Michele Spagnuolo discusses identifying Bitcoin addresses controlled by the CryptoLocker threat actors and tracing potential ransom payments made to those addresses. Figure 12 graphs the total number of ransoms paid per day (in gray) along with the total value of those payments in U.S. dollars on the day they were received (in blue).
total bitcoins acquired via crytpolocker ramsom = 1,216 total BTC, the vast majority were outside the usa.
http://www.secureworks.com/cyber-thr...er-ransomware/