US Court Seizes $8.37M in Crypto from Ransomware Negotiator

Kucoin

US Court Seizes $8.37M in Crypto from Ransomware Negotiator

First seen 19 Jul 2026, 19:46 UTC • •45.8

Article Content

1 / 5

Browse articles

ThreatCluster •July 20, 2026 at 19:39 UTC

•Angelo Martino was convicted for leaking sensitive financial data to ransomware attackers.
•The seizure included over $8.3 million in cryptocurrencies and luxury physical assets.
•The case reflects increased law enforcement actions against insider threats in cybercrime.

A U.S. District Court in Florida has seized approximately $8.37 million in cryptocurrencies and physical assets from Angelo Martino, a cybersecurity negotiator linked to the BlackCat ransomware group. Martino, who was supposed to negotiate on behalf of companies targeted by ransomware, instead leaked sensitive financial information to attackers, allowing them to increase ransom demands. The seized assets include 90.319 Bitcoin, 56,174.15 XRP, and 39,760.79 XLM, along with luxury homes and vehicles. Martino was convicted and sentenced to 70 months in prison, marking a significant step in holding insiders accountable for cybercrime. This case highlights the ongoing efforts of U.S. law enforcement to track and seize funds linked to cyber extortion.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 63d ago How this analysis works

Timeline

2026-07-19

Court issues asset forfeiture order

A federal court ordered the seizure of $8.37 million in crypto and physical assets from Angelo Martino, linked to BlackCat ransomware.

2026-07-19

Martino sentenced to prison

Angelo Martino received a 70-month prison sentence for his role in facilitating ransomware attacks.

Date unknown

Martino's collaboration with BlackCat deepens

Martino's role evolved from negotiator to active participant in the extortion process, enabling higher ransom demands.

More articles in this cluster (4)

Threat Graph

5 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Ransomware
T1486 - Data Encrypted for Impact

Threat Actor (3)

BlackCat
Alphv
BlackCat/ALPHV

Relationships

BlackCat uses Ransomware
BlackCat uses T1486 - Data Encrypted for Impact
Alphv uses Ransomware
Alphv uses T1486 - Data Encrypted for Impact
BlackCat/ALPHV uses Ransomware
BlackCat/ALPHV uses T1486 - Data Encrypted for Impact

Following this threat?

Track BlackCat in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Threat Actors Exploit Windows Shadow Copies for Ransomware and Credential Theft Cybercriminals are increasingly abusing Microsoft’s Volume Shadow Copy Service (VSS) to facilitate ransomware attacks and steal credentials. They achieve this by deleting recovery options before deploying ransomware and extracting sensitive data from protected files, including the Active Directory database. Tools such…

RansomHouse Targets Namibian Defence Ministry in Cyberattack The Namibia Cyber Security Incident Response Team (Nam-CSIRT) confirmed a cyberattack on the Ministry of Defence and Veterans Affairs, linked to the ransomware group RansomHouse. The attack involved unauthorized activity within the ministry's network, with RansomHouse threatening to release stolen information.…