Researchers tracked 61 Bitcoin wallets attributed to the Ryuk malware enterprise. They found that Ryuk operators primarily use two legitimate cryptocurrency exchanges to cash out the Bitcoin from paying victims as fiat money. The money then goes through a laundering service before getting to legitimate exchanges or being used to pay for criminal services on underground markets. The largest payment confirmed to these attackers was 2,200 BTC, which converted to $34 million at the time. The average ransom value received by the group is 48 bitcoins, the researchers said in their report.
Source: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-bitcoin-wallets-point-to-150-million-operation/