A U.S. court seized $8.37 million in cryptocurrency assets from Angelo Martino (안젤로 마르티노), a ransomware negotiator accused of betraying clients and helping hackers press ransom demands.

On July 19 local time, blockchain media outlet U.Today reported that the U.S. District Court for the Southern District of Florida ordered forfeiture of a cryptocurrency portfolio Martino had concealed, wrapping up the case.

The seized assets were spread across bitcoin, privacy coins and altcoins. The court targeted 90.319 bitcoin, 7,999.873 monero, 56,174.15 XRP, 39,760.79 stellar lumens, and a small amount of Solana-based SOL tokens. The bitcoin holding was valued at about $5.84 million, the largest share, while monero was worth about $2.46 million.

The XRP was seized from a wallet ending in "...EkThx6" and the stellar lumens from an address ending in "...5RJ3BD". The court also designated for seizure two luxury residential properties in Florida, luxury vehicles and a motorboat. Those assets were cited as part of a lifestyle maintained with funds generated through illegal activity.

The heart of the case is that Martino was originally in a position to protect companies. He was brought in as the lead negotiator when major firms had their networks encrypted in attacks by a ransomware group known as BlackCat, or ALPHV. His role at the time was to reduce the ransom and coordinate cryptocurrency transfers safely.

But Martino effectively turned the negotiations into an internal auction. He secretly passed victims' actual budgets and insurance limits to the hackers, allowing them to assess the victims' ability to pay and demand tougher terms. Martino was found to have received a set percentage in bitcoin and XRP in return for that cooperation.

Investigators concluded he was deeply involved as a substantive participant in the attacks, beyond acting as a simple intermediary. The outlet reported that instead of protecting corporate wallets, he shifted into a figure who designed hackers' ransom plans. It also noted that the negotiations ultimately became an "internal auction", and that BlackCat was able to demand tougher terms after learning victims' financial capacity.

Martino's double dealing also led to criminal punishment. He was convicted and sentenced to 70 months in federal prison. The forfeiture of more than $8.30 million in assets amounted to a move that effectively removed the funding base of his illegal business.

The case shows that conflicts of interest between ransomware negotiators and hackers can lead to financial crimes during ransomware responses. It also confirmed that authorities expanded the scope of seizure by tracing not only bitcoin but also monero, XRP, stellar lumens and SOL. Control over negotiating structures and money flows is expected to become more important in future ransomware responses.