IT Admin holds his employer hostage

It sounds like he was attempting to make it look like a ransomware attack. On the surface, as a lay person it might seem like the perfect crime since tens of millions in crypto get sent off to Slavic countries every year, never to be seen again. The insurance companies and even the FBI throw their hands up and say "nothing we can do". The problem is that white collar crime leaves a lot of evidence. Even if the digital forensics didn't give him away, the other half of being a criminal is a way of turning your ill gotten gains into cash you can spend. Crypto forensics is a maturing field and AI is making it that much harder to hide evidence of your crimes on the blockchain. KYC laws are also getting enforced much harder so even if you have a bunch of crypto sitting in a wallet you control, getting someone to swap that for an asset you can readily spend is going to be hard. Oh you found a guy who will swap you a suitcase full of cash money for your internet money? Cool, what are you going to do with even just a million dollars in cash. Just take it down to the local bank branch and tell then your rich uncle died and just left you a pile of cash? This insider ransomware scheme that is blamed on faceless Russians is one that could be pulled off and be "the perfect crime" in that the people who lost the money would forget about it and stop chasing you. It would take a tremendous amount of planning and backstopping and even then I'd be afraid I'd do something stupid like login to an admin panel without my VPN on or something but it could totally be done and I'd be surprised if one day down the road we didn't find out that at least one of the "Russian" groups was actually run out of a western country.