TwitterA bomb threat demanding a Bitcoin payment has led to evacuations of businesses, schools and other offices around the country.

A bomb threat email demanding a payment in Bitcoin that appears to have been sent to thousands of companies, schools, hospitals, news organizations government agencies and individuals around the United States has led to dozens of precautionary evacuations.

The Bitcoin scammers began arriving about 1 p.m. Eastern, according to Twitter users who received the notes. The bomb threat demands $20,000 be delivered to a BTC wallet and threatens that explosives will be detonated if that money is not paid. The emails claim that explosives had been planted in the location where the email recipient works by a “mercenary” of the sender. The emails have subjects like “Think twice,” and “Think about how they can help you” and appeared to be robo-generated spam.

According to KOCO-TV, Oklahoma City Police said there is a nationwide investigation into the emails underway. There have been no reports of explosives being found in any of the locations where bomb threat emails were received.

The FBI said in a statement, “We are aware of the recent bomb threats made in cities around the country, and we remain in touch with our law enforcement partners to provide assistance. As always, we encourage the public to remain vigilant and to promptly report suspicious activities which could represent a threat to public safety.”

Here is the text of the email:

Good day. My mercenary has carried the bomb (lead azide) into the building where your business is conducted. My mercenary built the explosive device under my direction. It can be hidden anywhere because of its small size, it is impossible to destroy the supporting building structure by this explosive device, but if it denotates there will be many wounded people.

My recruited person is watching the situation around the building. If he notices any suspicious activity, panic or cops the device will be blown up.

I can call off my man if you make a transfer 20,000 usd is the price for your safety and business. Transfer it to me in Bitcoin and I assure that I have to withdraw my mercenary and the bomb will not detonate. But do not try to deceive me – my guarantee will become valid only after 3 confirmations in blockchain.

It is my Bitcoin address: [redacted]

You have to solve problems with the transaction by the end of the working day, if the working day is over and people start leaving the building the bomb will explode.

Nothing personal this is just a business, if I do not see the bitcoin and a bomb explodes, next time other companies will send me more bitcoins, because it isn’t a one-time action.

I will no longer log into this email, I monitor my wallet every twenty minutes and if I receive the money I will give the command to my man to get away.

If the bomb explodes and the authorities see this email We are not a terrorist society and don’t take responsibility for explosions in other places.

Other versions of the email contained different descriptions of the type of bomb and different BTC wallet addresses. The emails appear to have been sent by fake email addresses or emails hacked and stolen by the scammer.

Here are some of the tweets from recipients of the email threats:

View image on Twitter

Elliott Weir, MBA, CFP®@IIIFinancial

Here’s a new scam to land in my Spam box…a threat to blow up my office building. No, I won’t “tansfer” (sic) “20’000 usd” in Bitcoin. Since I work from home I doubt your “mercenary has carried the bomb…into the building where your business is conducted.”

3

1:14 PM – Dec 13, 2018

See Elliott Weir, MBA, CFP®’s other Tweets

View image on Twitter

Ryanocerous Grant@TheeRyanGrant

So I actually just got a bomb threat in my work email today ordering me to send the person $20,000 via bitcoin or they will blow up my place of work…. 2018 is wild

94

1:35 PM – Dec 13, 2018 · San Francisco, CA

108 people are talking about this

View image on Twitter

Tom Scott✔@tomscott

The Bitcoin-spam-scammers have moved on from fake blackmail threats to fake bomb threats. So far no-one’s paid anything to the address, and I suspect it’ll stay that way.

384

1:23 PM – Dec 13, 2018

158 people are talking about this

View image on Twitter

Lance King@analogfusion

Well, that’s a new one. I just got a random bomb threat via email, demanding bitcoin payment. Since I’m at the coffee shop now, I suppose I’m safe. #ransomemail

3

1:35 PM – Dec 13, 2018

15 people are talking about this

The Massachusetts State Police tweeted, “MSP Fusion Center tracking multiple bomb threats emailed to numerous businesses in the state. MSP Bomb Squad notified and local departments are responding in their communities. Similar threats have been received in other states. We will share more info when available.”

According to Eric Tendian, who tweets about crime in Chicago, at least 12 businesses there have received threats with calls about the email still coming into police.

Eric Tendian@EricTendian

#BREAKING: At least 12 businesses in #Chicago and many across the US are receiving bomb threats via email, most if not all arriving since 12:00pm CST. They demand the recipient send $20,000 in Bitcoin to a certain BTC wallet, otherwise a bomb will explode. #bombthreat

44

2:15 PM – Dec 13, 2018

Twitter Ads info and privacy

103 people are talking about this

The Oklahoma City Police tweeted, “We’re working a number of bomb threat calls in OKC. There have been similar threats called into several locations around the country. No credible threat found at this point. We encourage the public to continue to be vigilant and call with anything suspicious.”

“These are apparently the same email threats that have been going on around the country,” Captain David Mohlis with the Waterloo, Iowa, Police Department told the Waterloo-Cedar Falls Courier after numerous threats were reported there. “The FBI is aware of it and is asking us to obtain the (mailer’s) information that is being sent to these business owners.”

WNDU-TV in Indiana was among the businesses to evacuate:

View image on Twitter

Clifton French✔@CliffFrenchTV

Confirmed: emailed bomb threat to WNDU. Sheriff’s office is sweeping the building. It’s been evacuated. Sheriff tells me the second dog is making a sweep right now.

6

2:21 PM – Dec 13, 2018

See Clifton French’s other Tweets

The News & Observer newspaper in North Carolina also evacuated after an email was received by an employee there:

View image on Twitter

Jonathan M Alexander✔@jonmalexander

Bomb threat at the N&O building. Police are here and we have evacuated .

58

1:30 PM – Dec 13, 2018

142 people are talking about this

Schools, banks, zoos, government offices, medical centers and a wide range of other businesses were also being evacuated:

Kyle Mazza✔@KyleMazzaWUNF

BREAKING: Police investigating bomb threat at Fair Lawn Memorial Middle School in Fair Lawn, NJ

4

2:46 PM – Dec 13, 2018 · Memorial Middle School

See Kyle Mazza’s other Tweets

View image on Twitter

Todd Johnson@SFBizTodd

.@SFPD is shutting off Sansome Street between California and Clay and evacuating Financial District office buildings due to a bomb threat in the area. Bomb squad enroute.

10

7:48 PM – Dec 10, 2018 · San Francisco, CA

See Todd Johnson’s other Tweets

View image on Twitter

Brooke Evans@beevans_

Bomb threat at @wboc. All evacuated. Police on scene.

5

2:45 PM – Dec 13, 2018

See Brooke Evans’s other Tweets

Ron Fisher@FisherSince_82

Johnstown PD sweep the entire block as potential bomb threat is made to @tribunedemocrat.

1:58 PM – Dec 13, 2018 · Central Park

See Ron Fisher’s other Tweets

View image on Twitter

Darrin Keaton@Lawyer_Keaton

Cobb Courthouse evacuation…

1

2:37 PM – Dec 13, 2018

See Darrin Keaton’s other Tweets

The Cedar Rapids Police tweeted, “Several area businesses are receiving what appears to be a robo-email saying there is a bomb threat to their business unless they pay money in Bitcoins. We have found no credible evidence any of these emails are authentic.”

The NYPD said in a statement, “We are currently monitoring multiple bomb threats that have been sent electronically to various locations throughout the city. These threats are also being reported to other locations nationwide and are not considered credible at this time.”

On Twitter, the NYPD added, “Please be advised – there is an email being circulated containing a bomb threat asking for bitcoin payment. While this email has been sent to numerous locations, searches have been conducted and NO DEVICES have been found. At this time, it appears that these threats are meant to cause disruption and/or obtain money. We’ll respond to each call regarding these emails to conduct a search but we wanted to share this information so the credibility of these threats can be assessed as likely NOT CREDIBLE.”

Cybersecurity expert Brian Krebs wrote, “The bitcoin address included in the email was different in each message forwarded to KrebsOnSecurity. In that respect, this scam is reminiscent of the various email sextortion campaigns that went viral earlier this year, which led with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid.”

Krebs added, “I could see this spam campaign being extremely disruptive in the short run. There is little doubt that some businesses receiving this extortion email will treat it as a credible threat. This is exactly what happened today at one of the banks that forwarded me their copy of this email.”

Jason McNew, a Pennsylvania-based security consultant, told Krebs, “There are several serious legal problems with this — people will be calling the police, and they cannot ignore even a known hoax.”