PANews reported on May 8 that according to Cointelegraph, the dark web-related panel of the LockBit ransomware gang was hacked, resulting in the leakage of nearly 60,000 Bitcoin addresses. These addresses are related to LockBit's ransomware infrastructure, and the leaked data includes a MySQL database dump containing information related to cryptocurrency, which may help blockchain analysts track the illegal flow of funds of the gang.

Although the address was exposed, no private keys were leaked. The leaked database contains 20 tables, including a "builds" table that records the ransomware versions created by members of the group, and a "chats" table that records more than 4,400 negotiation messages with victims.

Analysis pointed out that this incident may be related to the vulnerability of the Everest ransomware site, and the two used similar information prompts.