CASE 042025Bitcoinreal incident

Chaos ransomware Bitcoin seizure

Reconcile a complete Bitcoin spend with a civil-forfeiture allegation and seizure timeline.

The DOJ says 20.2891382 BTC was seized on April 15, 2025 from an address allegedly associated with a Chaos ransomware member known as Hors. The selected transaction spends the address's 20.28914200-BTC UTXO to a 20.28913820-BTC output, with the difference paid as the miner fee.

INVESTIGATOR BRIEF

Research question

Reproduce the input, output, and miner fee from Bitcoin data, then cite the DOJ for the alleged ransomware association and seizure context.

The Dallas FBI seized the Bitcoin and the United States filed a civil complaint seeking forfeiture.

PROVENANCE BEFORE CONCLUSION

Evidence ladder

Read these layers in order. A later layer may explain an observation, but it does not change what kind of evidence the underlying transaction is.

01 · on-chain fact

The named UTXO was fully spent on the seizure date

The inputs, output amount, miner fee, confirmation time, and source address are reproducible from public Bitcoin data.

02 · source-reported context

The DOJ describes a seizure and alleged ransomware connection

The DOJ release supplies the amount, date, source address, alleged Hors/Chaos association, and civil-forfeiture status.

03 · bounded inference

The matching amount and date corroborate the reported seizure movement

The ledger match is strong corroboration, but government control of the destination and the underlying allegations depend on legal and investigative records.

REPRODUCIBLE START POINT

Seed transaction

Bitcoin · 2025-04-15T19:00:55Z

Seizure-date full UTXO spend

626ed3b412c02541c5db53df1c776162ada693050a49d953b3c80f146734832d

The confirmed transaction spends 2,028,914,200 satoshis and creates a 2,028,913,820-satoshi output—exactly 20.2891382 BTC—with a 380-satoshi fee.

Open in ChainRadar View Bitcoin transaction

SOURCE-QUALIFIED INDICATORS

Address set

Analyze each address independently. A contract, sender, recipient, and source-published indicator can have different roles and evidentiary weight.

DOJ-named source address · Address from which the FBI says it seized Bitcoinbc1q5d8af0crjhlnepjq08muhh55899rf2ktye3sxd

The DOJ says the address was allegedly associated with a Chaos ransomware member known as Hors.

CHAINRADAR LAB

Platform workflow

Bitcoin Transaction Decoder

Reconcile inputs, output, and fee

ActionOpen the prefilled transaction and verify that total input equals total output plus the miner fee.

Evidence goalUTXO lineage, scripts, output amount, 380-satoshi fee, confirmation, and transaction ID.

Open tool

Transaction Observation Report

Preserve a current Bitcoin observation

ActionCapture provider, acquisition time, confirmation context, warnings, and digest for the same transaction.

Evidence goalA second normalized observation of the exact transaction and source metadata.

Open tool

Address Lookup

Inspect the DOJ-named source address

ActionReview bounded public activity and confirm that the selected transaction spends the named UTXO.

Evidence goalRecent address activity and the provider's explicit history boundary.

Open tool

Address Intelligence

Review the DOJ claim at source

ActionAnalyze the source address and keep the official allegation separate from deterministic Bitcoin facts.

Evidence goalA source-qualified association, when active, plus technical and direct-activity facts.

Open tool

Ransomware checklist

Use allegation-safe reporting

ActionRecord the complaint, alleged predicate conduct, seizure, and forfeiture request without converting allegations into adjudicated facts.

Evidence goalA report preserving legal status, cited amount, case number, and unresolved questions.

Open tool

TWO-SOURCE MINIMUM

Cross-check evidence

A ChainRadar result is one observation. Compare it with an independent ledger, official record, or technical source and record both agreement and discrepancy.

The transaction creates an output of exactly 20.2891382 BTC.

ChainRadar check: Bitcoin decoder exact base-unit arithmetic
Independent check: Blockstream public transaction record
Expected agreement: The output is 2,028,913,820 satoshis.

The fee is 380 satoshis.

ChainRadar check: Input minus output reconciliation
Independent check: Independent Bitcoin explorer/raw transaction decode
Expected agreement: 2,028,914,200 minus 2,028,913,820 equals 380 satoshis.

The source address was associated with Chaos ransomware and the spend was a seizure.

ChainRadar check: Address activity can corroborate the spend but not the legal characterization
Independent check: DOJ press release and civil complaint
Expected agreement: Ransomware association and seizure remain explicitly attributed to the DOJ.

REPORTING STANDARD

Calibrated findings

Supported conclusions

The public transaction exactly reproduces the 20.2891382-BTC output reported by the DOJ.
The input/output difference independently reproduces the 380-satoshi fee.
The DOJ source supplies the ransomware, alias, seizure, and forfeiture context.

Required limitations

A civil complaint contains allegations; it is not itself a final judgment.
The Bitcoin transaction does not identify the human controller of either address.
Destination ownership should not be inferred from amount and timing alone.

READ THE ORIGINAL RECORD

Sources

official

U.S. Department of Justice

United States files civil complaint seeking forfeiture of over $1.7M in cryptocurrency

public ledger

Blockstream Explorer

Public Bitcoin transaction record

KEEP PRACTICINGApply the same evidence ladder to another scenario.

All five cases

Chaos ransomware Bitcoin seizure

Reconcile a complete Bitcoin spend with a civil-forfeiture allegation and seizure timeline.

Chaos ransomware Bitcoin seizure

Research question

Reproduce the input, output, and miner fee from Bitcoin data, then cite the DOJ for the alleged ransomware association and seizure context.

Evidence ladder

The named UTXO was fully spent on the seizure date

The DOJ describes a seizure and alleged ransomware connection

The matching amount and date corroborate the reported seizure movement

Seed transaction

Seizure-date full UTXO spend

Address set

Platform workflow

Reconcile inputs, output, and fee

Preserve a current Bitcoin observation

Inspect the DOJ-named source address

Review the DOJ claim at source

Use allegation-safe reporting

Cross-check evidence

The transaction creates an output of exactly 20.2891382 BTC.

The fee is 380 satoshis.

The source address was associated with Chaos ransomware and the spend was a seizure.

Calibrated findings

Supported conclusions

Required limitations

Sources

Preparing your view

Chaos ransomware Bitcoin seizure

Research question

Reproduce the input, output, and miner fee from Bitcoin data, then cite the DOJ for the alleged ransomware association and seizure context.

Evidence ladder

The named UTXO was fully spent on the seizure date

The DOJ describes a seizure and alleged ransomware connection

The matching amount and date corroborate the reported seizure movement

Seed transaction

Seizure-date full UTXO spend

Address set

Platform workflow

Reconcile inputs, output, and fee

Preserve a current Bitcoin observation

Inspect the DOJ-named source address

Review the DOJ claim at source

Use allegation-safe reporting

Cross-check evidence

The transaction creates an output of exactly 20.2891382 BTC.

The fee is 380 satoshis.

The source address was associated with Chaos ransomware and the spend was a seizure.

Calibrated findings

Supported conclusions

Required limitations

Sources