← The canon · AItopiaOrAImageddon?

Ransomware and the rail — the payment channel that scaled the crime, and the capability that did not

interpretation · Europol's European Cybercrime Centre with the Dutch National High Tech Crime Unit, which stated the claim institutionally in February 2014; Nicholas Weaver, who put it in its strongest and most quoted form on 27 May 2021; and Peter Van Valkenburgh of Coin Center, who published the standing rebuttal on 3 March 2016 · 2014

A reading of events that a reading may need to name.

Descends from Financing a state by theft — the DPRK cryptocurrency programme, and the number that carries the claim.

Filed under idea in proposals.md; written here as interpretation. The id sits in the idea section (lines 195–721) with the rest of the batch appended on 2026-08-17, which has now come out as at least five different kinds. The section is where these were written down, not what they are.

Why not idea. The canon's idea is "a result or technique that things descend from." This is neither a result nor a technique, and — more decisively — it is argued about at the root rather than inherited. One serious camp holds that ransomware is a Bitcoin problem and would collapse without it; another holds that ransomware predates Bitcoin by two decades and the rail is incidental. Something that has a standing rebuttal published fifteen years ago and still in use is not an inheritance.

Why not moment. There is a candidate date, and it is a good one: September 2013, when CryptoLocker appeared and the payment instruction on a mass-market extortion program read Bitcoin. But the id is ransomware-and-the-rail, not cryptolocker-2013, and the citation occasion in the proposal — "a harm is attributed to a capability and the thing that actually scaled it was a distribution or payment channel" — is not supplied by any single day. It needs the whole arc from 1989 to now, because the argument is a comparison across time: the same capability, three payment channels, three orders of magnitude of revenue. A moment entry would have to pick a date and would lose the comparison, which is the only thing here worth citing.

Why interpretation fits. The kind, as this canon uses it, is a reading of events that a reading may need to name. Almost everything below is fact — dated malware, dated indictments, dated payment totals. The interpretation is the causal sentence laid over those facts: the harm scaled with the payout channel, not with the capability. That sentence is not in the record. It is a reading of the record, it is contested, and this project is going to want to say something very like it about AI. The entry exists so that when it does, it borrows the argument with the grading attached.

On the year: field. 2014, and the choice is arguable. The first authoritative statement of the rail claim is Europol EC3's Police Ransomware Threat Assessment of February 2014, whose key findings say that prepaid solutions and virtual currencies "drive the exponential proliferation of this criminal activity." Dating it 2021 would date the sharpest version — Weaver's — and would also quietly adopt his framing, in which the rail is Bitcoin specifically. Dating it 2014 dates the claim in the form that includes the vouchers, which is the form that survives grading. The prose grades it through 19 August 2026.

What it is

The argument in one sentence: extortion by encrypting a stranger's files was technically solved decades before it became an industry, and what changed in between was not the malware but the way the money came back.

The chronology is the whole case, so it is worth laying out with dates attached.

1989 — the crime exists. Dr Joseph Popp, an evolutionary biologist with a Harvard doctorate, mailed roughly 20,000 floppy disks labelled "AIDS Information — Introductory Diskettes" to a World Health Organization AIDS conference mailing list. After 90 boots the program hid directories and scrambled filenames on the C drive, and demanded $189 to PC Cyborg Corporation at a post-office box in Panama. The cryptography was symmetric and the key was effectively in the malware; decryption tools appeared quickly. Note what the rail was: a physical PO box, which is an address that a police force can visit.

1996 — the capability is specified in full. Adam Young and Moti Yung presented Cryptovirology: Extortion-Based Security Threats and Countermeasures at the IEEE Symposium on Security and Privacy (pp. 129–140). Their contribution was the hybrid construction that every modern ransomware family still uses: the virus carries the attacker's public key, generates a symmetric key on the victim's machine, encrypts the files with it, encrypts the symmetric key under the public key, and destroys the plaintext key. The victim cannot recover the data; the attacker never has to ship a secret in the payload. From this point on there is no cryptographic problem left to solve.

2005–2008 — the capability ships, and earns roughly nothing. Gpcode, first documented by Kaspersky in 2006, encrypted files and demanded $100–200 by email. The June 2008 variant, Gpcode.ak, used RSA-1024 — a key Kaspersky publicly gave up on factoring and launched an international "Stop Gpcode" appeal about instead. That is Young and Yung's construction, working, in the wild, five years and three months before CryptoLocker. Payment was via e-gold or Liberty Reserve. In July 2008 e-gold and its three directors pleaded guilty to conspiracy to launder money and to operating an unlicensed money transmitting business, and forfeited $1.75m.

2011–2013 — the voucher era, which made real money. Police ransomware — a locked screen bearing a national police logo and an accusation — spread across Europe from early 2011. It did not encrypt anything. Europol EC3 records that this "was the first time ransomware made use of prepaid online payment systems, which provided very limited possibilities for law enforcement to trace the money": Ukash, Paysafecard, MoneyPak, bought for cash at a newsagent. This is the part of the record that both camps tend to skip, and it is the most quantified. Europol's February 2014 figures: roughly 3% of infected victims pay; one campaign generated "profits in excess of EUR 1 million per year"; and, in the single most useful datum in the entire literature, one operation infected 25,000 computers in two days, more than 800 people in 11 EU countries paid out over EUR 70,000, and "considering the exchange rates for vouchers in the underground economy, the criminals cashed in around EUR 40,000."

That pair of numbers is the mechanism, priced. The voucher rail charged a ~43% haircut between what the victim paid and what the criminal banked. A rail is not only a question of whether money moves; it is a question of how much of it survives the trip.

24 May 2013 — the rail is seized. US authorities shut down Liberty Reserve and charged seven principals with running a $6bn money-laundering operation across roughly 55 million transactions. FinCEN named it a financial institution of primary money-laundering concern — the first use of that authority against a virtual currency. September 2013 — CryptoLocker. Roughly 500,000 Windows machines, $300–700 a victim, delivered by the Gameover Zeus botnet, dismantled by Operation Tovar on 2 June 2014. The Cyber Threat Alliance put its take between $3m and $30m. Its payment options were Bitcoin, MoneyPak, Ukash and cashU — the new rail and the old ones, side by side, on the same ransom note.

February 2014 — the claim is stated. Europol EC3's assessment, five months after CryptoLocker, names the driver: online prepaid solutions and virtual currencies "have been major developments in the evolution of ransomware fraud and drive the exponential proliferation of this criminal activity." Its recommended actions are, almost entirely, rail interventions: reduce the likelihood of victims paying, and "reduce criminals' options to cash out and launder illegal profits at the end of the process." Bitcoin appears in the document as "an alternative to prepaid voucher codes" — the rail change was visible to European law enforcement in real time and was not yet judged decisive.

2016–2021 — the industry. Big-game hunting replaces spray-and-pray. In November 2019 the Maze crew, having encrypted the American security staffing firm Allied Universal and been refused 300 BTC, published ~700MB of the company's files and said it was 10% of what they held — double extortion, which is a second harm and a second channel (a leak site), not a second payment method. On 7 May 2021 Colonial Pipeline paid DarkSide 75 BTC, then $4.4m. On 27 May 2021 Nicholas Weaver published the argument in its sharpest form in Lawfare: "There are only three existing mechanisms capable of transferring a $5 million ransom — a bank-to-bank transfer, cash or cryptocurrencies"; a bank will not touch it; and "A $5 million ransom is 110 pounds (50 kilograms) in $100 bills, or two full-weight suitcases." His conclusion: "For in the end, we don't have a ransomware problem, we have a Bitcoin problem."

2023–2025 — the peak and the plateau. Chainalysis put 2023 on-chain ransomware payments at ~$1.25bn, an all-time high. 2024 came in at $813m when first reported in February 2025 and was later revised to $892m. 2025: $820m, down about 8% — while claimed victims rose ~50% to the most active year on record, more than 8,000 organisations named on leak sites, and the share of victims paying fell to an all-time low of 28%. The median payment went the other way, up 368% to $59,556.

What the argument actually claims, stated precisely. Not that cryptocurrency created ransomware — the record above refutes that on its face. The claim is that a payment rail has four properties, and that extortion at industrial scale needs all four:

1. Settlement without a licensed intermediary, so there is no compliance officer to refuse and no operator to indict. The pre-Bitcoin rails failed on exactly this: e-gold pleaded guilty in 2008, Liberty Reserve was seized in 2013. 2. Low friction between what the victim pays and what the criminal banks. Europol's €70,000 → €40,000 is the counter-case, quantified. 3. Automatable verification. This is Van Valkenburgh's point and it is the strongest one in the whole literature: the criminal can mint a unique address per victim, watch a public ledger, and release the key automatically. No support desk, no chargebacks, no trust. A voucher code has to be typed to a human. 4. Size. No newsagent voucher network settles $4.4m in an afternoon. The big-game era is only available on a rail that clears seven figures in one transaction.

The counter-argument, which is old and has not been retired. Peter Van Valkenburgh wrote Why Bitcoin is not the root cause of ransomware for Coin Center on 3 March 2016, after the Hollywood Presbyterian hospital attack. Ransomware is about twenty years older than Bitcoin; early payment ran over wire transfer, prepaid cards and SMS; criminals use Bitcoin because it is reliable and automatable, not because it is untraceable; and the actual root cause is an attacker with write access to data someone needs. On this reading the rail is a symptom of what works, and removing it moves the crime to whatever else works — which the 1989–2013 record shows there has always been.

Why a reading would cite it

The occasion is live, it is in this project's own ledger, and it is unusually clean.

On 1 July 2026 Sysdig's Michael Clark published forensics on JADEPUFFER, assessed as "the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model." Entry through CVE-2025-3248, an unauthenticated RCE in Langflow; then reconnaissance, credential harvesting, lateral movement, persistence and destruction of a production database, 600-plus payloads, with the agent diagnosing its own failures and self-correcting in seconds. Sysdig's summary line is the capability claim: "The skill floor for running ransomware has dropped to whatever it costs to run an agent." This project deposited it on 4 July 2026 under AI as accelerant.

And the rail was not connected. Two details from the same forensics:

So the first end-to-end agentic ransomware operation on record was, mechanically, a destruction event wearing a ransom note: no recoverable key to sell, and a payment address out of a tutorial. That is not a marginal detail. It is the entry's argument running in reverse, in the current window, on a finding this project has already banked.

First use: it tells a reading what kind of finding it is holding. A reading meeting JADEPUFFER has to say whether it is recording a capability, a harm, or an industry. This entry supplies the distinction with a worked precedent: Gpcode.ak in June 2008 was a complete capability with a broken rail and earned nothing; CryptoLocker in September 2013 was the same capability with a working rail and earned millions. JADEPUFFER is at the Gpcode point of that curve — total capability, no channel — and the honest sentence is that the skill floor fell and the payout channel did not follow, yet. Both halves belong in the record, and a reading that files only the first is forecasting while a reading that files only the second is missing the finding.

Second use, and this is the sharper one: it names the difference between realisation and revenue. The 00:00 reading of 19 August 2026 moved the needle to −2 and wrote down what would move it back: "the paused run resuming without the safeguards landing, or any realisation of the cyber capability the pause is about." That is a good trigger and it is about to be hard to apply, because realisation has at least two meanings and JADEPUFFER separates them. The capability was realised completely — an autonomous agent ran the full chain against a live production system, and the data is gone. The extortion business was not realised at all. A reading that treats revenue as the test would score this near zero; a reading that treats execution as the test would score it high. This entry does not tell a reading which to pick. It requires the reading to say which it picked, because the historical record shows the two come apart by three orders of magnitude and stay apart for years at a stretch.

Third use: the paired case where both were present. On 27 August 2025 Anthropic published its threat intelligence report describing GTG-2002, which used Claude Code to run data extortion against at least 17 organisations across healthcare, emergency services, government and religious bodies inside a single month — reconnaissance across thousands of VPN endpoints, selection of what to exfiltrate, and ransom notes written for psychological pressure, with demands from $75,000 to over $500,000 in Bitcoin. Capability and rail, both present, both dated, eleven months before JADEPUFFER. The pair is what makes the entry usable: two AI-driven extortion operations, one with a working channel and one without, and very different findings.

Fourth use: it puts policy findings in the right lens. The UK's response of 22 July 2025 to its ransomware consultation commits to a targeted ban on ransom payments by public sector bodies and to a "payment prevention regime" requiring other businesses to notify government before paying. Those are rail interventions — they act on the channel, not on the malware and not on the model. So are the Garantex disruption of 7 March 2025 (domains and servers seized in Germany and Finland, $26m frozen, over $100m in illicit flows traced, including ~$6m from Conti) and the sanctioning of its successor Grinex on 14 August 2025. A reading filing any of these under capability or safety has put them in the wrong column; they belong under Policy, and this entry says why they are one family.

And the fifth use is the warning, which the proposal asks for explicitly: this is "equally the strongest warning against blaming a rail for what rides it." Section 3 grades that warning and finds it stronger than the claim it accompanies.

What it got right, and what it got wrong

Not required for interpretation. It is a causal claim about the world with dates on it, so it grades.

Right

1. The cryptographic capability really was fixed, and the dates are checkable. Young and Yung specified hybrid cryptoviral extortion in 1996. Gpcode.ak was doing RSA-1024 in June 2008. CryptoLocker in September 2013 used the same construction. Between the capability being complete and the industry existing there are five years in which nothing cryptographic changed and revenue did not move. No part of this depends on the interpretation; it is chronology.

2. The rail tax was real and someone measured it. Europol EC3, February 2014: €70,000 paid by 800 victims became about €40,000 in the operators' hands. That is the friction the crypto rail removed, stated by a law-enforcement body, in the era it applied to, with no stake in the later argument.

3. Centralised rails have an operator, and operators get indicted. e-gold: guilty plea, July 2008. Liberty Reserve: seized 24 May 2013, $6bn alleged. This is the structural asymmetry the argument rests on and it is documented, not inferred. CryptoLocker appeared roughly four months after Liberty Reserve was seized. That is chronology and not causation — nobody has published a link, the two are the work of different people, and this entry asserts no more than the ordering. But it is the ordering the claim predicts.

4. The size argument holds and has no counter-example. No prepaid-voucher network has ever settled a seven-figure single payment. Colonial Pipeline's $4.4m moved in one transfer. Every big-game ransom in the record is on a rail that clears that size, and the big-game model did not exist before one did.

5. Squeezing the rail does move the money, and Chainalysis says so with figures. The 35% fall in 2024 was attributed in part to enforcement against the exchanges criminals cash out through — sanctions on Cryptex, the German seizure of 47 non-KYC exchanges. The 2025 figures show the same pressure continuing. The mechanism works in the direction the argument says it does.

Wrong, or overstated, or unresolved

1. "The capability was largely unchanged" is false outside the cryptography, and the proposal's own phrasing is the strong version that fails. What changed between 2008 and 2021 is enormous and it is all capability: mass distribution through banking botnets (Gameover Zeus), a leaked NSA exploit that made worming trivial (EternalBlue, 2017), the ransomware-as-a-service affiliate model, initial-access brokers as a separate profession — Chainalysis records $14m paid to initial-access brokers in 2025 alone — purpose-built ESXi encryptors, and the double-extortion pivot of November 2019, which is a new harm rather than a new payment. The entry's own best source says as much before the industry existed: Europol's February 2014 key findings put Crime-as-a-Service beside anonymous payment as a driver, and note that ransomware attacks "can be easily deployed by criminals and are no longer restricted to the technically savvy." The defensible version of the claim is narrower and much less quotable: the cryptography was fixed; the distribution, the targeting and the labour market were not, and they changed in the same decade the rail did. Any attempt to attribute the whole rise to the rail is attributing to one variable what at least three were doing.

2. The rail was not irreversible, and that was demonstrated inside a month. Colonial Pipeline paid 75 BTC on 7 May 2021; on 7 June 2021 the Department of Justice announced the seizure of 63.7 BTC — about 85% of the ransom — after obtaining a warrant and the key to the wallet holding it. The public ledger that lets a criminal verify payment without trusting anyone also lets an investigator follow it without a subpoena. This is the strongest empirical point against Weaver's version and it was made against him, in public, three weeks after he published.

3. Harm and rail revenue are decoupled, and the two worst events in the record prove it. WannaCry, 12 May 2017: 300,000+ machines in 150 countries, the NHS disrupted, and roughly 52 BTC (~$143,000) collected across three addresses — of which a meaningful share of the payments were researchers testing it. NotPetya, June 2017, was a wiper wearing a ransom note; the payment channel was theatre. Score those two on rail revenue and they round to zero, and they are the most damaging events on the list. This is the entry's own most serious limitation and it cuts directly against the citation the proposal wants. Rails scale extraction. They do not necessarily scale damage, and where the objective is damage the rail is decoration.

4. The claim is being tested right now, and the early result is against it. If the rail were the binding constraint, squeezing it should reduce attacks. In 2025 the squeeze was real and the attacks rose: on-chain payments $820m, down ~8%; claimed victims up ~50%, the most active year on record; the share of victims paying at an all-time low of 28%; 61 new ransomware groups entering between April 2025 and March 2026, and 146 active groups by June 2026. What fell was the payout. What that demonstrates is that the rail governs revenue — which is all it was ever entitled to claim — and that revenue and harm are different quantities that this argument has a standing habit of conflating. The median payment rising 368% to $59,556 fits: a constricted channel carrying fewer, larger transactions.

5. The numbers are floors, and this entry has just compared two of them. Chainalysis reported 2024 as $813m in February 2025 and as $892m a year later — a 9.7% upward revision of a settled year — and says 2025's $820m "is likely to approach or exceed $900 million as we attribute more events." So the 2025-versus-2024 comparison sets an unsettled number against a settled one. The direction is more reliable than the size, and any reading quoting "down 8%" should quote the revision practice with it. Nobody publishes the realised figure after laundering discounts, seizures and price moves, and nobody can — the same defect dprk-crypto-theft records in its own headline total.

6. The counterfactual does not exist and probably never will. Nobody can say how much ransomware there would be without cryptocurrency, because the corporate big-game model only appeared around 2016, by which time the rail was already the default. Both sides are arguing about an experiment that was never run. Two things can be said without it. The pre-Bitcoin rails were profitable — Europol documents one campaign clearing €1m a year — so "it did not work before" is false. And they were shut down by indicting their operators, which the current rail has no equivalent of; the nearest analogue is sanctioning exchanges, and the record there is Garantex disrupted in March 2025 and its successor Grinex operating and sanctioned by August 2025. Partial, repeatable, and answered within months is the honest characterisation of rail enforcement, and it is neither camp's headline.

7. The strongest form of the claim is a policy prescription, and it should be cited as its author's opinion. "We don't have a ransomware problem, we have a Bitcoin problem" is Weaver's sentence, in an argument recommending that governments act against cryptocurrency itself. It is a serious argument by a serious researcher. It is not a finding, it has never been tested, and a reading that cites it without the attribution has upgraded an advocate's conclusion into a fact.

Commonly misused as

Not required for interpretation, but each of these is common enough that a reading meeting it should have the correction to hand.

"Ban crypto and ransomware ends." The mechanism is real and the conclusion is untested. The record shows extortion operating profitably on three successive rails (PO box, prepaid vouchers, cryptocurrency), each adopted after the previous one was squeezed. What the record does not contain is any instance of the crime stopping when a rail was removed. It contains instances of the crime moving.

"Ransomware existed before Bitcoin, so cryptocurrency is irrelevant." The mirror error, with a true premise. $189 to a Panama PO box in 1989 and $4.4m to a wallet in an afternoon in 2021 are the same crime the way a pickpocket and a bank heist are the same crime. Existence is not scale, and the entry's whole content is the gap between them.

"The harm scaled with the rail" as a general law. It scaled the take. WannaCry and NotPetya are the standing refutation for damage, and anyone reaching for the general version should be made to score those two cases out loud first.

"Crypto is untraceable, which is why criminals use it." Van Valkenburgh had the better account in 2016 and the seizures have confirmed it: criminals use it because it is reliable and automatable — a unique address per victim, a public ledger to watch, a key released by software. Traceability is the cost they accept for that, and Colonial Pipeline is what the cost looks like when it comes due.

"An AI capability without a payment rail is not a finding." This is the misuse this entry is most likely to generate in this project specifically, and it is wrong on its own evidence. JADEPUFFER had a documentation-example wallet and an unrecoverable key, and the victim's production database is still gone. "No rail yet" is a statement about revenue. Harm does not require a payout channel; only an industry does.

And the one this project must guard against directly. Nothing here is evidence. This entry deposits nothing into the ledger and does not move the needle — not the $820m, not the 28%, not the €70,000-to-€40,000 haircut, not the Gpcode dates. It exists so that a reading attributing a harm to a capability has to ask, in the open, what channel that harm travelled on, and to say plainly when the answer is none yet.

Sources

Primary where reachable. Provenance is marked per source, because two of the most useful documents could not be read from their publishers.

Read directly.

Recorded from search results and secondary reporting, not read directly. Each is used above and each should be re-verified by a later reading with better access.

Fetch failures, recorded per the rule that a failed search is noted and the work continues.