Berlin’s state government refused a 30 Bitcoin ransom, and the hackers behind the attack published 5.7 terabytes of stolen data on the dark web.

The Rhysida ransomware group had opened the auction at 30 BTC. Berlin let the deadline pass instead of paying.

Why the Bitcoin Ransom Demand Failed

Rhysida, a ransomware crew active since 2023, offered the files to the highest bidder. Bidding started at 30 BTC.

Bitcoin (BTC) trades near $79,902 per coin. Therefore, 30 coins come to roughly $2.4 million. Berlin’s Senate Chancellery put the demand at about two million euros.

BTC has added 0.46% today and 24.4% over the past month. That climb raised the dollar value of the demand while the ultimatum ran.

Florian Hauer, the city’s chief digital officer, ruled out any payment.

“The State of Berlin will not give in to blackmail. The safety of the State of Berlin’s staff and the people of Berlin is our top priority.”

The Bitcoin ransom deadline ran out on Friday, September 4. Rhysida published the full dataset that afternoon.

Berlin’s refusal tracks a broader shift. On-chain ransomware payments fell about 8% in 2025, even as claimed attacks rose 50%.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Berlin Counts the Cost of a Dark Web Auction

The attack surfaced on August 14. Berlin then cut two Senate departments from the state network. One covers urban development and housing; the other covers mobility, transport, and the environment.

Housing benefit payments and family support stalled until both departments returned on August 23. Officials have warned that residents’ personal data could be in the leak.

A central crisis unit now reviews the material Rhysida released once the Bitcoin ransom went unpaid. Forensic specialists comb through the files around the clock.

The State Criminal Police Office and Germany’s federal cybersecurity agency lead the investigation. Officials told residents to report fraud or identity theft to police.

Berliners elect a new state parliament on September 20, two weeks after the Bitcoin ransom expired.

Rhysida collected nothing. Berlin has not put a figure on the damage, and the review of the published files continues.

Source: BeInCrypto