Feds arrest couple, seize $3.6B in hacked Bitcoin funds • Hacker News Board

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#81

Post by tannhauser23 » Tue, Feb 08, 2022, 5:44 PM UTC

duxup wrote: post #74

caseysoftware wrote: post #65

I'm sitting here trying to understand their mindset. They had to know what kind of scrutiny would be on those coins forever. At the time of the theft, the coins are worth $100M+ and they can't touch them. Even worse, anything they do with them will be monitored, researched, dug into, and everything else from law enforcement, amateur detectives, and every major tech+crime group. Fast forward to now and the coins are w…

I was wondering about this. I would think the most obvious path would be to find some other criminals (now you've got new risks) who don't care about the provenance of the coins, will pay cash for some coins at a discount, and you somehow launder that cash.... Could at least get a couple bucks from it, possibly.

There are "local bitcoin trading" groups that do exactly this - convert bitcoin to cash at a discount. But obviously you can't do this for billions of dollars and you expose yourself to personal monitoring and capture.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#82

Post by shiado » Tue, Feb 08, 2022, 5:44 PM UTC

It never ceases to amaze me how incompetent some high profile criminals are. Encrypting a file is simply too difficult apparently. The entire purpose of crypto is that the exclusive holder of a private key cannot have funds seized. A 15 year old kid probably has better opsec with their crypto wallets than these people. Astonishing really.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#83

Post by X6S1x6Okd1st » Tue, Feb 08, 2022, 5:44 PM UTC

AlexanderTheGr8 wrote: post #64

> “After the execution of court-authorized search warrants of online accounts controlled by Lichtenstein and Morgan, special agents obtained access to files within an online account controlled by Lichtenstein,” the press release said. “Those files contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and rec…

There's a lot of evidence in the statement_of_facts however it's unclear how much of it can only be reconstructed with the private keys. Interested parties should really look to what was known to grant the search warrant.

https://www.justice.gov/opa/press-release/file/1470186/downl...

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#84

Post by lbriner » Tue, Feb 08, 2022, 5:44 PM UTC

Serious question though, we live in a time when a mere mortal is able to carry out an enormous financial crime, whose knock-on effects could be enormous to millions of people directly and indirectly. How do you put a relevant sentence on that? Even whole-life in prison doesn't really make up for the number of people who might be affected by it.

note, I didn't read the article, it was just the headline that made me ask the question so possibly slightly off-topic.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#85

Post by rjbwork » Tue, Feb 08, 2022, 5:45 PM UTC

duxup wrote: post #68

AlexanderTheGr8 wrote: post #64

> “After the execution of court-authorized search warrants of online accounts controlled by Lichtenstein and Morgan, special agents obtained access to files within an online account controlled by Lichtenstein,” the press release said. “Those files contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and rec…

Well you don't want to lose those keys ... there is a bit of a conundrum there (granted you don't have to do it the way they did either). As far as how exactly they got caught, there was a reward offered by the company it was stolen from. It may have been someone tipped the feds off for the reward.

I'm not invested in crypto or really at all interested in it. That said, my mentor seems pretty excited about it and is pretty heavily invested as of the past few months. I advised him to do something like https://en.wikipedia.org/wiki/Shamir's_Secret_Sharing and distribute it across a wide number of storage mechanisms, physical, digital, and custodial. For instance, in google drive, in drop box, in a bank safety deposit box, engraved in a gold bar buried in your yard, in your house safe, etc.

Why anyone with a significant amount of crypto assets isn't going to insane extremes in terms of secrecy and durability is beyond me.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#86

Post by AlexanderTheGr8 » Tue, Feb 08, 2022, 5:45 PM UTC

loceng wrote: post #14

I ask this every so often during threads regarding stolen cryptocurrency: Is there any solution yet to preventing stolen cryptocurrency funds from being spent? Isn't the only solution to have a central database and require laws to require every transaction to be pre-checked to see if it's stolen funds or not? And not only that, the centralized system will have to be constantly keeping track of wallet mixing to see wh…

Is there a need for an algorithm to efficiently check if a transaction is in a particular list?

I have a fairly good idea on how to make a very efficient algorithm for this. If there is a need for it, I would love to help in any way I can.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#87

Post by duxup » Tue, Feb 08, 2022, 5:45 PM UTC

sschueller wrote: post #38

danso wrote: post #3

The statement of facts is linked to from the press release, and describes generally how the Feds were able to trace the stolen funds (they found a file listing private keys, after gaining access to the suspect's cloud storage) https://www.justice.gov/opa/press-release/file/1470186/downl... > The 2017 transfers notwithstanding, the majority of the stolen funds remained in Wallet 1CGA4s from August 2016 until January 3…

A little thin on details. I wonder if they tracked down IP addresses at the exchanges.

There was a reward offered by Bitfinex. It's possible someone simply dropped a dime on these guys and after that everything fell into place.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#88

Post by ngokevin » Tue, Feb 08, 2022, 5:47 PM UTC

sschueller wrote: post #46

ngokevin wrote: post #33

Earlier quoted context omitted.

From the article, they aren't necessarily being charged with the hack itself

So they where hired to launder the money? Wouldn't the FBI try to make a deal to catch the people who executed the hack?

Just saying in the article that's what they're being legally charged for, and that already comes with hefty maximum sentences.

They are clearly associated with the hack, but that can be tacked on after further investigation and cross-examination. The money laundering is an easier opening target.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#89

Post by knownjorbist » Tue, Feb 08, 2022, 5:47 PM UTC

openhandcrimp wrote: post #32

It seems that Tornado Cash ( https://tornado.cash/ ) could have been used to launder the funds. I wonder if: - Laundering happened before Tornado Cash existed, so Tornado Cash was not used - They used something like Tornado Cash, but the funds were still traceable

Another possibility is Ironfish(https://ironfish.network/), but I don't know how much liquidity there exists in either of these. I don't think you could launder/hide $4bn through either of these. Perhaps slowly over a long period of time.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#90

Post by gruez » Tue, Feb 08, 2022, 5:47 PM UTC

14 wrote: post #34

raverbashing wrote: post #8

Earlier quoted context omitted.

A fancy (or even basic) dictionary attack has a very high chance of working.

Random example but my passwords look something like chOf$Tyl83fhn@54R. I keep them written down because they are hard to remember. My threat model is no one. Seems so amateur to use a simple password that could be brute forced. Especially with so much on the line.

>Seems so amateur to use a simple password that could be brute forced. Especially with so much on the line.

There's selection bias going on because only dumb criminals get caught, so you only hear about the dumb opsec practices of those criminals. Conversely, you'll never hear about the opsec practices of that professional crew with perfect opsec that hacked an exchange/difi contract and disappeared into thin air.