Joint analysis by a blockchain analytics firm and an insurer traced at least $107m in bitcoin ransom payments to Black Basta from early 2022 to November 2023. The figure is widely repeated in coverage of the leak.
It deserves the repetition. Almost every number in this corpus originates with a party who wanted it to be a particular size. A traced chain figure is derived from a public ledger and is one of the few that does not.
What It Measures
Payments the analysts could attribute to addresses they associated with the operation, in the period examined. Every one of those clauses is a boundary.
Attribution of addresses is an analytical judgement. Payments through addresses not attributed are outside it. So is anything after November 2023 — which is most of the period the leaked archive covers.
What It Does Not Measure
Harm. This corpus filed at 25-1219 that no mechanism connects a breach to a subsequent fraud, and the same gap sits here: money received by an attacker is not money lost by a victim, and neither is the cost of the incident.
The Southern Water file at 25-0216 is the demonstration. Response cost, extortion demand and traced receipt are three separate ledgers, and a figure from one of them answers a question about that one only.
And It Is A Floor, Which Is The Useful Part
Chain analysis produces an "at least". That is the opposite of most figures in this database, which are ceilings offered by whoever benefits from a large number — the attacker volume claims at 25-1111 and 25-1001, the market sizing disputed at 25-1102.
A floor from a public ledger and a ceiling from an interested party are not the same kind of object, and this corpus has not always been careful to say which it is holding. This file is the correction.
The $107m figure is as reported in coverage of the leak, attributed to joint work by a blockchain analytics firm and an insurer covering early 2022 to November 2023. This desk has not reviewed the underlying analysis and cannot evaluate the address attribution on which it rests. Graded medium. Corrections: corrections@forensicpost.com.