$12M Caesars ransomware recovery (Scattered Spider)

The 2023 Caesars Entertainment ransomware attack, attributed to the Scattered Spider group, ended with a multimillion-dollar ransom paid in crypto. Ransom payments are often written off as unrecoverable; this case showed they aren't.

A $15 million slice of the payment was tracked as it moved through the group's laundering infrastructure. Members of Scattered Spider are known for aggressive social engineering but comparatively sloppy money handling, and the tracing work located a large portion of the funds while they were still reachable.

Twelve million dollars was recovered, one of the largest publicly documented recoveries of a ransomware payment, and a rare piece of good news in a category of crime where victims usually absorb the full loss.