LockBit Ransomware Cartel Gets Hacked: 60,000 Bitcoin Wallets and 4,400 Negotiation Logs Exposed

The world’s most notorious ransomware-as-a-service operation has suffered a humiliating blow. On May 20, 2025, cybersecurity analysts confirmed that LockBit’s entire dark web infrastructure — including administrative and affiliate control panels — was breached by an unknown party. The defaced panels now display a taunting message: “Don’t do crime, CRIME IS BAD xoxo from Prague,” along with a downloadable MySQL database dump named “paneldb_dump.zip.” The breach exposes the inner workings of a criminal enterprise that has extorted hundreds of millions from victims worldwide.

The Exploit Mechanics

The leaked database was created on April 29, 2025, and extracted from a local development environment running MySQL Server 8.0.41 on Ubuntu 22.04.1. The SQL dump contains 20 database tables that provide an unprecedented look into LockBit’s operations. The breach appears to have exploited weaknesses in LockBit’s own server infrastructure — an ironic twist for a group that built its reputation on exploiting others’ vulnerabilities. Preliminary analysis suggests the attackers gained access to a working backend server, likely through misconfigured access controls or unpatched software.

Affected Systems

The scope of the leaked data is staggering. The “btc_addresses” table lists nearly 60,000 Bitcoin wallet addresses believed to be tied to ransom payments, revealing the massive financial infrastructure behind LockBit’s operation. The “builds” and “builds_configurations” tables detail how LockBit affiliates generated custom ransomware payloads for specific targets, with some entries listing intended victim companies by name. These tables also reveal technical options used during attacks, such as which ESXi servers to avoid and which file types to encrypt. The “chats” table contains 4,442 negotiation messages between LockBit operators and victims, spanning from December 19, 2024, to April 29, 2025. Perhaps most embarrassingly, the “users” table lists 75 individuals with access to the affiliate panel, with passwords stored in plaintext — including credentials as weak as “Lockbitproud231.”

The Mitigation Strategy

While LockBit’s leader, known as “LockBitSupp,” has downplayed the breach by claiming no private keys or critical data were lost, the exposure is significant. Cybersecurity firm Arete, which analyzed the leak, noted that the breach provides actionable intelligence for defenders. Organizations can now cross-reference the 60,000 Bitcoin addresses against their own transaction records to identify potential ransom payments. Law enforcement agencies gain access to affiliate identities and communication patterns. The plaintext passwords can be used to track affiliate activity across other platforms. For the broader ransomware ecosystem, this breach serves as a cautionary tale: even criminal enterprises cannot afford to neglect their own security posture.

Lessons Learned

The LockBit breach reinforces several critical security principles. First, no organization — legitimate or criminal — is immune to supply chain and infrastructure attacks. Second, storing credentials in plaintext is a catastrophic failure at any scale. Third, the breach demonstrates the value of proactive threat intelligence; organizations that monitor dark web leaks can gain early warning of threats targeting their industry. For the cryptocurrency community specifically, the leaked Bitcoin addresses provide a treasure trove of data for blockchain analytics firms tracing illicit fund flows.

User Action Required

Organizations that have previously been targeted by LockBit should review the leaked database to determine if their data appears in negotiation logs or build configurations. Cryptocurrency exchanges and compliance teams should integrate the 60,000 Bitcoin addresses into their screening systems. Security researchers are encouraged to analyze the leaked ransomware build configurations to develop more targeted detection signatures. With Bitcoin trading at approximately $106,791 and the total value of tracked ransom payments potentially reaching hundreds of millions, the financial stakes of this leak cannot be overstated.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified cybersecurity professionals for threat mitigation strategies.