Leak analysis

Inside the LockBit 4.0 affiliate panel

A leaked database from the LockBit 4.0 panel records how affiliates built payloads, how victims reached the negotiation page and how the haggling went. This page shows the aggregates only.

Privacy. Affiliates are renamed by activity rank. Passwords, wallets, victim names, domains and uploaded files are never published, and chat excerpts are limited to five hand-picked, redacted conversations.

18 Dec 2024 to 29 Apr 202574 affiliates246 victim sessions4,215 messages

Overview

Affiliates7453 built at least once

Builds created1,183631 distinct target sites

Victim sessions246156 builds reached a victim

Messages4,215188 file attachments

Marked as paid72.8% of sessions, 3 affiliates

Median first ask$50k67 negotiations quoted a price

Median affiliate reply6.8 min90th percentile 6.8 h

Top 5 affiliates57%of all victim sessions

Timeline

Activity by week from 16 Dec. The busiest week for chat was the one starting 10 Feb, with 700 messages. The first week is the launch: 625 invites were issued and 121 builds created.

Victim sessions per week

Show the data as a table

Weekly activity
Week commencing	Victim sessions	Builds created	Affiliate messages	Victim messages	Invites issued	Affiliates joined
16 Dec	4	121	37	29	625	29
23 Dec	12	30	53	49	265	8
30 Dec	10	11	18	25	118	2
6 Jan	31	37	12	13	109	3
13 Jan	20	73	59	36	147	6
20 Jan	14	55	69	53	100	2
27 Jan	11	65	38	40	106	3
3 Feb	13	46	131	96	170	3
10 Feb	12	89	386	314	165	1
17 Feb	8	47	141	107	148	2
24 Feb	12	47	121	79	185	2
3 Mar	7	36	147	79	130	0
10 Mar	10	59	106	82	130	1
17 Mar	11	35	90	70	126	2
24 Mar	24	97	144	116	189	2
31 Mar	8	63	122	127	218	2
7 Apr	8	95	78	102	188	2
14 Apr	15	52	142	141	248	1
21 Apr	13	111	282	401	281	2
28 Apr	3	14	41	39	45	0

Affiliates

74 accounts ran the panel. 53 created a build, 35 had a victim open a session and 3 had a victim marked as paid. The top affiliate handled 18% of sessions, the top three 43% and the top five 57%.

By panel tag

Tags are labels the panel admin attached to accounts. They are not verified.

Affiliates, builds and victims by tag
Tag	Affiliates	Builds	Victims
newbie	62	570	140
verified	5	476	89
pentester	4	34	6
other	3	95	9

Most active affiliates

Victim sessions for the top ten, named by rank.

Affiliate 014470 builds, 1,073 messages, 5 paid
Affiliate 024216 builds, 9 messages
Affiliate 031953 builds, 134 messages
Affiliate 0417170 builds, 152 messages, 1 paid
Affiliate 0517147 builds, 142 messages
Affiliate 061279 builds, 248 messages
Affiliate 071074 builds, 71 messages
Affiliate 08732 builds, 26 messages
Affiliate 09715 builds, 2 messages
Affiliate 10680 builds, 23 messages

All affiliates

Sort with the column headers.

						Status
Affiliate 01	verified	70	44	1,073	5	active
Affiliate 02	newbie	16	42	9	0	active
Affiliate 03	newbie	53	19	134	0	active
Affiliate 04	verified	170	17	152	1	active
Affiliate 05	verified	147	17	142	0	active
Affiliate 06	newbie	79	12	248	0	active
Affiliate 07	newbie	74	10	71	0	active
Affiliate 08	newbie	32	7	26	0	active
Affiliate 09	newbie	15	7	2	0	paused
Affiliate 10	verified	80	6	23	0	active
Affiliate 11	newbie	4	5	45	0	active
Affiliate 12	verified	9	5	43	1	active
Affiliate 13	newbie	30	5	24	0	active
Affiliate 14	newbie	13	5	19	0	active
Affiliate 15	newbie	25	4	59	0	active
Affiliate 16	other	30	4	19	0	paused
Affiliate 17	newbie	3	4	1	0	active
Affiliate 18	other	9	3	48	0	paused
Affiliate 19	newbie	15	3	10	0	paused
Affiliate 20	newbie	25	3	0	0	active
Affiliate 21	pentester	12	3	0	0	paused
Affiliate 22	newbie	13	2	19	0	active
Affiliate 23	newbie	6	2	3	0	active
Affiliate 24	newbie	13	2	2	0	active
Affiliate 25	pentester	9	2	2	0	active
Affiliate 26	other	56	2	0	0	active
Affiliate 27	newbie	4	1	23	0	active
Affiliate 28	newbie	3	1	9	0	active
Affiliate 29	newbie	10	1	4	0	paused
Affiliate 30	newbie	3	1	2	0	active
Affiliate 31	newbie	2	1	2	0	active
Affiliate 32	pentester	9	1	1	0	paused
Affiliate 33	newbie	7	1	1	0	active
Affiliate 34	newbie	6	1	1	0	active
Affiliate 35	newbie	4	1	0	0	paused
Affiliate 36	newbie	22	0	0	0	active
Affiliate 37	newbie	14	0	0	0	active
Affiliate 38	newbie	10	0	0	0	paused
Affiliate 39	newbie	10	0	0	0	paused
Affiliate 40	newbie	9	0	0	0	paused
Affiliate 41	newbie	9	0	0	0	paused
Affiliate 42	newbie	7	0	0	0	paused
Affiliate 43	newbie	7	0	0	0	paused
Affiliate 44	newbie	6	0	0	0	paused
Affiliate 45	newbie	6	0	0	0	active
Affiliate 46	newbie	5	0	0	0	paused
Affiliate 47	pentester	4	0	0	0	paused
Affiliate 48	newbie	3	0	0	0	paused
Affiliate 49	newbie	2	0	0	0	active
Affiliate 50	newbie	2	0	0	0	paused
Affiliate 51	newbie	1	0	0	0	paused
Affiliate 52	newbie	1	0	0	0	active
Affiliate 53	newbie	1	0	0	0	active
Affiliate 54	newbie	0	0	0	0	paused
Affiliate 55	newbie	0	0	0	0	paused
Affiliate 56	newbie	0	0	0	0	paused
Affiliate 57	newbie	0	0	0	0	paused
Affiliate 58	newbie	0	0	0	0	paused
Affiliate 59	newbie	0	0	0	0	paused
Affiliate 60	newbie	0	0	0	0	paused
Affiliate 61	newbie	0	0	0	0	paused
Affiliate 62	newbie	0	0	0	0	paused
Affiliate 63	newbie	0	0	0	0	paused
Affiliate 64	newbie	0	0	0	0	paused
Affiliate 65	newbie	0	0	0	0	paused
Affiliate 66	newbie	0	0	0	0	active
Affiliate 67	newbie	0	0	0	0	paused
Affiliate 68	newbie	0	0	0	0	paused
Affiliate 69	newbie	0	0	0	0	active
Affiliate 70	newbie	0	0	0	0	paused
Affiliate 71	newbie	0	0	0	0	active
Affiliate 72	newbie	0	0	0	0	active
Affiliate 73	newbie	0	0	0	0	active
Affiliate 74	newbie	0	0	0	0	active

Negotiations

What happened after a victim opened the negotiation page. Each stage is a share of the 246 victim sessions, not a strict sequence.

Victim sessions246 (100%)Each is a victim opening the negotiation page.
Opened the chat208 (85%)At least one chat row, including the automated greeting.
Victim wrote back138 (56%)A message that is not the automated greeting.
Affiliate quoted a price67 (27%)A US-dollar figure in an affiliate message (heuristic).
Marked as paid7 (3%)The panel paid_commission flag.

Median messages8longest chat 452

Median chat span2 daysfirst to last message

Median victim reply4.8 min90th percentile 20.5 h

Negotiation page views15,894median 11, most 3,688

How long chats ran

Negotiations by number of messages, excluding the automated greeting.

1 message18
2 to 440
5 to 930
10 to 2427
25 to 4924
50 to 9911
100 or more7

When people were typing

Messages by hour of day in UTC. Both sides cluster in the same hours.

AffiliatesVictims

Ransom asks

Dollar figures found in affiliate messages, 67 negotiations in all. This is a heuristic read of free text: bitcoin-only quotes and figures typed without a currency are missed.

Median first ask$50k90th percentile $185k

Ask against claimed revenue1.0%median, 67 negotiations

Price lowered12 of 23where a second figure was quoted

Typical reduction35%first ask to last ask

First figure quoted

Negotiations by the first dollar amount an affiliate named.

Under $5k11
$5k to $10k2
$10k to $25k10
$25k to $50k8
$50k to $100k15
$100k and over21

Discounts named in chat

Percentage discounts mentioned in 11 messages.

10% off3
20% off3
30% off2
50% off2
15% off1

Follow the money

The dump names the bitcoin wallets the panel gave to victims, and affiliates pasted their own into chats. Bitcoin's ledger is public, so payments to those wallets can be read and followed. Values use the price on 19 Oct 2026, $82,541 per bitcoin, and the daily price on the day each payment arrived. Only wallets named in the dump are checked.

Traced in total8.07 BTC$754,730 when paid, $665,875 now

Panel wallets, never spent4.96 BTC$409,383 now, none ever spent

Victims who paid18the panel flags only 7 as paid

Median payment$6.1klargest to an affiliate wallet $59.9k

Largest deposit4.22 BTC52% of all traced, Apr 2025

Paid against first ask79%median; 11 of 13 paid no more than the first ask

Moved within a day21 of 29median 34 min to the first spend

Affiliate sign-up fees0.10 BTC$8,284 now, 12 wallets paid

Where the affiliate-side money went

29 payments reached 26 affiliate wallets, 3.85 BTC in all. Each was followed up to 8 hops, sharing value across outputs in proportion to their size. 17 of the 20 deposits into victim panel wallets are close to 20% of a payment an affiliate had just received. The rest of that payment is what continues onward.

Merged with many other depositsTypical of an exchange or service wallet66%2.53 BTC$209,104
Sent on as the 20% sharePaid into the victim's panel wallet19%0.74 BTC$60,969
Still moving after 8 hopsNot followed further12%0.46 BTC$38,214
Sitting unspentIn the first wallet or a later one3%0.11 BTC$9,128
OtherBatch payouts, mixing and dust0%0.00 BTC$44

Payments by month

Dollar value on the day it arrived, affiliate wallets only.

Dec 2024$53,889 (2)
Jan 2025$52,829 (4)
Feb 2025$101,612 (11)
Mar 2025$35,845 (3)
Apr 2025$108,398 (7)
Oct 2025$323 (2)

Payment sizes

Payments over $50, by value when received. 5 smaller ones are left out.

Under $1k6
$1k to $5k7
$5k to $25k12
$25k to $100k4
$100k and over0

Then and now

Bitcoin received, valued when paid and at the price on 19 Oct 2026
Received into	Bitcoin	When paid	Now	Change
Affiliate wallets	3.8461 BTC	$352,896	$317,459	−10%
Panel wallets, paid directly	4.2211 BTC	$401,834	$348,415	−13%
Total traced	8.0672 BTC	$754,730	$665,875	−12%
Sign-up fees (12 of 163 wallets)	0.1004 BTC	$9,343	$8,284	−11%

Affiliate wallets and panel wallets overlap: the 20% shares in the panel wallets were taken from the affiliate payments, so only the direct deposits are added to the total. The panel wallets hold 4.96 BTC in all, none of it ever spent. Anything paid to wallets the dump does not name, or in Monero, is not counted. Where the money went is a heuristic: a transaction with eight or more inputs is read as an exchange or service wallet, and no exchange is named. Sign-up fee wallets still hold 0.0678 BTC.

Targets

Affiliates enter a company website and revenue when they build a payload. Figures here count distinct sites, never name them. Many builds are tests and rebuilds, so read the totals as an upper bound on real targets.

Country-coded sites

223 of 631 distinct sites end in a country code. Sites ending in .com, .net and similar cannot be placed.

China35
Brazil24
Taiwan17
France11
Italy10
Czechia9
Türkiye6
Colombia5
Mexico5
Malaysia5
Iran5
Russia4

Revenue claimed by affiliates

Typed by the affiliate, not checked. Median $5M.

Under $100k208
$100k to $1M33
$1M to $10M167
$10M to $100M187
$100M to $1B15
$1B and over17

Builds by type code

The panel stores a numeric type for each build. What each code means is not documented in the dump.

Type 30504
Type 25297
Type 46151
Type 40143
Type 5088

The panel itself

How the operation ran its own service: sign-up fees, pre-generated resources and the mistakes the panel logged.

Invites issued3,6932,338 bitcoin, 1,355 monero

Invites redeemed721.9% of issued, status 50

Median sign-up fee0.0082 BTCor 3.62 XMR

Plaintext passwords74 of 742 accounts share one

Wallet addresses pre-made59,975159 assigned (0.3%)

Key pairs pre-made30,0001,095 used (3.6%)

What the panel rejected

3,245 invalid requests were logged, grouped by the error message.

Invalid CSRF token2,736
No message recorded195
Invite code not found71
Non-JSON response68
Password rejected by policy56
Rate limited54
Other25
Wallet list empty16

Admin announcements

Titles of the news posts shown to affiliates.

18 Dec 2024LockBit 4.0 - released.
18 Dec 2024File share & Private note
9 Jan 2025For FBI and Donald Trump with love
15 Jan 2025Reverse engineering impossible
30 Mar 2025LITE PANEL

Conversations

Five negotiations, shown turn by turn with the affiliate on the right. The wording is the panel's own, typos included. Names, links and wallets are removed, and "…" marks trimmed text. The five were picked to show different patterns, not to be a random sample.

What affiliates did

Share of the 151 negotiations where an affiliate wrote, by a keyword match on their messages.

Offers a free test decryption38 (25%)
Offers a discount40 (26%)
Says the price is final or lowest16 (11%)
Sets or shortens a deadline24 (16%)
Threatens to publish or sell data39 (26%)
Defers to a boss or management35 (23%)
Cites what they know about the victim11 (7%)

What victims did

Share of the 138 negotiations where the victim wrote back.

Pleads hardship or says it cannot pay34 (25%)
Asks for a discount26 (19%)
Names a counter-offer in dollars28 (20%)

A $4,000 ask

paid

The panel marks this victim as paid.

Victim
how much decrypt file
Affiliate
4000$ we accept bitcoin only
Victim · 26.5 h in
Hello, it's nice to see you safely. Can you give me a little discount? …
Affiliate · 30 h in
we can give 3800$
Victim · 30.9 h in
We feel like the price is higher. Can't we get a little bit up to $3,600? 10%
Affiliate · 31 h in
ok 3600$ 10%
Victim · 31.1 h in
Thank you. Is it possible for 0.037?
Affiliate · 31.1 h in
no
Affiliate · 38.3 h in
I found problem, all files was decrypted
Victim · 44.5 h in
Please check BTC
Affiliate · 44.7 h in
checked wait for the decryptor
Affiliate · 46.5 h in
i remmit to our tech team. they will send decryptor. because of time shift difference
Victim · 3.3 days in
There are too many materials that cannot be recovered. Why are you doing this?
Affiliate · 3.8 days in
cant recover? moment i will talk to tech team. they will assist you

An $80k ask

paid

The panel marks this victim as paid.

Affiliate
price decrypt 80k in bitcoin, for all hosts and files
Victim · 55 min in
sir this amount is very high to be paid. We would like to work with you because it will take much time to recover our infrastructure. …
Affiliate · 76 min in
we can't offer you a discount
Affiliate · 80 min in
if you pay quickly and restore the infostructure on the same day
Affiliate · 83 min in
I saw your financial report, our price is not big for you
Affiliate · 1.9 h in
ok, we can do a 20% discount
Victim · 2.4 h in
First of all thank you for your understanding and the discount you provided. I appreciate your help on this. But still we are very far away from what we can really pay. …
Affiliate · 2.5 h in
I don't care whether you pay me or not, there will be no more talk about discounts
Affiliate · 2.5 h in
If you don't make a decision, the price will be 2x tomorrow.
Affiliate · 2.7 h in
the price will be 60k your decision to pay or not.
Victim · 3.1 h in
Is there a way to recover 2-3 computers with 15k and get a partial service from your side? …
Affiliate · 27.2 h in
you can pay 50k, but the offer will be available for a some days if you can't pay on the weekend, I'll refund price.
Victim · 3.9 days in
shall we sent 10$ just you to confirm and then send the rest 49990 ?
Affiliate · 3.9 days in
ok

A 1 BTC ask

no payment recorded

No payment is recorded for this victim.

Affiliate
price for decryption and deleting your data from our servers is 1 BTC.
Victim · 13.2 h in
It's extremity expensive here
Affiliate · 13.2 h in
your offer
Victim · 13.2 h in
1k USD
Affiliate · 13.2 h in
Unreal
Affiliate · 13.4 h in
[link to a company profile page]
Affiliate · 13.4 h in
When the timer expires, the decryptor will be deleted and your data will be published
Victim · 13.5 h in
… 1 BTC is completely unrealistic, considering the inflation of our currency against the dollar. Please carefully consider the possibility of making this concession. …
Affiliate · 13.6 h in
I can make a 50% discount

A negotiator acting for the victim

no payment recorded

No payment is recorded for this victim.

Affiliate
the price is 12,000 USDT
Affiliate · 4 min in
ESXI price is 120,000 USDT
Affiliate · 5 min in
total price is 132,000 USDT
Affiliate · 47.4 h in
after 30days ,u lose files foever. decrypt will delete
Affiliate · 2.1 days in
u just agent?
Victim · 7 days in
I have followed your reply information: The client says he can't afford the cost you want. There was backup data 14 days before it was encrypted
Affiliate · 7 days in
Not just 14 days of data, we have clear records.
Affiliate · 7 days in
i will report to boss
Affiliate · 7.1 days in
the lowest price is 80,000 USDT
Affiliate · 7.1 days in
Prices will rise every 3 days. The longer the time, the higher the price.
Affiliate · 9.1 days in
Our team celebrates the achievement of new milestones. Offering customers, your lowest decryption price is 50,000 USDT.
Affiliate · 10.3 days in
Have you given up?
Affiliate · 11.1 days in
If you choose to give up paying the ransom, we will follow up.
Affiliate · 11.1 days in
We will conduct subsequent attacks, incidents and data disclosure.

$1,500 offered against $50,000

no payment recorded

No payment is recorded for this victim. The affiliate then asked to move the talks to a private chat.

Victim
Good day. It is not necessary to test with a file. We trust you. We made a security mistake. …
Victim · 2.5 h in
… Unfortunately we do not have that figure. We are willing to pay but we cannot get close to that number.
Affiliate · 2.9 h in
The price that was requested was formed based on the indicators of your company. And this price is individual for you. In fact, we very rarely take such low amounts.
Victim · 3.4 h in
Right now I have $1500
Affiliate · 13.7 h in
The price is really 50,000 dollars. What you offer has no value for us. If we do not come to an agreement with you soon, then soon all the sensitive data that we downloaded from the company servers will be sold and/or published.
Affiliate · 19.5 h in
We are not ready to lower the price because the price you proposed is too far from reality. Maybe we could discuss with our management a discount of 5-10%, but definitely not 96% as you are asking. …
Victim · 21.5 h in
thank you. But I don't really get that much money. Please I need your help, I am facing a legal problem because of this. By borrowing more money, I can get $3200
Affiliate · 4.6 days in
It doesn't matter to us. Soon all the stolen files will be published. Be prepared for it. You have only one way to prevent it - find the necessary amount of money.
Victim · 5 days in
We don't mind the information being published. You can do it without problem. It's not sensitive at all. …
Victim · 19.1 days in
Good morning. To get back to this, we can offer you $22,000.
Affiliate · 19.3 days in
The price is 50,000 dollars.
Victim · 27 days in
Sorry, I could get $40,000 by Monday.
Affiliate · 27.1 days in
You are a company that helps the affected company solve this problem. Is that correct?
Victim · 27.2 days in
Yes, but they are holding me responsible.
Affiliate · 27.4 days in
We would like to contact you in a private chat, where we will be alone to discuss all the details. There may be strangers in this chat. …

Method and limits

Source: A MySQL dump of the panel database, generated 29 Apr 2025. It holds 15 populated tables covering 18 Dec 2024 to 29 Apr 2025. The raw dump is not published.
What is removed: Affiliate handles, passwords, session identifiers, wallet addresses, onion links, victim domains and file names. Affiliate rows are ordered by activity and renamed, and every build is reduced to counts.
Who is who: In the chat table, flag 0 is the victim side and flag 1 the affiliate side. The first message in each chat is an automated greeting and is not counted as a message.
Marked as paid: The panel's paid_commission flag on a victim session. It shows the panel recorded a payment, not how much or whether it was later reversed. Only 7 sessions carry it.
Ransom figures: Read from free text with simple patterns. They capture US-dollar amounts only and can miss or misread a figure.
Invites: Invite status 50 matches the number of accounts created from invites, so it is read as redeemed. Status 100 (160 invites) is undocumented and left out of the redeemed count.
Bitcoin: Read from the public ledger for wallets named in the dump as of 19 Oct 2026. A victim's panel wallet is credited about 20% of a payment the affiliate had just received, so only deposits that are not such a split are added to the total. Followed money is shared across outputs in proportion to their size, up to 8 hops. Transactions with eight or more inputs are read as an exchange or service wallet; no service is named and the label can be wrong. Payments in Monero, or to wallets the dump does not name, are invisible here.
Conversations and tactics: The five conversations are chosen by hand and trimmed. The tactic counts are keyword matches over every negotiation, so they undercount wording the patterns miss and can match a phrase used in another sense.
Test data: The dump includes test builds and test chats from the first days. They are not filtered out.

Reproduce

The committed data/leak.json is the only data the site reads. To rebuild it you need your own copy of the dump.

cd lockbit-leak
node scripts/extract.mjs   # reads paneldb_dump.sql, writes data/leak.json
cd site
npm ci
npm run check

Tables read: btc_addresses (59,975), pkeys (30,000), socket_messages (5,339), chats (4,423), invites (3,693), system_invalid_requests (3,245), visits (2,398), builds (1,183), builds_configurations (1,183), files (1,015), clients (246), users (75), migrations (34), news (5), faq (1).