When the master or masters of the WannaCry cryptoransomware worm emptied the bitcoin wallets associated with the malware earlier this week, they apparently did so to make future movement of the funds more anonymous. According to researchers at the Italian information security firm Neutrino, the bitcoin were exchanged for XMR, the “untraceable” private digital currency backed by Monero.
On Wednesday, the 52.2 bitcoins in the wallet were drained out over nine transactions, as detected by a bot created by Quartz’s Keith Collins. Neutrino researchers traced the moved bitcoins to wallets associated with Monero.
Monero is a private digital currency that is focused on anonymity. While it is based on blockchain like other cryptocurrencies and uses distributed consensus for all transactions to prevent wallet hacking, it uses “ring signatures”—an anonymous cryptographic signature scheme—to sign transactions. This makes it impossible to tell which parties were involved in a transaction when examining the blockchain itself.