LockBit ringleader unmasked, charged by US authorities

Quick Take

  • LockBit ringleader, Dmitry Khoroshev, was unmasked in a 26-count indictment unsealed on Tuesday. 
  • Khoroshev’s indictment comes a few months after an international law enforcement coalition seized LockBit’s infrastructure, thwarting its operations. 

U.S. authorities have unmasked and indicted the ringleader of LockBit, a prolific ransomware operation that has extorted victims out of half a billion dollars. He faces more than two dozen criminal counts. 

According to a 26-count indictment unsealed on Tuesday, Dmitry Khoroshev, 31, acted as LockBit’s “developer and administrator,” steering its code’s development and recruiting affiliates to deploy the ransomware against its victims. The alleged cybercriminal received 20% of each ransom payment for his role in the scheme, raking in $100 million in cryptocurrencies over roughly four years, the U.S. Justice Department said Tuesday in a statement. 

“Today’s indictment…continues the FBI’s ongoing disruption of the BlockBit criminal ecosystem,” FBI Director Christopher Wray said in the statement. 

LockBit has extorted at least $500 million from roughly 2,500 victims in more than 120 countries since its inception in 2019, according to prosecutors. However, it is also responsible for several billions of dollars in “broader losses” related to lost revenues, incident responses and ransom recoveries, the U.S. Justice Department said in its statement.

THE SCOOP

Keep up with the latest news, trends, charts and views on crypto and DeFi with a new biweekly newsletter from The Block's Frank Chaparro

By signing-up you agree to our Terms of Service and Privacy Policy
By signing-up you agree to our Terms of Service and Privacy Policy

In the indictment, U.S. authorities called for Khoroshev to forfeit his $100 million cut of the ill-gotten gains. In the meantime, the UK, U.S., and Australia have sanctioned the mastermind, freezing his assets and issuing bans against his traveling.

The U.S. State Department is offering a $10 million reward for information leading to Khoroshev arrest. 

This latest indictment comes several months after authorities took steps to shutter the ransomware operation. In February, international law enforcement seized LockBit’s infrastructure, effectively disrupting its operations. Around that time, U.S authorities also charged two Russian cybercriminals with deploying Lockbit ransomware against a slew of companies and groups. 


Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

© 2023 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

About Author

Elizabeth Napolitano is a data reporter covering business and technology news, with a focus on cryptocurrencies. Prior to joining The Block, Elizabeth reported on BigTech, AI, crypto and videogames for CBS Moneywatch. As a CoinDesk reporter, she covered DeFi, NFTs and U.S. courts. She holds an MA in Journalism from CUNY. Follow her on X: @LizKNapolitano

Editor

To contact the editor of this story:
Lawrence Lewitinn at
[email protected]