Though the funds all the time got here to the change by way of middleman wallets, Chainalysis discovered cases by which the pockets receiving ransomware proceeds despatched funds on to the mining pool pockets, which then despatched the cash to the change. This would possibly imply that each the ransomware- and mining-related wallets belong to the identical proprietor, who’s utilizing mining as a technique to launder prison funds, Chainalysis wrote.