the operators behind the may 2017 global ransomware incident wannacry converted their proceeds into monero. in june, the shadow brokers, the group that leaked the code used in wannacry, started accepting payments in monero.