The Hive case shows how ransomware-as-a-service (RaaS) turns cyber extortion into a division of labor: a core group runs malware, servers and victim-facing systems, while affiliates break into organizations and share the proceeds. Cryptocurrency supplied a cross-border payment rail, and the FBI’s covert access to Hive let investigators give victims decryption keys before authorities disrupted the operation’s servers and darknet sites in January 2023.
How Hive industrialized ransomware
The U.S. Department of Justice described Hive as a RaaS operation with administrators—also called developers—and affiliates. The administrators maintained the ransomware platform and supporting infrastructure. Affiliates conducted intrusions, encrypted victims’ systems, stole data and negotiated with victims, then shared ransom proceeds with the core group.
The core operators
Hive’s central team supplied the software and the systems that made attacks repeatable. That separation meant the people developing and operating the service did not have to conduct every intrusion themselves.
The affiliates
Affiliates brought access and operational effort. They selected targets, moved through victim networks and applied the extortion pressure. This structure lowered the technical and organizational barriers for criminals who could obtain access without building a complete ransomware business from scratch.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Why the model matters
RaaS changes ransomware from a single gang’s project into a platform business. Disrupting the platform can damage many campaigns at once, but affiliates may still seek another provider if they remain at large and retain their skills or access.
What cryptocurrency contributed
Hive used cryptocurrency as a borderless way to receive ransom payments from victims in different countries. That payment rail fit an operation whose victims, affiliates and infrastructure crossed national boundaries.
The payment system was only one part of Hive’s extortion process. The group also used darknet communications and a leak site to pressure victims, including by threatening to publish stolen information. The available government descriptions do not establish that every victim had to pay in Bitcoin, Monero or one other specific coin, so Hive should not be characterized as requiring a single cryptocurrency in every case.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
How large was Hive?
The major figures come from different authorities and measure different things. They should not be added together or described as one cumulative revenue total.
Recommended Free Tools
| Measure | Figure | What it represents | Source and date |
|---|---|---|---|
| Victims | More than 1,500 worldwide | Victims identified since June 2021 | U.S. Department of Justice, 2023 |
| Ransom payments received | Over $100 million | Payments Hive received since June 2021 | U.S. Department of Justice, 2023 |
| Countries with victims | More than 80 | Geographic reach of reported victims | U.S. Department of State, 2023 |
| Victims given decryption keys | More than 1,300 | Victims assisted through the FBI’s covert access | Federal Bureau of Investigation, 2023 |
| Ransom demands prevented | At least $130 million | FBI estimate of payments avoided through decryption-key assistance | Federal Bureau of Investigation, 2023 |
The State Department said victims included hospitals, school districts, financial firms and critical infrastructure. Those sectors help explain why Hive’s financial impact extended beyond a company’s ransom decision: downtime, recovery work and risks from stolen data could affect public services and customers even when no ransom was paid.
How the FBI penetrated Hive and helped victims
FBI Director Christopher Wray said investigators obtained covert access to Hive systems beginning in July 2022. For seven months, the bureau used that access without alerting Hive, identified victims and obtained decryption keys.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Covert access: The FBI gained access to Hive’s systems in July 2022, according to Wray’s account.
- Victim identification: Investigators used the access to determine which organizations had been hit.
- Key distribution: The bureau supplied decryption keys to more than 1,300 victims so they could restore encrypted data without relying on a ransom payment.
- Financial effect: The FBI estimated that this assistance prevented at least $130 million in ransom payments.
- Public disruption: On January 26, 2023, the Justice Department announced the operation against Hive while international partners moved against its infrastructure.
Wray summarized the approach as: “Since then, for the past seven months, we’ve been able to exploit that access to help victims while keeping Hive in the dark.” The public account describes the operational result, not a complete technical recipe for how the access was obtained.
What happened in the January 2023 takedown
U.S., German and Dutch authorities, working with Europol, seized or disrupted Hive servers and darknet sites in January 2023. Taking control of or disabling those systems attacked the core service that affiliates depended on for ransomware operations, communications and leak-site pressure.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Date | Event |
|---|---|
| June 2021 | The Justice Department’s reported measurement period for Hive victims and ransom receipts begins. |
| July 2022 | The FBI’s covert access to Hive systems begins, according to Director Wray. |
| July 2022–January 2023 | Over seven months, investigators identify victims and provide decryption keys while keeping Hive unaware. |
| January 26, 2023 | The Justice Department announces the disruption; partner agencies seize or disable Hive servers and darknet sites. |
Did the takedown end ransomware-as-a-service?
No. The evidence supports a major infrastructure disruption, not the permanent disappearance of every Hive affiliate or of the wider RaaS market.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
What the operation clearly achieved
- It removed or disrupted important Hive servers and darknet sites.
- It deprived the group of some ability to coordinate attacks, communicate with victims and publish stolen data.
- It helped more than 1,300 victims avoid paying, according to the FBI.
- It exposed the financial vulnerability of a service whose income depended on keeping affiliates and victims connected to the platform.
What it did not establish
- It did not establish that every affiliate was arrested.
- It did not prove that affiliates could not migrate to another ransomware service.
- It did not show that ransomware or cryptocurrency-based extortion had ended globally.
That distinction is central to understanding RaaS. Law enforcement can dismantle a brand and its infrastructure while the people, access methods and business model reappear elsewhere.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the Hive case means for financial risk
For organizations
Ransomware exposure is both an operational and a financial problem. A decision to pay is not simply a transfer of cryptocurrency: it follows service interruption, potential data exposure, legal and regulatory review, restoration costs and uncertainty about whether attackers will honor a promise to decrypt or delete data. Hive’s leak site and victim communications show how attackers combine technical disruption with reputational pressure.
For individuals and customers
When a hospital, school district or financial firm is attacked, customers may experience unavailable services, delayed transactions or notifications about stolen information even if the organization refuses to pay. The Hive case therefore connects cybercrime to everyday financial resilience, not just to the victim organization’s IT department.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBest Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
For policymakers and investigators
The case demonstrates the value of attacking both sides of the economics: covertly helping victims avoid payments and disrupting the infrastructure that connects administrators, affiliates and victims. International coordination mattered because Hive’s operations crossed jurisdictions.
Bottom line
Hive is a clear example of RaaS as a criminal platform: developers and administrators supplied the service, affiliates executed attacks, and cryptocurrency enabled ransom collection across borders. The FBI’s seven-month covert access helped more than 1,300 victims avoid at least $130 million in payments, while the January 2023 international action disrupted Hive’s servers and darknet sites. Those results weakened one major operation, but they did not eliminate the affiliate-driven model or the broader ransomware ecosystem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
