FBI seizes over $2.4 million in Bitcoin from new Chaos gang linked to Texas attack

In April 2025, the FBI in Dallas seized more than 20 bitcoins (\~\$2.4 million) from a crypto wallet belonging to a member of the new Chaos ransomware gang. According to the investigation, the hacker under the pseudonym *Hors* received these funds in the form of ransoms after attacks on companies in Texas.

According to the US Department of Justice, 20,2891382 BTC were withdrawn from the address bc1q5d8af0crjhlnepjq08muhh55899rf2ktye3sxd. At that time, the amount exceeded $ 2,300,000 and the authorities have now filed a civil lawsuit for confiscation to legalize the full seizure of assets.

The Chaos group, according to the investigation, is a rebranding of BlackSuit, which, in turn, became the successor to the notorious Conti, which collapsed after an internal data leak in 2022. By 2023, its members had established several new branches, including Royal (Quantum), and later BlackSuit, which attacked, in particular, the city of Dallas. After pressure from law enforcement, they reformatted into Chaos.

Chaos is not related to the outdated ransomware constructor of the same name, which newcomers have been using since 2021. The new gang has powerful technical capabilities, including a modern encryption system, ransom demand templates, TLS-secured connection, and tools for hiding activity.

Cisco Talos experts believe that the new version of Chaos is completely based on BlackSuit – this is evidenced by the identical encryptor, note structures, and tools used. Darknet extortion sites were destroyed by law enforcement at the preliminary stage of the investigation.

The seizure of over $2.4 million in bitcoin demonstrates the effectiveness of the FBI’s actions against modern cryptocriminals. Chaos is not just another extortion gang: it continues the legacy of Conti and actively employs new tactics. Legal mechanisms, such as civil forfeiture, allow cybercriminals to freeze their profits before they are convicted.