Has anybody successfully decrypted their files after paying the WannaCrypt ransom?

Yes, some have apparently gotten their files decrypted after paying the ransom.

We have confirmation that some of the 200+ #WannaCry victims who have paid the ransom have gotten their files back. Still, not recommended.

(tweeted by Mikko Hypponen, CRO at F-Secure, on May 15, 2017)

But there is absolutely no guarantee to get yours decrypted after paying and chances seem to be pretty low, especially since it's not an automated process but requires interaction with a human operator. Security researchers strongly recommend against paying the ransom.


To be frank, the ransom payment is a typical prisoner dilemma. If nobody get the file decrypted (some company will have some security assessment and info sharing policy with authority), it will destroyed ransomware attacker reputation thus destroyed the future "prospect". However, there is chances that ransomwware attacker make blunders.

The issue lies on the encryption key. To maximise the ransom profit, generate a new crypto key every PC is the way to go. However, it will also introduce risk of the crypto key missing in the transition to the bad guys C&C (command and control) server.

So having pre-generate crypto key will guarantee a decryption, but it also means those who pay may "reuse" the decrypt key in many PC.

(update): As suggested by @Josef, the attacker may use an asymmetric key to encrypt am adhoc unique key. I.e. Ransomeware code use a public key to encrypt the adhoc crypto key. This mean either the malware need to send this first level encrypt data back to C&C server. But there is one catch for this mechanism : If the authority block the IP of the C&C, it will "hurts" the syndicate "sales performance"(sarcasm).


Yes, some victims have received the decryption key after paying the ransom. However, due to the scale of the infection and the way the ransomware is coded, it is likely the criminals won't be able to honor decryption requests:

Those meager profits may partly stem from WannaCry barely fulfilling its basic ransom functions, says Matthew Hickey, a researcher at London-based security firm Hacker House. Over the weekend, Hickey dug into WannaCry’s code and found that the malware doesn’t automatically verify that a particular victim has paid the demanded $300 bitcoin ransom by assigning them a unique bitcoin address. Instead, it provides only one of four hardcoded bitcoin addresses, meaning incoming payments don’t have identifying details that could help automate the decryption process. Instead, the criminals themselves have had to figure out which computer to decrypt as ransoms come in, an untenable arrangement given the hundreds of thousands of infected devices. “It really is a manual process at the other end, and someone has to acknowledge and send the key,” says Hickey.

Hickey warns that the setup will inevitably lead to the criminals failing to decrypt computers even after payment. He says he’s already been monitoring one victim who paid more than 12 hours ago and has yet to receive a decryption key. “They’re not really prepared to deal with an outbreak of this scale,” Hickey says.

(Source here. Emphasis mine.)

Note that if your infected machine runs Windows XP, you may be able to recover your files for free. There is a way to fetch the decryption key from RAM, so provided you haven't switched off the machine after the infection, you may be able to get your data back without paying any ransom.
EDIT: good news, this method works also for all Windows version from XP to 7.