Blockchain Breadcrumbs Put Russian Extortion Crew's Leaked Chats Under the Microscope
A cache of internal messages purportedly from Russian extortion outfit Silent Ransom Group (SRG) landed online this week under the dramatic title "The Luna Moth Files." Dramatic names aside, the more interesting question was whether any of it was real. Two blockchain analytics firms have now weighed in, and the short answer is: at least some of it checks out.
Chainalysis confirmed that certain wallet addresses appearing in the leaked material sit downstream of confirmed SRG extortion payments worth millions. It stopped short of authenticating the whole dump, but that's a meaningful endorsement. One wallet identified in the chats was funded entirely from a single victim payment exceeding $10 million, collected in mid-2026, which Chainalysis says it had already been tracking before the leak surfaced.
Crystal Intelligence ran its own analysis. The leaked chats claim SRG pulled in roughly $207 million from 27 firms between April and September 2026. Crystal couldn't verify that headline figure, but it did trace funds back to an upstream collection wallet that received around 2,675 Bitcoin across its lifetime. That's not nothing.
What makes Crystal's breakdown genuinely interesting is the spending side. SRG wasn't just hoarding Bitcoin. The group used instant exchangers to convert crypto into cash deposited onto Russian bank cards. For larger sums, they apparently relied on a Moscow-based broker referred to only as "Zhenya," who handed over physical roubles in exchange for cryptocurrency. The chats suggest members thought Zhenya was quietly skimming from the exchange rate, which is almost endearingly paranoid given the circumstances.
For smaller payments, specifically to field agents and document forgers, the group sent funds directly into wallets on regulated exchanges that require identity verification. Crystal flags this as the group's most significant operational security failure. Regulated exchanges keep records. Those records lead to real people behind the pseudonyms.
The chats also apparently included some fairly brazen money laundering tips. Members discussed buying property using mortgages and advised each other to tell banks any suspicious funds were inheritance or gifts, or to produce fabricated loan agreements if pressed. Sports cars got a mention too.
A Bitcoin-to-Zelle service called SAFU Exchange, advertised on Telegram, also appears in the material. Crystal's database links the same handle to an unlicensed, sanctions-flagged exchange operating out of Georgia.
SRG has been active since roughly 2022, with a consistent focus on law firms. Its main trick is callback phishing: impersonating IT support, convincing targets to call back and hand over remote desktop access, then quietly hoovering up files. The FBI flagged in May that the group had moved beyond remote access into something considerably bolder, with individuals physically walking into US law offices and copying data onto USB drives. According to Crystal, these field agents were recruited through Russian-language job boards with listings advertising $300-a-night work as nightclub promoters. The actual job turned out to be rather different.
The Luna Moth Files site claims the material contains nearly 5,700 internal messages, allegedly naming senior members and field operatives. None of those identities have been independently verified yet. But if Crystal is right that regulated exchange records tie real names to those handles, law enforcement may not need the leak to do the hard work for them.