More than $140,000 (£105,000) in Bitcoin has been paid out by victims of the global WannaCrypt ransomware outbreak from May.
The money was removed from the online wallets at 4am UTC on Thursday.
The Bitcoin activity was noticed by a Twitter bot set up by Quartz journalist Keith Collins.
Status of WannaCrypt wallets:— actual ransom (@actual_ransom) August 3, 2017
52.19666422 BTC ($142,361.51)
338 payments, 0 withdraws
2017-07-24 at 10:07 AM ET
The attack swept across at least 74 countries, and the UK's NHS was forced to turn away patients as a result of the lockdown. FedEx, rail stations, universities and a Spanish national were also clobbered by the attack. Victims were asked to cough up between $300 and $600 to have documents restored.
NHS Digital stopped short of advising health organisations in England not to pay the ransom because it couldn't be certain that all hospitals had backed up patient records.
Quartz speculated that the WannaCrypt bitcoins will be put through a "mixer", with the currency transferred and mixed into a larger series of payments to obscure where it ends up.
"The general consensus among security experts and government agencies is that North Korea was behind the WannaCrypt attack, and that the operation was more political than money-driven," it reported. ®