The hackers behind the WannaCry ransomware have tried to conceal who they are by using a virtual currency that is more anonymous than Bitcoin.
Victims paid more than $140,000 in bitcoins to recover files scrambled by WannaCry, and last week the gang behind the attack started to move the bitcoins out of the wallets they were paid into. The bitcoin activity was noticed by a Twitter bot set up by Quartz journalist Keith Collins.
But the operators of the exchange they used to swap the bitcoins have now frozen the accounts they used.
It has been nearly three months since infections struck organisations worldwide, affecting corporate networks and encrypting their files.
Victims were told to pay between $300 and $600 in bitcoins to have their files unscrambled and return computers to a working state.
Many security experts believed the money paid into three bitcoin wallets set up by the WannaCry creators would never be moved, because moving the cash might expose key details about the attackers that could be used to track them down.
But last week, the bitcoins were moved and some were piped to an exchange network called Shapeshift.io in an attempt to convert them to another virtual currency called Monero.
The Monero crypto-currency was set up to be more anonymous than Bitcoin and seeks to hide as much information as possible about every transaction.
The WannaCry gang is believed to have chosen Shapeshift.io for the digital cash transfer because the service can be used without signing up for an account.
However, the attempt to launder the cash via the platform seems to have been thwarted soon after it was told what was happening.
“As of today, we have taken measures to blacklist all addresses associated with the WannaCry attackers that are known to the Shapeshift team,” a spokesman told American business magazine Forbes.
Shapeshift said it would block any further attempts to change the WannaCry bitcoins into Monero or any other crypto-currency.
“Additionally, we are engaging directly with law enforcement involved with the WannaCry case and will assist them with any needs they may request to apprehend the perpetrators,” the spokesman added.
