Behind Closed Doors: Measurement and Analysis of CryptoLocker Ransoms in Bitcoin Kevin Liao, Ziming Zhao, Adam Doupe,´ and Gail-Joon Ahn Arizona State University fkevinliao, zmzhao, doupe,
[email protected] Abstract—Bitcoin, a decentralized cryptographic currency that called bitcoins1, to other addresses by issuing transactions, has experienced proliferating popularity over the past few years, which are then broadcast to the public blockchain. is the common denominator in a wide variety of cybercrime. Since all confirmed transactions are visible to the public, the We perform a measurement analysis of CryptoLocker, a family of ransomware that encrypts a victim’s files until a ransom blockchain’s inherent transparency has proven to be ineffective is paid, within the Bitcoin ecosystem from September 5, 2013 in preserving the anonymity of its users (legitimate users through January 31, 2014. Using information collected from and cybercriminals alike). While Bitcoin addresses alone are online fora, such as reddit and BitcoinTalk, as an initial starting not explicitly tied to any real-world entities, a number of point, we generate a cluster of 968 Bitcoin addresses belonging recent research efforts have shown that monetary movements to CryptoLocker. We provide a lower bound for CryptoLocker’s economy in Bitcoin and identify 795 ransom payments totalling and address links can be traced throughout the blockchain 1,128.40 BTC ($310,472.38), but show that the proceeds could data structure [3]–[8]. Even though there have been many have been worth upwards of $1.1 million at peak valuation. By attempts to enhance user privacy with varying degrees of analyzing ransom payment timestamps both longitudinally across success (i.e.