Digital Asset Theft And Ai-Enabled Ransomware Prosecutions
Case 1: NetWalker & Cryptocurrency Ransomware (USA, 2022)
Facts:
The ransomware group NetWalker deployed ransomware campaigns globally, encrypting victims’ systems and demanding ransom payments in cryptocurrency.
One key defendant was found to have orchestrated attacks, collected crypto payments, and laundered those funds.
Charges:
Wire fraud, conspiracy to commit money laundering, unauthorized access of protected computers, extortion via digital assets.
Outcome:
In October 2022 a member of NetWalker was sentenced to 20 years in prison and ordered to forfeit about US$21.5 million in stolen crypto.
Legal Significance:
Demonstrates that digital asset theft (via crypto ransom) is treated equally seriously as “traditional” asset theft.
The laundering of cryptocurrency proceeds is a key component of the prosecution.
Shows how law enforcement has developed the capacity to trace crypto payments and hold actors criminally responsible.
Case 2: REvil (AKA Sodinokibi) Ransomware (USA, 2024)
Facts:
The REvil ransomware‑as‑a‑service group launched thousands of attacks and demanded ransom payments of hundreds of millions of dollars in virtual assets.
One co‑conspirator, Yaroslav Vasinskyi, was charged for his role in this scheme.
Charges:
Conspiracy to commit computer fraud, extortion, money laundering; receipt and handling of virtual assets derived from criminal conduct.
Outcome:
In 2024 Vasinskyi was sentenced to over 13 years in prison for his part in the REvil scheme (ransom demands greater than US$700 million).
Legal Significance:
Highlights that large‑scale ransomware groups leveraging crypto assets are being prosecuted under multiple statutes.
Virtual assets (cryptocurrencies) are clearly part of the chain of criminal responsibility — not ancillary but central.
Case 3: “Crypto Theft via SIM‑Swap & Wallet Hacks” (USA, 2025)
Facts:
A U.S. defendant, Noah Michael Urban, used SIM‑swap attacks and other hacking techniques to gain control of victims’ cryptocurrency wallets and transfer millions of dollars in crypto to his own accounts.
Charges:
Conspiracy, wire fraud, aggravated identity theft, theft of digital assets (cryptocurrency).
Outcome:
In August 2025 Urban was sentenced to ten (10) years in federal prison, and ordered to forfeit approximately US$4.8 million in assets, pay US$13 million in restitution.
Legal Significance:
Shows that traditional identity‑theft and hacking statutes are being used to prosecute theft of digital assets.
Reinforces that cryptocurrency wallets and digital tokens are treated as property subject to theft charges.
Case 4: Digital Asset Theft Case in Germany (2025)
Facts:
A German court (Braunschweig Higher Regional Court) dismissed charges in a case involving the theft of ~US$2.9 million in cryptocurrency (tokens) because the court held the German Criminal Code’s definition of “movable thing” did not clearly apply to crypto assets.
Charges:
Alleged theft of crypto tokens by exploiting seed‑phrase vulnerability.
Outcome:
The prosecution was dismissed due to the legal gap around classification of cryptocurrencies in German law.
Legal Significance:
Illustrates a legal gap: digital assets may not fit traditional theft statutes in some jurisdictions.
Signals that where digital assets’ legal classification is unclear, prosecutions may fail — prompting legislative reform.
Case 5: AI‑Enabled Ransomware Extortion & Digital Assets (USA)
Facts:
The U.S. Department of Justice (DOJ) reported that ransomware groups have used sophisticated automation and digital asset payment flows: the “Ransomware and Digital Extortion Task Force” cites that digital assets are heavily used in extortion schemes.
For example, gangs deploy malware (sometimes AI‑assisted) to encrypt systems, demand crypto payment, then launder the assets across mixers then convert into fiat or other tokens.
Charges:
Unauthorized access of protected computers, extortion, conspiracy, money laundering, criminal proceeds in virtual assets.
Outcome:
Numerous convictions and infrastructure seizures; e.g., seizure of criminal infrastructure of major ransomware groups, disrupting operations and securing convictions.
Legal Significance:
Shows how digital assets + ransomware combine into “AI‑enabled” or automated cyberattack vectors.
Demonstrates that prosecutors treat digital asset theft/extortion on par with traditional asset theft, and use virtual asset tracing as evidence of criminal proceeds.
Case 6: Corporate Ransomware Payment Case (Canada/UK jurisdiction)
Facts:
A Canadian‐based insurance company’s systems were encrypted by ransomware (BitPaymer) in October 2019; ransom was demanded in Bitcoin (~US$1.2 million) and ultimately ~US$950 000 paid.
Legal Issues:
Issues of paying ransom, digital asset flow, blockchain tracing of payment.
Outcome:
While this case is primarily civil/insurance rather than criminal prosecution, it reflects the legal complications of digital asset ransom payments and the tracing of crypto flows.
Legal Significance:
Even when direct criminal prosecution may not occur, the incident illustrates how digital asset theft/extortion is integrated into risk, legal compliance, insurance, and regulatory frameworks.
Highlights that digital assets (cryptocurrencies) complicate ransom payments and liability.
Observations & Common Themes
Virtual/digital assets (cryptocurrencies, tokens) are now central to theft and ransomware schemes, and are treated as criminal proceeds.
AI/automation: While not always explicitly labelled “AI‐enabled,” many ransomware schemes use sophisticated automation, scripting, and orchestration of attacks + automated crypto payment flows.
Legal classification of digital assets matters: Some jurisdictions (e.g., Germany) struggle with categorizing crypto as “property” or “movable thing,” affecting theft prosecutions.
Tracing and forfeiture: Prosecutions increasingly rely on blockchain tracing, crypto wallet identification, and conversion of digital assets into forfeiture orders.
Cross‐border and jurisdictional complexity: Digital asset theft and ransomware span jurisdictions, complicating enforcement and requiring international cooperation.
Prosecution statutes: Hacking laws (unauthorized access), extortion laws (ransomware), money‐laundering/forfeiture laws (digital asset flows) are all used.
Precedent setting: These cases establish that theft of digital assets and ransomware with crypto payment vectors are as serious as “traditional” theft and extortion crimes.
RELATED Blog
comments