Tracing ransomware payments in and out of exchange wallets provides law enforcement with vital leads after a phishing attack. This case study details the analysis performed to understand the flow of bitcoin from wallet to wallet across all layers of the world wide web.