Lion Cipher Lab

Follow the money: trace a ransomware payment on the Bitcoin blockchain

• Threat Intel Analyst
• Advanced
• ~75 min
• Free · no account required

Why it matters

When a ransomware crew extorts a payment, they almost always demand Bitcoin -- and that decision, which feels to the victim like the attacker vanishing into the dark, is actually the single best forensic gift the attacker gives you. Bitcoin is not anonymous; it is PSEUDONYMOUS on a ledger that is fully public, permanent, and append-only. Every satoshi that moves is written down forever, visible to anyone with a browser, and it can never be edited or deleted. That means a threat-intel or incident-response analyst can do something that is impossible with a suitcase of cash: watch the ransom…

What you'll learn

• the investigator's model of Bitcoin: addresses vs wallets, the UTXO model, transaction inputs/outputs, txids, and confirmations
• why a PUBLIC, permanent, pseudonymous (not anonymous) ledger is exactly what makes ransom payments traceable
• reading a transaction on a public block explorer: inputs, outputs, amounts in satoshis and BTC, timestamps, and confirmations
• querying the FREE Blockstream Esplora HTTP API with curl -- address, /txs, /tx, and /outspends endpoints, no key or account
• following a flow of funds hop by hop downstream and recording it as a flow-of-funds table
• recognizing the movement patterns: consolidation, peel chains, and CoinJoin / mixers as deliberate obfuscation
• the common-input-ownership heuristic for clustering addresses into one entity, and how to spot the change address
• the honest LIMITS of clustering: CoinJoin breaks common-input-ownership and address reuse creates false positives
• attribution: how a flow into a KYC'd exchange deposit address becomes a subpoena lead, and where OFAC-sanctioned mixers sit
• where free tools stop and commercial attribution platforms (Chainalysis / TRM) begin -- and the OFAC sanctions risk of paying

Steps in this lab

1. The investigator's model of Bitcoin (addresses, UTXOs, transactions, txids)
2. Your free toolkit: a public explorer and a keyless API (no wallet, no funds)
3. Read a transaction on the explorer: inputs, outputs, amounts, timestamp
4. Pull the same transaction as JSON from the free API
5. Point it at a real case: find the ransom payment IN
6. Follow the flow downstream, hop by hop, into a flow-of-funds table
7. Name the movement patterns: consolidation, peel chains, mixers
8. The heuristic that makes it work: common-input-ownership + change
9. Attribution and cash-out: exchanges, sanctioned mixers, where free tools stop
10. When/why/better: the defender's payoff and the honest limits

Open the full interactive lab →