This was an actual Bitcoin transaction to one of the Wannacrypt addresses. Notice the sender addresses. https://blockchain.info/tx/96015c757e440554005965b97349234dcae8d4c0f8cc3410a0743cbcc9bacd6c https://icosahedron.website/media/-ESNlZljtxaNO4ryYEo