Bitcoin Used in Berlin Ransomware Attack, Rhysida Victim Data Leaked

Bitcoin remains the currency of choice for nearly all ransomware groups worldwide, even though every transaction is permanently recorded on the blockchain and can be traced by anyone. 

This irony was once again proven by the latest case: the Berlin state government in Germany became a victim of a ransomware attack by the Rhysida group, which demanded a ransom of 30 Bitcoin after breaching the city's Senate network. Berlin chose to refuse payment, and as a consequence, a data leak of 5.7 terabytes occurred on the dark web in early September 2026.

This case is interesting not only because of the ransom amount, but because it serves as a real example of how Bitcoin is still actively used in cybercrime, and simultaneously how major public institutions are increasingly emboldened to refuse to succumb to digital extortion.

Key Takeaways

• Rhysida demanded a ransom of 30 BTC (approximately US$2.4 million) from the Berlin government after hacking the city's Senate network in mid-August 2026.
• Berlin refused to pay; Rhysida leaked approximately 5.7–5.8 terabytes of data (roughly 1.44 million files) to the dark web on September 5, 2026.
• Chainalysis data shows that the proportion of ransomware victims who paid the ransom fell to a record low of 28% in 2025, even though Bitcoin remains the perpetrators' preferred payment method.

Chronology of the Rhysida Ransomware Attack on Berlin

The Berlin state government network was breached around mid-August 2026, with the breach only being detected and officially announced on August 14. 

As a security measure, two Senate departments — responsible for urban and housing affairs, and mobility and transport — were disconnected from the state network until August 23, causing delays in the disbursement of housing allowances and family assistance during the recovery period.

Rhysida then claimed responsibility and demanded a ransom of 30 Bitcoin, equivalent to approximately US$2.4 million according to BeInCrypto, or about €2 million according to the Berlin Senate Chancellery's own calculation. This discrepancy is natural as the Bitcoin price continued to fluctuate during the payment deadline.

Florian Hauer, Berlin's Chief Digital Officer, reaffirmed the city's stance of not bowing to extortion for the safety of its staff and citizens. The payment deadline ended on September 4, 2026, and a day later, Rhysida indeed published all the stolen data on the dark web.

For readers who wish to delve deeper into digital asset security while also starting to trade crypto safely, registering on an OJK-licensed crypto asset trading platform such as Bittime could be a good first step.

Scale of the Data Leak and Who Rhysida Really Is

The leaked data amounts to approximately 5.7 to 5.8 terabytes, consisting of roughly 1.44 million files. The contents are quite sensitive: tens of thousands of contracts, thousands of confidential parliamentary committee documents, records of tens of thousands of administrative fine proceedings, salary data and passwords of state employees, and vulnerability analyses of critical infrastructure such as Berlin's drinking water supply system. 

Local authorities have warned that ordinary citizens' personal data, not just government employees', may also be affected.

Rhysida itself is not a new player in the ransomware world. This group, believed to be based in Russia or Eastern Europe, has been active since 2023, with a track record of attacking the British Museum in the same year — stealing around 500,000 files and publishing them after the museum refused to pay — as well as the city of Stuttgart with similar attack patterns. 

This track record made Rhysida's threat to publish Berlin's data no mere bluff.

Read Also: Nvidia's $500 Billion AI Funding – Will AI Crypto Tokens Benefit?

Why Does Bitcoin Remain Ransomware's Currency of Choice?

According to the Chainalysis 2026 Crypto Crime Report, total on-chain ransomware payments in 2025 actually fell by 8% to US$820 million, marking the second consecutive year of decline. However, at the same time, the number of attacks claimed by ransomware groups surged by 50%, making 2025 the most active year on record.

Interestingly, the proportion of victims who actually paid the ransom fell to a record low of just 28%. The Berlin case, which chose to refuse payment, is actually in line with the current trend among the majority of ransomware victims. 

Nevertheless, the median ransom payment that was actually paid soared by 368%, from US$12,738 in 2024 to US$59,556 in 2025 — driven by a handful of high-value payments, not a general resurgence of large-scale corporate extortion tactics.

Jacqueline Koven, Head of Cyber Threat Intelligence at Chainalysis, explained that Bitcoin remains the top choice for ransomware actors because of its cross-border nature, speed, liquidity, and ease of use. 

Ironically, the transparency of the blockchain, which makes every transaction traceable, is itself a risk for the criminals, as it opens the door for law enforcement to follow the flow of extorted funds.

Read Also: BIS Unveils New Potential of XRP Ledger for Digital Financial Systems

Conclusion

The Rhysida ransomware case against Berlin reveals two opposing sides: large public institutions are increasingly brave in refusing to succumb to digital extortion, while Bitcoin persists as the preferred payment method for cybercriminals, even as the risks of tracking it grow higher. 

Chainalysis data reinforces this trend more broadly — ransomware attacks are happening more frequently, but fewer victims end up paying. For governments and companies alike, this incident serves as a reminder that strong cybersecurity is far cheaper than facing the consequences of a massive data breach.

Check the prices of Bitcoin (BTC), Ethereum (ETH), XRP, Solana (SOL), GRAM, and BNB as well as the top memecoin DOGE. You can trade directly on Bittime!

Bittime is a Digital Financial Asset Trader (PAKD) platform licensed and supervised by the Financial Services Authority — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from Rp10,000. The registration process is fast, secure, and can be started today.

Monitor the  USDT to IDR conversion and the real‑time price movements of your favorite crypto assets. All available in one  crypto investment app that can be downloaded for free from the Play Store.

Ready to start? Register now at Bittime and execute your investment strategy with a platform trusted by millions of users in Indonesia.

FAQ

What is Rhysida? 

Rhysida is a ransomware group active since 2023, believed to be based in Russia or Eastern Europe, with a track record of attacking the British Museum and the city of Stuttgart before targeting Berlin.

Why did Berlin refuse to pay the Bitcoin ransom demanded by Rhysida? 

The Berlin government reaffirmed its principle of not bowing to extortion for the safety of its staff and citizens, even though the consequence was that the stolen data was eventually published on the dark web.

Why do ransomware hackers often demand payment in Bitcoin? 

Bitcoin is chosen because of its cross-border nature, fast processing, liquidity, and ease of use compared to conventional payment methods.

Can Bitcoin ransom payments be traced? 

Yes, because every Bitcoin transaction is permanently recorded on the blockchain, allowing law enforcement to trace the flow of funds, although the tracking process still requires time and special expertise.