Hackers demand 5 BTC from Kenya president

TLDR

Hackers briefly took over Kenyan President William Rutos official website and demanded 5 Bitcoin as ransom, but authorities say no sensitive data loss is confirmed so far.

1. Attackers defaced the president.go.ke site, demanded 5 BTC, and threatened a data leak if the ransom was not paid.
2. Kenyas ICT Authority and cybercrime unit NC4 are investigating, highlighting how government infrastructure is increasingly targeted with crypto-linked extortion.
3. The case reinforces standard ransomware guidance for everyone using crypto, including never paying ransoms and tightening security around wallets and credentials.

Deep Dive

1. What Happened In Kenya

According to local reporting summarized by a recent crypto security article, hackers briefly disabled and defaced President William Rutos official website, president.go.ke, on 18 July 2026.

They replaced the homepage with derogatory messages and demanded 5 BTC, threatening to leak unspecified data if the ransom was not paid by Saturday evening. Kenyas cabinet secretary for Information, Communications and the Digital Economy said response protocols were activated and public access to the portal was restricted while a forensic investigation began.

Officials stated on X that there was no evidence yet of unauthorized access to sensitive data or data exfiltration, and that wider government systems remain operational, but the site itself stayed offline during remediation.

2. Why Bitcoin Is Used In Ransom

The attackers chose Bitcoin (BTC) for the ransom, which fits a long running pattern in ransomware and extortion. Bitcoin is global, liquid and can be moved quickly without banks, which makes it attractive to criminals.

At the same time, Bitcoin transactions are public and traceable on chain. Recent law enforcement cases show authorities can sometimes follow these flows and seize funds by targeting exchanges, services or off ramps where criminals eventually convert BTC to cash. That traceability is one reason some cyber gangs increasingly experiment with privacy coins or stablecoins instead.

For Kenya, NC4 has already warned that government systems faced billions of digital threats in recent months, and this incident is another example of politically targeted attacks that use crypto as the payment rail.

3. Practical Lessons For Crypto Users

Even though this attack targeted a government website, the mechanics are similar to many ransomware events that hit individuals or businesses. The key principles remain useful for crypto holders.

1. Do not pay ransoms. Payment encourages repeat attacks and does not guarantee data deletion.
2. Harden basic hygiene. Strong unique passwords, multifactor authentication, and limiting which machines hold wallet keys all reduce exposure.
3. Treat urgent messages demanding crypto transfers or security moves as suspect and verify through known, official channels.

For Kenya and other governments building digital services, the incident underlines the need to treat web portals and identity systems as critical infrastructure, with continuous patching, monitoring and incident rehearsals.

Conclusion

The 5 BTC demand tied to the defacement of President Rutos website is a small ransom in dollar terms but a high profile reminder that political and public sector targets are now firmly in the crosshairs of crypto enabled cybercrime. The combination of visible disruption and a Bitcoin payment request highlights both the convenience criminals seek and the forensic trail they leave, making stronger cybersecurity and better on chain investigative capacity central to reducing future risk.