The trove, published earlier this week on a website titled “The Luna Moth Files,” includes chat logs, alleged ransom-demand totals, internal documents, and dozens of cryptocurrency wallet addresses supposedly tied to the group’s operations.
Blockchain investigations firm Chainalysis said on Wednesday that the leaked material appears to expose the money trail behind the group's extortion business.
The firm said in an X post that “certain leaked SRG addresses sit downstream of millions of dollars in ransomware payments that SRG has extorted from victims.”
One of the addresses in the leak was already on Chainalysis's radar: it reflected a $10 million victim payment the group collected in mid-2026, the company said.
Reuters reported it could not independently verify the authenticity of the website's claims or data.
A $10 million payment and wallets already on the radar
The leak matters because it could help investigators and victims trace where the money went.
Silent Ransom Group has built its name on targeting law firms, which hold the sensitive documents, merger details, and client secrets that make them lucrative marks.
According to Chainalysis, at least one of the leaked wallets matches addresses the firm was tracking before the leak went public, which lends weight to the idea that the trove is drawn from real extortion payments.
The amounts involved put the group in the upper tier of extortion operations.
The FBI warned in May that the group was stealing data from law firms with hacks and demanding millions of dollars to prevent it from being posted publicly.
A single $10 million payment, if confirmed, would rank among the largest publicly discussed ransom payments tied to a single victim group this year.
How the group hunted its targets
The bureau has described an unusually hands-on playbook.
Instead of relying only on phishing emails and software flaws, the FBI says Silent Ransom Group targets specific firm employees with phone calls, emails, and sometimes in-person visits to gain access to their computers and, from there, the firms' networks.
Reuters has previously reported that the group has been alleged to be involved in hacks on prominent law firms including Fox Rothschild and Jones Day.
The group's identity, and who decided to expose it, remains a mystery.
Nobody has claimed responsibility for publishing “The Luna Moth Files,” and retaliation leaks of this kind can come from rival crews, disgruntled affiliates, or even law enforcement sources.
What is clear is that the same tactics that made the group dangerous — relentless contact with victims and a willingness to follow through on threats — have now made it visible.
For the law firms still sitting on undisclosed breaches, the leak is a warning that their secrets may no longer be secret.
