Berlin Cyberattack: Rhysida Demands 30 Bitcoin
Berlin is investigating a cyberattack on two state agencies after the ransomware group Rhysida reportedly demanded 30 Bitcoin, worth about €2 million, for allegedly stolen data. Berlin Mayor Kai Wegner said the state would not pay the ransom.
The affected agencies were temporarily disconnected from Berlin’s state network. The disruption affected some public services, including housing-benefit applications. Rhysida claims it stole almost six terabytes of data, including administrative records, contracts, passwords, login credentials, emergency plans and critical-infrastructure documents. Berlin has not independently verified the group’s claims or the reported ransom amount.
Officials initially said only public information had been compromised, but later acknowledged that non-public data was affected. The Berlin State Criminal Police Office and prosecutors are investigating the breach and assessing when the intrusion began and how much data may have been removed.
The Berlin cyberattack highlights the continuing use of Bitcoin in ransomware demands. Although attackers can transfer funds without traditional bank accounts, Bitcoin transactions remain publicly traceable. For crypto traders, the incident is unlikely to materially affect Bitcoin’s price because no payment was confirmed. However, a confirmed ransom payment, wallet movement or law-enforcement seizure could create short-term volatility and renew scrutiny of crypto-related money laundering risks.
Neutral
The direct market impact is neutral because Berlin has refused to pay and authorities have not confirmed either the 30 BTC demand or the alleged theft. The incident involves Bitcoin as a payment method, not a change to Bitcoin’s network, supply, regulation or institutional demand.
In the short term, traders may monitor wallets linked to Rhysida, particularly if blockchain analysts identify ransom movements. Confirmed transfers to exchanges could create temporary selling pressure, while a seizure or recovery of funds could reinforce confidence in blockchain tracing. Broader headlines about ransomware may also produce brief negative sentiment toward crypto, although similar incidents have historically had limited lasting impact on Bitcoin prices.
Over the longer term, repeated ransomware cases could encourage stricter compliance rules, transaction monitoring and sanctions targeting illicit crypto wallets. Those measures may raise operational costs for exchanges and privacy-focused services, but they are unlikely to materially change Bitcoin’s long-term market structure. The case could also support the view that public blockchains enable law-enforcement tracing, partly offsetting concerns about crypto being used for anonymous criminal payments. Traders should therefore focus on verified wallet activity, official investigation updates and any regulatory response rather than the unverified ransom claim itself.