US investigators seize nearly 64 bitcoins, valued at ~$2.3M, that Colonial Pipeline had paid in ransom to hackers last month; source says ransom was 75 bitcoin
Law-enforcement officials seize nearly 64 bitcoin of ransom paid after cyberattack led to closure of East Coast fuel conduit Source: U.S. Department of Justice .
Wall Street Journal
Context & Ripple Effects
Colonial Pipeline halted operations after a ransomware attack, with related reporting identifying DarkSide as the gang that stole and encrypted roughly 100GB of data. The seizure turns a payment made during that disruption into a law-enforcement recovery.
The action also coincided with a sharp Bitcoin selloff after news of the recovery, connecting an infrastructure ransomware case to immediate market sensitivity around the traceability of crypto-linked funds.
First-order effects
The U.S. Department of Justice has removed nearly 64 of the 75 bitcoin reportedly paid by Colonial Pipeline from the hackers’ control, substantially reducing the proceeds retained from the attack.
Colonial Pipeline’s ransomware episode now has an enforcement outcome beyond the operational shutdown, while Bitcoin’s price fell more than 7% in related coverage.
Second-order effects
DarkSide and other ransomware operators must account for a higher risk that crypto payments can be identified and seized after a victim pays.
Organizations facing ransomware gain evidence that payment does not necessarily end the financial pursuit of attackers, reinforcing the value of coordinated incident response with law enforcement.
Third-order effects
If recoveries like this become repeatable, ransomware economics shift toward an ecosystem-cyber-defense model in which payment tracing and asset seizure complement prevention and restoration.
Crypto markets may become more sensitive to enforcement actions that demonstrate the ability to disrupt illicit wallets, rather than treating ransomware payments as irretrievable.
The trend: Ransomware response is expanding from restoring disrupted victims to pursuing attackers’ crypto proceeds through coordinated cyber and financial enforcement.
The federal government says it seized by court order $2.3 million of the ransom paid by Colonial Pipeline. The FBI had the password to the hackers' Bitcoin account, @PeteWilliamsNBC reports. “Today we turned the tables on DarkSide,” says Deputy Attorney General Lisa Monaco.
Per followup FBI SF press call: agency is deliberately being vague on how they got access to that DarkSide wallet bc they wanna avoid tipping off other hackers. But it's replicable, agent said. Seemed to push against theory they got caught using Coinbase. https://www.nbcnews.com/…
From the FBI affidavit in the Colonial Pipeline ransomware seizure: “Systems that played a role in Victim X's business were also affected, which led Victim X to take portions of its critical infrastructure out of operation.” https://storage.courtlistener.com/ ... https://twitter.…
64 of 75 bitcoin from Colonial Pipeline ransomware recovered by law enforcement. It's not completely anonymous and untrackable. https://www.wsj.com/...
Eagerly awaiting the backstory of how the Feds tracked the Bitcoin ransom in the Colonial Pipeline hack and seized it from the bad guys' digital wallet. https://www.wsj.com/...
So Russian hackers were intelligent enough to take down the largest oil pipeline on the east coast, but dumb enough to send their bitcoin to a custodial wallet in California? 🤔🤔🤔 https://www.wsj.com/...
Full story here: https://www.nytimes.com/... One note: The 63.7 BTC removed appears to represent the DarkSide affiliate's share of the ransom payout, which was moved from an affiliate's wallet at 1:40ET today. (Hence why the funds removed were 63 Bitcoin versus the original 75 BT…
Here's a perfect example of the confusion. Why do you need a court order if you have the password to their wallet? The reverse is also true. If the bitcoin was transferred to a custodial wallet, you dont need the password (keys). https://twitter.com/...
I don't know if it's been answered yet, but do all these dollar numbers take into account the fluctuating value of bitcoin over recent weeks? How much were today's bitcoins worth on the date of payment? https://twitter.com/...
In the minds of US law-enforcement and American economic policy planners, bitcoin is increasingly being viewed as purely a tool of criminality. Too soon to know if that view will extend to other crypto. https://www.cnbc.com/...