In brief
- A U.S. court has sentenced Russian citizen Aleksei Volkov to 81 months in prison for his role in ransomware attacks causing over $9 million in actual losses.
- Volkov operated as an “initial access broker,” finding vulnerabilities and selling unauthorized access to ransomware groups who then encrypted victims’ data.
- The 26-year-old must pay $9.2 million in restitution to victims and forfeit equipment used in the crimes.
A court in the Southern District of Indiana sentenced Russian citizen Aleksei Volkov, 26, to 81 months in prison Monday for assisting major cybercrime groups including the Yanluowang ransomware group in attacks that caused over $9 million in actual losses and over $24 million in intended losses across the United States.
Volkov, of St. Petersburg, Russia, operated as an “initial access broker”—a specialist who gains unauthorized access to corporate networks and sells that access to other threat actors, according to court documents. His buyers used the access to deploy ransomware that encrypted victims’ data, then demanded cryptocurrency payments—“sometimes in the tens of millions of dollars”—in exchange for restoring access and not publishing stolen data on leak sites.
On November 25, 2025, Volkov pleaded guilty to four counts from the Southern District of Indiana indictment—unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft—plus two counts from the Eastern District of Pennsylvania indictment for conspiracy to commit computer fraud and conspiracy to commit money laundering. Police in Rome, Italy, had arrested Volkov before his extradition to the United States.
As part of his plea agreement, Volkov admitted that he and co-conspirators “demanded tens of millions of dollars in ransom and received millions,” with Volkov receiving a share of cryptocurrency ransom payments. The court ordered him to pay full restitution including almost $9.2 million to known victims and to forfeit equipment used in his crimes.
Ransomware and crypto
Ransomware, often leveraging cryptocurrency for payment, remains a challenge for the crypto space. Per Chainalysis’ 2026 Crypto Crime Report, on-chain ransomware payments totaled $820 million in 2025, down 8% year-on-year, while claimed attacks increased by 50% and the median ransom payment grew 368% year-over-year to nearly $60,000.
In recent months, ransomware developers have turned to blockchain smart contracts as a distribution channel, including the DeadLock ransomware strain that leverages Polygon smart contracts for proxy server address rotation and distribution, and EtherHiding, which targets BNB Smart Chain and Ethereum smart contracts.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Criticized for freezing too slowly: USDC freezes are taking too long! Circle CEO: We will definitely wait for a court order before freezing; we refuse to freeze it on our own
Circle CEO Jeremy Allaire said the company will not proactively freeze wallet addresses unless it receives a court order or law-enforcement requirement. Even amid allegations of hacker money laundering and community backlash, Circle continues to insist on operating under the rule of law.
Jeremy Allaire sets Circle’s law-enforcement bottom line
-----------------------------
As the global cryptocurrency market surges with uncertainty, Circle’s CEO Jeremy Allaire, at a press conference in Seoul, South Korea, made a clear stance on the market’s most sensitive issue of “asset freezes.” He noted that while Circle has technical means to freeze specific wallet addresses, unless it receives a court order or an official directive from law-enforcement agencies, the company will not
CryptoCity8h ago
Criticized for freezing USDC too slowly! Circle CEO: We will definitely wait for the court’s order before freezing—refusing to freeze privately/by ourselves without authorization
Circle CEO Jeremy Allaire said the company will not proactively freeze wallet addresses unless it receives a court order or a request from law enforcement. Even amid hacker money-laundering disputes and community backlash, Circle still insists on operating in accordance with the rule of law.
Jeremy Allaire sets Circle’s law-enforcement bottom line
-----------------------------
As the global cryptocurrency market roils, Circle’s CEO Jeremy Allaire, the stablecoin issuer, delivered a clear stance on the most sensitive issue in the market at a press conference in Seoul, South Korea. He pointed out that although Circle has the technical means to freeze specific wallet addresses, unless it receives a court order or a formal instruction from law-enforcement authorities, the company will not take such action on its own.
CryptoCity11h ago
Attacker Exploiting Bridged Polkadot Vulnerability Transfers $269K to Tornado Cash
On April 15, Arkham reported that the attacker who exploited a Bridged Polkadot vulnerability transferred around $269,000 in stolen funds to Tornado Cash, complicating asset tracking.
GateNews12h ago
Is it possible that using a credit card to buy crypto could bypass Financial Supervisory Commission regulations? Odlinting is promoting Wallet Pro, a U.S. debit card crypto-buying service
The OwlPay and Wallet Pro services launched by OdinTing use stablecoin technology to enable B2B cross-border payments, and partner with international payment giants to demonstrate its ambition to expand in the fintech space. By operating from abroad, OdinTing bypasses Taiwan’s regulatory restrictions to provide fast virtual-asset trading. Meanwhile, facing the newly promulgated Virtual Asset Services Act, it is expected in the future to become a reference template for other foreign-invested companies entering the Taiwan market.
CryptoCity12h ago
Zerion Hot Wallet Loses $100K in AI-Driven Social Engineering Attack by North Korea-Linked Hackers
Zerion confirmed a recent AI-driven social engineering attack by North Korean hackers, resulting in a $100,000 loss from corporate hot wallets. User funds remain safe, and the company has taken precautionary measures. This follows another significant attack on Drift Protocol.
GateNews13h ago
Criticized for freezing USDC too slowly! Circle CEO: We will definitely wait for a court order to freeze it—refusing to freeze it on our own
Circle CEO Jeremy Allaire said that unless it receives a court order or a law-enforcement request, the company will not proactively freeze wallet addresses. Even amid disputes over hackers allegedly laundering money and backlash from the community, Circle remains committed to operating in accordance with the rule of law.
Jeremy Allaire sets Circle’s law-enforcement bottom line
-----------------------------
As developments surge across the global cryptocurrency market, at a press conference in Seoul, South Korea, Circle’s CEO Jeremy Allaire took a clear stance on the most sensitive issue in the market—“asset freezes.” He noted that while Circle has the technical means to freeze specific wallet addresses, unless it receives a court order or an official instruction from law-enforcement agencies, the company does not
CryptoCity14h ago
