| DigitalMint | |
|---|---|
| DigitalMint (2015–present); Chaintrax Cyber (2026–present) | |
| Type | Private (limited liability company) |
| Industry | Ransomware negotiation and ransom payment; cryptocurrency; ransom financing |
| Founded | 2014, Chicago, Illinois |
| Founders | Marc Grens; Jonathan Solomon |
| Headquarters | 301 W. Grand Ave., Suite 383, Chicago, Illinois |
| Key people | Jonathan Solomon (CEO); Marc Grens (President); Don Wyper (COO; oversees "every negotiation engagement") |
| Products | Formerly: bitcoin ATM network (c. 1,400 locations; operated 2014–2024; discontinued citing "moral" issues) |
| Services | Ransomware negotiation; ransom payment facilitation; payment financing |
| Parent | Red Leaf Chicago, LLC |
| Website | digitalmint chaintrax |
DigitalMint, which since late 2026 has also operated as Chaintrax Cyber, is an American ransomware-payment and cryptocurrency company in Chicago whose negotiators were convicted in 2026 of conspiring with the BlackCat (ALPHV) ransomware gang against the company's own clients. It is a trade name of Red Leaf Chicago, LLC, which negotiates and makes ransom payments on behalf of ransomware victims, and offers financing for them. Founded in 2014 by Marc Grens and Jonathan Solomon, the company built and operated one of the largest bitcoin ATM networks in the United States — a network Grens later said the company knew, by 2016, was used overwhelmingly by fraud victims; it eventually closed the network in 2024. Since 2017 it has both negotiated with ransomware gangs and also bought and transmitted cryptocurrency used to make ransom payments, charging fees that, according to its California disclosure statement, may be determined by "the size of the settlement payment" and may include a "commission, spread, markup, or other compensation."
In 2026 former DigitalMint managing director of cyber incident response Angelo Martino admitted selling the secret negotiating positions and insurance limits of the firm's clients to the BlackCat attackers he was supposedly negotiating against, in what The Insurer described as "corrupting negotiations to extort $75 million"; the company's clients in five charged cases paid about $75 million in ransoms, and DigitalMint, where "only three executive founders" were "authorized to initiate wire transfers or cryptocurrency transactions," processed the payments. A second DigitalMint negotiator, Kevin Tyler Martin, deployed BlackCat ransomware with Martino and a third man. Martino was sentenced to nearly six years in prison and Martin to four. DigitalMint has said its internal controls "did not detect any anomalous behavior" in Martino's cases. It has repeatedly declined to say whether it refunded fees it charged for processing payments on the corrupted negotiations; its Terms of Service say that "all fees are non-refundable, unless otherwise explicitly agreed to in writing." A victim's lawyer told the court that neither the defendants "nor their employers" had offered to repay "one dime."
In 2026 the company began operating as Chaintrax Cyber. The Chicago Sun-Times reported in October 2026 that DigitalMint "looks to have relaunched" as Chaintrax Cyber "in the wake of a scandal involving two former employees," with the same executives. Red Leaf Chicago registered the assumed name "Chaintrax" with the Illinois Secretary of State the day after Martino was sentenced. In October 2026, after the arrest of another prominent ransomware negotiator at a separate firm, technology publications cited the DigitalMint case as the precedent for criminal charges against ransomware negotiators.
Red Leaf Chicago, LLC was organized in Illinois on October 13, 2014, and registered the assumed name "Digital Mint" in December 2015. Grens has described DigitalMint as "one of the biggest players" and "one of the first movers" in the cryptocurrency ATM industry; at its peak the network comprised roughly 1,400 bitcoin ATM and teller locations in 35 states. Of that industry, Grens has said: "The players, executive founders, just we're kind of in on it on how dirty the industry is, allowing scam victimization."
The network became a channel for fraud. A January 2025 Chicago Sun-Times investigation described the city's cryptocurrency ATMs as "magnets for drug-dealing and scams on older adults." Grens told the Sun-Times that DigitalMint had discovered by 2016 that most of its customers making large purchases were scam victims, and told Wisconsin Watch that an internal investigation had found nearly all customers making transactions of $1,000 or more were victims of fraud; DigitalMint shut down the kiosks eight years later, in 2024. Grens said of the decision, "The moral of the story is, if you do the right thing this industry wouldn't exist," and "I don't want to build something dirty."
DigitalMint began negotiating with ransomware groups and facilitating ransom payments in 2017. Unlike negotiators that only advise victims, DigitalMint both negotiates with the attackers and executes the payments: CNBC reported in 2021 that the company could complete a ransom payment within "30 to 60 minutes from initial contact," and the company said it had facilitated more than $100 million in ransomware settlements since January 2020, with a median payment of $800,000. By 2025 it said it had conducted more than 2,000 ransomware negotiations. Red Leaf Chicago is registered with the Financial Crimes Enforcement Network as a money services business under the DigitalMint name.
DigitalMint's fees are set by contract with each client. Its California Digital Financial Asset Disclosure Statement, published on digitalmint.io under California Financial Code section 3501, states that "fees may be determined by a combination of factors such as the size of the settlement payment, the virtual currency required, liquidity or any financing or pre-funding payments," and that "DigitalMint may include its commission, spread, markup, or other compensation in the price." Its Terms of Service, which apply to every Red Leaf Chicago business alias, provide that "all fees are non-refundable, unless otherwise explicitly agreed to in writing by the Company." The company retains a percentage of each ransom it transmits as a commission.
In January 2021 Grens advised ransomware victims who hire cyber incident response firms to "ensure any conflicts of interest are mitigated or fully disclosed," and to "keep their services separate from a cryptocurrency ransomware settlement provider"; in April 2026 DigitalMint described itself as handling "incident response, ransomware negotiation, and cryptocurrency settlement in one place."
Critics in the industry have argued that combining negotiation with payment for a fee tied to the ransom creates a conflict of interest. Bill Siegel, chief executive of the rival firm Coveware, said that "if an intermediary earns a large fixed percentage of a ransom, objective advice is not going to follow." Mark Camillo, chief executive of the insurer-backed group CyberAcuView, said that "many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed. This makes no sense if they are also the negotiator." The company has pushed back, saying it "firmly reject[s] the notion that our business model creates misaligned incentives."
According to his plea agreement, while negotiating for five DigitalMint clients attacked by BlackCat in 2023 — a nonprofit, a financial-services company, a hospitality company, a retailer and a medical company — Martino passed their confidential negotiating strategies and insurance limits to the attackers, who paid him for the information. In one exchange he told the attackers to "keep denying our offers and i will let you know once i find out the max the[y] want to pay"; a $1 million offer became a payment of nearly $16.5 million. The five victims paid ransoms totaling about $75.3 million, including individual payments of $26.8 million and $25.7 million, all of them transmitted through DigitalMint, where by the company's account "only three executive founders" could initiate cryptocurrency transactions. Court documents also accused Martino of conducting at least 10 ransomware attacks with Martin and Goldberg, and the Sun-Times later reported that his role in the scheme was to identify victims, extract data from their computers and lock their networks.
On April 3, 2025, federal agents searched Martino's Florida home and the Department of Justice notified DigitalMint that he was under investigation. The company has given differing accounts of what it did next: it told CyberScoop that it suspended his access that day and fired him the next; it told The Record that it fired him in June; and Grens told Bloomberg News in July 2025 that the employee had been "immediately terminated." Bloomberg also reported that some law firms and insurers had warned clients against hiring DigitalMint, and quoted Grens saying the company was "not the target" of the investigation.
Martino was charged by information in February 2026 and released on bond on condition that he do no work in the cybersecurity industry. He pleaded guilty on April 14, 2026, to conspiracy to interfere with commerce by extortion. On July 9, 2026, he was sentenced to 70 months in prison; law enforcement had seized about $10 million of his assets, and Bloomberg later reported that court records showed he had used the proceeds to buy two Florida homes, a boat and vehicles. A hearing to determine restitution, originally set for September 17, was rescheduled to November 12, 2026.
In October 2025 a federal grand jury in Miami indicted a second DigitalMint negotiator, Kevin Tyler Martin, and Ryan Clifford Goldberg, an incident-response manager at the Israeli security firm Sygnia, on charges that between April and November 2023 they had deployed BlackCat ransomware against at least five U.S. companies and extracted about $1.2 million from a Florida medical-device firm; the indictment, returned under seal on October 2, was made public in early November 2025. According to the Justice Department, DigitalMint hired Martin as Martino's co-worker after the conspiracy had begun. The company later said both men had "preexisting relationships relating to their involvement in ransomware-related schemes before joining DigitalMint" — stating the two negotiators were already engaged in ransomware conspiracies when DigitalMint hired them. After Martino's sentencing the company said it had "maintained controls consistent with industry standards, including background checks and compliance procedures." DigitalMint said Martin had been "acting completely outside the scope of his employment" and claimed it was "a cooperating witness in the investigation and not an investigative target." Martin and Goldberg pleaded guilty and were each sentenced to four years in prison on May 1, 2026.
DigitalMint's Terms of Service make all fees non-refundable unless the company agrees otherwise in writing. Processing more than $75 million in ransom payments would have earned DigitalMint, even at modest rates for such cryptocurrency payment execution, at least $2 million in fees and commissions on the five rigged negotiations. Asked in March and July 2026 whether it had refunded the fees charged to its victimized clients, and asked by The Insurer whether it had compensated clients whose payments were inflated, DigitalMint said it was "not able to discuss specific client relationships or fee arrangements due to confidentiality obligations." In a victim impact statement filed in April 2026, counsel for the Florida medical-device company that paid a $1.2 million ransom wrote that the company had "retained supposedly reputable companies to negotiate with the ransomware attackers" only to find that "those companies employed the very Defendants who were holding the company hostage," put its total losses at "closer to $10 million," and said that "neither the Defendants nor their employers ... have offered to repay one dime."
DigitalMint said Martino's conduct had been concealed from it and that it "condemns these individuals' criminal behavior." It said "no organization can completely eliminate insider risk" and that its "internal controls did not detect any anomalous behavior in Martino's negotiations." It said that its payment and negotiation businesses "were kept rigorously compartmentalized." The company said afterward it had begun requiring that all negotiations be conducted on cloud platforms that can be audited and logged, and that chief operating officer Don Wyper would now personally oversee every engagement.
On October 10, 2026, the Chicago Sun-Times reported that DigitalMint's parent "seems to have started another business" as Chaintrax Cyber "in the wake of a scandal involving two former employees," offering the same services under the same executive team; it was "unclear if DigitalMint has plans to rebrand as Chaintrax," and the companies did not respond to requests for comment. A crisis-communications consultant quoted in the story compared the name change to MiniScribe, a disk-drive maker whose fraud became notorious: "MiniScribe is still known here in Colorado as the company that shipped bricks. ... The new name changed the sign on the building. It doesn't immediately change what shows up when people search and it doesn't erase the mental association for customers who were burned."
On July 10, 2026, the day after Martino was sentenced, Red Leaf Chicago registered the assumed name "Chaintrax" with the Illinois Secretary of State. On August 27 — noted by the Sun-Times as "less than two months after" final sentencing — it filed three intent-to-use trademark applications for CHAINTRAX CYBER covering "the negotiation, transaction, and settlement of cryptocurrency payments to resolve ransomware incidents"; it registered "Chaintrax Cyber" on September 2.
The Chaintrax Cyber website describes "12 years of operational experience," identifies the business as a trade name of Red Leaf Chicago, and lists the FinCEN and NMLS registration numbers belonging to DigitalMint. The company's LinkedIn page gives Chaintrax Cyber's founding year as 2026; a podcast episode published September 1 introduced Grens as "President of Chaintrax" and said he had "led Chaintrax for twelve years."
On October 8, 2026, the FBI arrested a prominent Canadian ransomware negotiator and former incident-response executive on extortion charges that news organizations linked to the Bureau's investigation of the ShinyHunters hacking group. Coverage of the arrest cited the DigitalMint case as the precedent. Gizmodo distinguished the charges, writing that "the closer parallel is Angelo Martino, a former DigitalMint ransomware negotiator," whose conviction rested on "the same Hobbs Act statute cited in [the] complaint"; SecureWorld described the DigitalMint precedent as the first criminal case against the ransomware-negotiation industry and the October 8 case as "the second case in a year"; and Dark Reading noted that the man arrested "is not the first ransomware negotiator charged in connection with his work."
Advanced Financing for Ransomware Payments
Assumed names: Digital Mint (December 4, 2015); Chaintrax (July 10, 2026); Chaintrax Cyber (September 2, 2026)
The investigation into Angelo Martino, a former managing director in cyber incident response at Chicago-based DigitalMint, is being led by the DOJ's office in the Southern District of Florida
Angelo Martino, Managing Director, Cyber Incident Response, DigitalMint Cyber
Last Updated: August 25, 2026. Section 2, Fees and Expenses.
Repost of an article written for Cyber Defense Magazine
Repost of an article written for Security Magazine
Founded 2026