BABUK RANSOMWARE: A VICTIM OF INDODAX HACK

Rakesh Krishnan
2 min readFeb 6, 2025

--

In this article, we are going to witness a case study where a Ransomware Group had lost their “hard-earned” ransom amount to another Crypto Exchange Heist.

Hackers flees away with Money | Image Credit: OpenAI with Self-Edit

INTRODUCTION

On January 26th, 2025; Babuk the popular ransomware made a comeback by announcing their Babuk 2.0 Project.

Babuk Locker DLS

Among the contacts and other details, interestingly I found their Bitcoin Wallet Address as:

BABUK Wallet: 1JdvS63gBEFH3auYStgeSB3Q2xMdi5cZi

Babuk has been using Indodax Exchange, which is the biggest Crypto Trading Application in Indonesia 🇮🇩

Upon checking the balance, we can see the group had made about $21,964 (alone in this wallet).

Babuk Group regularly transfers their money to a primary Hot wallet that belongs to Indodax Exchange i.e. 1JUToCyRL5UwgeucjnFAagKs4v1YqhjT1d

The first transfer happened on 20th August 2023 by transferring $504 to Indodax Hot Wallet.

First Transaction of Babuk to Indodax Hot Wallet

In total, the group had moved about $7,017 to this Hot Wallet. The last transaction from Babuk (to this wallet) was dated on 27th April 2024.

To read more: follow this article on my Newly launched Website:

--

--

Rakesh Krishnan
Rakesh Krishnan

Written by Rakesh Krishnan

Independent Security Researcher and Threat Analyst. Often sheds light on Dark Web. Regular contributor to Infosec Community.

No responses yet