Lockbit 2025 Leak Exposes 60K BTC Addresses, 4K Chats

Data Breach Summary

A major leak was posted on June 9, 2025, by the user USD on darkforums.st, revealing sensitive data from the Lockbit Database 2025 #181818. This breach includes nearly 60,000 Bitcoin addresses, user details, and over 4,000 chat logs with victim organizations. The leaked content spans a period from December 19, 2024, to April 29, 2025, offering a rare glimpse into the operations and communications of one of the most notorious ransomware groups.

---

Where and How?

The data was leaked on a well-known underground forum, darkforums.st, often used by cybercriminals to trade and expose stolen information. The files contain highly sensitive material, including Bitcoin wallet addresses and internal conversations with organizations affected by Lockbit’s ransomware attacks. This information could be used to trace transactions or reveal patterns in Lockbit’s negotiation tactics.

Group Background

Lockbit is a prominent ransomware gang that has been active since 2019. Known for its Ransomware-as-a-Service (RaaS) model, the group allows affiliates to deploy its malware in exchange for a share of the ransom. Lockbit has been involved in high-profile attacks worldwide, frequently targeting corporations, critical infrastructure, and government entities.

---

Company Data Breach History

Lockbit has a long and infamous history of cyberattacks and data leaks. This latest breach, however, turns the tables by exposing their own internal data. It not only compromises their operational secrecy but also places their affiliates and negotiation tactics under public scrutiny.

---

Further Action

Security experts and law enforcement agencies are likely to analyze this data to identify patterns, trace illicit funds, and potentially uncover the identities behind Lockbit’s operations. Organizations previously targeted by Lockbit should stay alert and may benefit from reviewing the leaked chats for information relevant to their cases.

---

Recommendations for Data Protection

For individuals and organizations:

• Enable multi-factor authentication (MFA) across all services.
• Avoid reusing passwords and use a password manager.
• Stay updated on ransomware threats and common phishing tactics.
• Monitor financial transactions and cryptocurrency activity for anomalies.
• Report any suspicious activity to cybersecurity authorities promptly.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.