FBI Seizes $2.4M in Bitcoin from Resurgent Chaos Ransomware Operation

In a significant blow to organized cybercrime, the FBI's Dallas field office has seized approximately 20 Bitcoin (worth ~$2.4 million) from a cryptocurrency wallet linked to the newly emerged Chaos ransomware operation. The funds, confiscated on April 15, 2025, were traced to an affiliate known as "Hors," who allegedly targeted businesses in Texas and beyond. The U.S. Department of Justice filed a civil forfeiture complaint last week to permanently claim the assets under laws allowing seizure of proceeds from criminal activity.

The Chaotic Evolution of a Ransomware Threat

While the Chaos name previously belonged to a low-tier ransomware variant, this new operation has no connection to its namesake. Cybersecurity researchers at Cisco Talos confirm it's a rebrand of the BlackSuit ransomware group, which itself evolved from the infamous Conti syndicate. After Conti disbanded in 2022 following internal leaks, its members splintered into factions including Royal (later BlackSuit), which attacked the City of Dallas in 2023. The new Chaos group inherited Conti's encryption techniques, ransom note structures, and attack tooling—proving cybercrime ecosystems continually mutate to evade scrutiny.

FBI announcement of the Bitcoin seizure (Source: Twitter)

Tracing the Digital Trail

The seized Bitcoin (20.2891382 BTC) originated from address bc1q5d8af0crjhlnepjq08muhh55899rf2ktye3sxd, highlighting law enforcement's growing ability to track cryptocurrency flows across ransomware campaigns. This seizure coincides with last week's takedown of BlackSuit's dark web leak sites, suggesting a coordinated investigation. Though affiliates like Hors operate semi-independently, their financial infrastructure remains a vulnerability—one increasingly exploited by agencies armed with blockchain analytics.

Why This Matters for the Defense Front

For security teams, this operation underscores three critical trends:
1. Ransomware rebrands are predictable: Groups like Chaos/BlackSuit reuse code and workflows, making behavioral detection crucial.
2. Cryptocurrency isn't anonymous: Seizures demonstrate that Bitcoin transactions leave forensic trails.
3. Affiliates are the pressure point: Targeting lower-tier operators disrupts the ransomware-as-a-service economy more effectively than chasing anonymous core teams.

As ransomware groups fragment and rename themselves, this seizure signals that law enforcement adapts just as quickly—turning the very cryptocurrency they demand into evidence against them. The $2.4 million forfeiture not only deprives criminals of profits but injects risk into an ecosystem that thrives on perceived impunity.

Source: BleepingComputer