The masterminds of the global ransomware attack that paralysed parts of the NHS and thousands more organisations in May might have finally collected their spoils.
A Twitter bot devised by Quartz journalist Keith Collins has spotted that £105,000 worth of bitcoin has now been withdrawn from the WannaCry hackers’ online wallets.
The money appears to have been moved in two stages: a small initial portion was taken in late July, while the rest was withdrawn in the early hours of this morning.
Experts say the money may have been processed by a mixer to obscure its origin. Some think it will be converted into hard currency. Others argue it will remain as bitcoin.
The attack, which forced the NHS to cancel thousands of appointments and operations, has since been linked to North Korea by intelligence officials at GCHQ.
Their investigation corroborated the findings of the NSA in the US, which had previously traced the ransomware back to a notorious cyber gang known as the Lazarus Group.
Most experts believe that the attack was motivated by a desire to chaos cause, not generate money, unlike some of Lazarus’s previous attacks.
Last year, the hackers are thought to have carried out the £63m cyber heist on Bangladesh’s central bank. The strike stunned the industry, pushing cybersecurity up the agenda in bank boardrooms around the world.