence. Where one step was announced twice within days, it counts once. Justice Department rows are press releases whose headline names crypto. Figures are the main amount each document states, and for charges they are allegations. Allegations are unproven unless a conviction, plea or settlement is stated. Summaries and stages are machine-read from the document and checked automatically, so the linked document is the authority.

Cite this Bitminer.io, “Crypto enforcement: ransomware”, data to 3 November 2026, https://bitminer.io/ledger/enforcement/scheme/ransomware/. How this is built