How 1 ransomware negotiator took shocking crypto extortion kickbacks in corrupt scheme

The US Justice Department is investigating a former ransomware negotiator suspected of accepting crypto extortion kickbacks in exchange for facilitating payments to cybercriminals. The case highlights growing concerns over insider corruption within the cybersecurity industry, where negotiators may profit from their clients’ desperation.

DigitalMint fires employee amid federal investigation

Marc Grens, president of Chicago-based DigitalMint, confirmed to journalists that an employee was terminated after allegations surfaced of unauthorized dealings with hackers. The firm, which specializes in ransomware negotiations and cryptocurrency payments, stated that it is cooperating with law enforcement but is not a target of the investigation.

“The investigation involves alleged unauthorized conduct by the employee while employed here,” Grens said. “We acted swiftly to protect our clients. Trust is earned every day.”

The case, first reported by Bloomberg, suggests the negotiator may have struck secret agreements to receive a percentage of the ransom, a clear example of crypto extortion kickbacks undermining the negotiation process.

Are ransomware negotiators exploiting victims?

Experts warn that negotiators don’t always act in their clients’ best interests. James Taliento, CEO of cybersecurity firm AFTRDRK, told Bloomberg:

“A negotiator is not incentivized to drive the price down if they profit off the size of the demand paid. Plain and simple.”

This aligns with past reports, including a 2019 ProPublica investigation revealing firms that paid hackers and then overcharged clients for “specialized recovery.” Such schemes often involve crypto extortion kickbacks, where middlemen secretly benefit from inflated ransoms.

Ransomware payments decline as defenses improve

While crypto extortion kickbacks remain a concern, fewer companies are paying ransoms overall. According to Coveware, only 25% of ransomware victims paid hackers in Q4 2024, down from 85% in early 2019.

The decline suggests stronger cybersecurity measures, better backups, and reluctance to fund criminals. Increased law enforcement action, such as the US Treasury’s sanctions against Russia-linked Aeza Group, has also disrupted ransomware networks.

Chainalysis reported a 35% drop in ransomware payments in 2024, totaling $815 million compared to $1.25 billion the previous year. However, experts caution that crypto extortion kickbacks could still distort negotiations, making transparency critical.

Crypto extortion kickbacks: The future of ransomware negotiations

As authorities crack down on illicit deals, firms like DigitalMint face pressure to ensure ethical practices. Grens emphasized the company’s compliance, stating it is registered with the US Financial Crimes Enforcement Network (FinCEN) and serves Fortune 500 clients.

Yet, the case underscores a broader issue: without strict oversight, crypto extortion kickbacks could erode trust in negotiators. The DOJ’s probe may set a precedent for holding intermediaries accountable—a crucial step in dismantling ransomware’s profit model.

For now, victims are advised to vet negotiators thoroughly, demand full transparency, and report any suspicious activity. As Taliento warned, “If a deal seems too easy, it probably is.”