$300 million ransom flow is all on-chain—now Web3 transparency is a double-edged sword: evidence for law enforcement, a tombstone for the hackers.

The EU, citing Chainalysis, has imposed sanctions on Russian national Vitaly Kovalev (alias Stern), identifying him as a senior member of Trickbot and involved in the operation of ransomware such as Ryuk and Conti; the related wallets’ ransom exceeds $300 million, and financial flows involve networks including Diavol, Karakurt, Royal, and Quantum. The EU also sanctions LummaC2 developers, personnel linked to Media Land LLC and GRU Unit 29155, as well as pro-Russian hacker organizations CARR and Z-Pentest.