The FBI Dallas office has successfully seized approximately 20 Bitcoins worth over $2.3 million from a cryptocurrency wallet linked to the Chaos ransomware group. The seizure, executed on April 15, 2025, represents a significant blow to cybercriminals targeting Texas businesses.
## The Investigation and Seizure
Federal agents traced the cryptocurrency to an address belonging to “Hors,” a suspected affiliate of the Chaos ransomware group. This individual is believed to have orchestrated multiple cyberattacks against companies in the Northern District of Texas and other regions.
The seized amount of 20.2891382 BTC was valued at over $2.3 million at the time of confiscation and has since increased to more than $2.4 million. On July 24, 2025, the U.S. Department of Justice filed a civil forfeiture complaint to permanently claim ownership of these assets.
Civil forfeiture enables the government to directly target property connected to criminal activities, allowing authorities to seize assets without requiring a criminal conviction first.
## The Evolution of Chaos Ransomware
The current Chaos ransomware operation represents a complex evolution in the cybercriminal landscape. Despite sharing a name with an older, low-tier ransomware variant from 2021, this new group has no connection to its predecessor.
### Criminal Lineage
The new Chaos operation traces its roots to the notorious Conti ransomware gang, which shut down in June 2022 following a damaging data breach. Former Conti members scattered across the cybercriminal ecosystem, forming new groups:
– **January 2023**: Royal (Quantum) ransomware emerged as Conti’s direct successor
– **June 2023**: Royal rebranded as BlackSuit following law enforcement pressure over the Dallas city attack
– **Recent**: BlackSuit evolved into the current Chaos operation
Cisco Talos researchers have identified strong connections between Chaos and BlackSuit, noting similarities in encryption methods, ransom note structures, and attack tools.
## Law Enforcement Success
This Bitcoin seizure likely stems from the broader investigation that led to the recent takedown of BlackSuit’s dark web extortion sites. The timing suggests that authorities uncovered this cryptocurrency wallet during their comprehensive operation against the ransomware network.
The successful seizure demonstrates the increasing effectiveness of law enforcement in tracking and disrupting cryptocurrency-based criminal operations, even as ransomware groups continue to evolve and rebrand their operations.
This case highlights the ongoing cat-and-mouse game between cybercriminals and law enforcement, where criminal organizations constantly adapt their tactics while authorities develop new methods to trace and seize illicit digital assets.