# On the Economic Significance of Ransomware Campaigns: A Bitcoin Transactions Perspective

arXiv: https://arxiv.org/abs/1804.01341 · HTML: https://mlsanity.com/paper/1804.01341/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Apr 2018.

## Built on by (most cited first, 7 of 7)

- [BABD: A Bitcoin Address Behavior Dataset for Pattern Analysis](https://mlsanity.com/paper/2204.05746/) (2022)
- [Bitcoin Research with a Transaction Graph Dataset](https://mlsanity.com/paper/2411.10325/) (2024)
- [Identifying Ransomware Actors in the Bitcoin Network](https://mlsanity.com/paper/2108.13807/) (2021)
- [From Asset Flow to Status, Action and Intention Discovery: Early Malice Detection in Cryptocurrency](https://mlsanity.com/paper/2309.15133/) (2023)
- [Toward Intention Discovery for Early Malice Detection in Bitcoin](https://mlsanity.com/paper/2209.12001/) (2022)
- [Chainlet Orbits: Topological Address Embedding for the Bitcoin Blockchain](https://mlsanity.com/paper/2306.07974/) (2023)
- [Clean Up the Mess: Addressing Data Pollution in Cryptocurrency Abuse Reporting Services](https://mlsanity.com/paper/2410.21041/) (2024)

## Abstract (arXiv)

Bitcoin cryptocurrency system enables users to transact securely and pseudo-anonymously by using an arbitrary number of aliases (Bitcoin addresses). Cybercriminals exploit these characteristics to commit immutable and presumably untraceable monetary fraud, especially via ransomware; a type of malware that encrypts files of the infected system and demands ransom for decryption. In this paper, we present our comprehensive study on all recent ransomware and report the economic impact of such ransomware from the Bitcoin payment perspective. We also present a lightweight framework to identify, collect, and analyze Bitcoin addresses managed by the same user or group of users (cybercriminals, in this case), which includes a novel approach for classifying a payment as ransom. To verify the correctness of our framework, we compared our findings on CryptoLocker ransomware with the results presented in the literature. Our results align with the results found in the previous works except for the final valuation in USD. The reason for this discrepancy is that we used the average Bitcoin price on the day of each ransom payment whereas the authors of the previous studies used the Bitcoin price on the day of their evaluation. Furthermore, for each investigated ransomware, we provide a holistic view of its genesis, development, the process of infection and execution, and characteristic of ransom demands. Finally, we also release our dataset that contains a detailed transaction history of all the Bitcoin addresses we identified for each ransomware.