Berlin Refuses Rhysida's 30 Bitcoin (BTC) Ransom Worth $2.4 Million

Rhysida’s 30 BTC Auction Ends Empty-Handed

Berlin’s state government has refused to pay a 30-coin Bitcoin (BTC) ransom demanded by the Rhysida ransomware group, and the attackers answered by publishing 5.7 terabytes of stolen data on the dark web. Rhysida, a crew active since 2023, opened an auction for the files with bidding starting at 30 BTC, offering the cache to the highest bidder rather than to the victim itself. With Bitcoin trading near $79,902 per coin while the ultimatum ran, the demand was worth roughly $2.4 million — a sum Berlin’s Senate Chancellery put at about two million euros. The asset’s recent strength worked against the extortion math: BTC added 0.46% on the day and 24.4% over the past month, lifting the dollar value of the demand while the clock ticked down. Rhysida’s playbook is a double-extortion model — encrypt systems, exfiltrate data, then monetize the theft twice, first through the ransom and again through a public sale if the target stalls. Berlin let the deadline pass without a counteroffer. Florian Hauer, the city’s chief digital officer, ruled out any payment in an official statement from the city, declaring: “The State of Berlin will not give in to blackmail. The safety of the State of Berlin’s staff and the people of Berlin is our top priority.” The ransom deadline ran out on Friday, September 4, and Rhysida published the complete dataset that same afternoon. The auction closed with no result — no dark-web whale bidder stepped forward to buy the 5.7TB cache, and Rhysida collected nothing from the operation. Berlin has not yet put a figure on the total damage, and the review of the published files continues.

Crisis Unit Combs Through the 5.7TB Leak

The intrusion surfaced on August 14. Berlin responded by severing two Senate departments from the state network: one covering urban development and housing, the other covering mobility, transport, and the environment. Citizen-facing services felt the impact immediately — housing benefit payments and family support stalled until both departments returned to service on August 23, according to the city’s own restoration notice. Officials have warned that residents’ personal data may be part of the leak. A central crisis unit is now reviewing the material Rhysida released after the ransom went unpaid, with forensic specialists combing through the files around the clock. The State Criminal Police Office and Germany’s federal cybersecurity agency are leading the investigation, and residents have been told to report fraud or identity theft to police. The timing adds political weight: Berliners elect a new state parliament on September 20, two weeks after the deadline expired. The refusal also tracks a measurable shift in extortion economics. On-chain data shows ransomware payments fell about 8% in 2025, even as claimed attacks rose 50% — evidence that victims are increasingly absorbing the breach rather than funding the criminals. Recent security coverage, including COINOTAG’s report on an Orionx shutdown over a $7 million custody gap, underscores how both institutional and state actors now face hardening scrutiny over digital-asset exposure.

No Payout, Fewer Ransoms Paid

COINOTAG’s reading of the two threads: Berlin’s refusal and the 2025 decline in on-chain ransom payments point the same direction — the coercive value of a proof-of-work settlement rail depends entirely on victims choosing to pay, and that willingness is eroding. The city’s remediation, documented in its official notices, centered on network isolation of the affected departments, a 24/7 forensic review, and a joint investigation with federal authorities. As governments weigh treasury policy frameworks from seizures to a Strategic Bitcoin Reserve, Berlin’s stance marks the defensive edge of state-level BTC exposure. With researchers warning of a next major Bitcoin (BTC) exploit driven by stronger AI tooling, September 20’s state election outcome will show whether that resolve holds under political pressure.