Where The Ransom Went Screensaver
The Where The Ransom Went screensaver shows ransomware payment addresses from the open Ransomwhe. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the Where The Ransom Went screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
Ransomware payment addresses from the open Ransomwhe.re register, key-less. Anyone can submit an address and every entry stays auditable — which also means the totals are what researchers reported, not what victims actually paid.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
How the ransom register is built
Ransomwhe.re describes itself as an open, crowdsourced ransomware payment tracker. It publishes Bitcoin addresses linked to ransomware payments, and the data can be browsed or downloaded through a public API. It was built by Jack Cable at Corridor and is a partner of Chainabuse.
Anyone can report one or more Bitcoin addresses, but a report must come with verification: a screenshot of the payment page, the ransom note, or a link to a public source. Submissions are reviewed before they are displayed, and the ransomware family is an optional field, so some addresses carry no family label. Because Bitcoin transactions sit on a public ledger, anyone can inspect an address's history.
The site states that dollar values are calculated using the bitcoin exchange rate on the day the transaction was sent, so they are approximations that can differ from what criminals actually received when they sold the coins. The totals also only cover addresses someone found and reported, so they are a floor, not a full count of ransomware payments.
A worked example
Ransomware payment addresses from the open Ransomwhe.re register, key-less. Anyone can submit an address and every entry stays auditable — which also means the totals are what researchers reported, not what victims actually paid.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- Do these totals show all ransomware payments?
- No. They cover only addresses that were reported and accepted, so real payments are likely higher.
- How are the dollar figures calculated?
- Ransomwhe.re states that it uses the bitcoin exchange rate on the day each transaction was sent. They may differ from what criminals received when they cashed out.
- Can blockchain data identify the attackers?
- Not by itself. The ledger shows addresses and amounts, not who controls them.