DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside • Hacker News Board

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#151

Post by icedchai » Tue, Jun 08, 2021, 2:01 AM UTC

rm_-rf_slash wrote: post #136

icedchai wrote: post #94

Earlier quoted context omitted.

Many so called "professionals" are still running operations with 5+ year old distributions that haven't been patched in almost as many years, and servers that people are afraid to reboot. I was once contracted by a company that was literally afraid to have any employees reboot a server because they had no idea how it worked, if it would come back up, and what to do if something didn't restart. They wanted an outside…

Would’ve been a decent opportunity to contract a job paid half up front.

I took the job on the side. It was literally the equivalent of "set up a couple of static web servers with FTP accounts, and move everything over." It was about 8 hours of work and 100 hours of meetings.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#152

Post by wyager » Tue, Jun 08, 2021, 2:14 AM UTC

blhack wrote: post #150

I think that the people here speculating about the FBI and private keys are greatly overestimating the competency of these hackers. While it's possible this it he FBI flexing some muscle that they have a backdoor into bitcoin's hashing algorithm, what seems much more likely (to me) is: There is a more sophisticated hacking group which created this particular ransomware package. They sell this ransomware package to le…

If the FBI has broke any of Secp256k1, SHA256, or RIPE160, (they have not) they’re not going to blow that on a $3M haul.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#153

Post by kart23 » Tue, Jun 08, 2021, 2:16 AM UTC

shiado wrote: post #149

Here is the FBI controlled address, presumably a Coinbase deposit address https://www.blockchain.com/btc/address/bc1qq2euq8pw950klpjca... Which got funds from https://www.blockchain.com/btc/address/3EYkxQSUv2KcuRTnHQA8t... This is the wallet explorer used for clustering the wallet https://www.walletexplorer.com/wallet/123085fff68ee703/addre... I have no idea why they censored out parts of the bitcoin addresses as goo…

I'm confused. That account had a little over *69 btc this morning, yet the FBI affidavit said it only has 63.7 btc.

What's up with the disparity?

https://www.justice.gov/opa/press-release/file/1402056/downl...

*edited

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#154

Post by erentz » Tue, Jun 08, 2021, 2:17 AM UTC

blhack wrote: post #150

I think that the people here speculating about the FBI and private keys are greatly overestimating the competency of these hackers. While it's possible this it he FBI flexing some muscle that they have a backdoor into bitcoin's hashing algorithm, what seems much more likely (to me) is: There is a more sophisticated hacking group which created this particular ransomware package. They sell this ransomware package to le…

I mean we know the hack wasn’t sophisticated at all. It seems to me the hackers are opportunists, scanning for vulnerabilities and weak VPNs. People are confusing grunt work with sophistication. They would’ve used ransomware against any target that they breached that they thought could pay. Too young or too stupid to think through the consequences.

Thread below indicates what happened is they were incredibly naive and eventually used a US exchange wallet. Just script kiddies really.

https://twitter.com/intangiblecoins/status/14020730011899125...

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#155

Post by [deleted] » Tue, Jun 08, 2021, 2:17 AM UTC

shiado wrote: post #149

Here is the FBI controlled address, presumably a Coinbase deposit address https://www.blockchain.com/btc/address/bc1qq2euq8pw950klpjca... Which got funds from https://www.blockchain.com/btc/address/3EYkxQSUv2KcuRTnHQA8t... This is the wallet explorer used for clustering the wallet https://www.walletexplorer.com/wallet/123085fff68ee703/addre... I have no idea why they censored out parts of the bitcoin addresses as goo…

[deleted]

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#156

Post by t0mbstone » Tue, Jun 08, 2021, 2:19 AM UTC

shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

The reason why this story doesn't make sense is because it's most likely a lie.

Think about it for a second.

If they wanted to discourage copycat criminals, the easiest way to do it would be to claim they seized the crypto, right?

But what proof do we have that the feds actually seized anything? Is the bitcoin transaction publicly listed anywhere where we can audit what happened? And even if you see the coins were moved, how do we know it was actually the feds that moved them and not the actual criminals?

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#157

Post by Geee » Tue, Jun 08, 2021, 2:23 AM UTC

Hackers make transactions on clearnet revealing their IP address -> FBI seizes the server.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#158

Post by [deleted] » Tue, Jun 08, 2021, 2:24 AM UTC

shiado wrote: post #149

Here is the FBI controlled address, presumably a Coinbase deposit address https://www.blockchain.com/btc/address/bc1qq2euq8pw950klpjca... Which got funds from https://www.blockchain.com/btc/address/3EYkxQSUv2KcuRTnHQA8t... This is the wallet explorer used for clustering the wallet https://www.walletexplorer.com/wallet/123085fff68ee703/addre... I have no idea why they censored out parts of the bitcoin addresses as goo…

[deleted]

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#159

Post by shiado » Tue, Jun 08, 2021, 2:26 AM UTC

kart23 wrote: post #153

shiado wrote: post #149

Here is the FBI controlled address, presumably a Coinbase deposit address https://www.blockchain.com/btc/address/bc1qq2euq8pw950klpjca... Which got funds from https://www.blockchain.com/btc/address/3EYkxQSUv2KcuRTnHQA8t... This is the wallet explorer used for clustering the wallet https://www.walletexplorer.com/wallet/123085fff68ee703/addre... I have no idea why they censored out parts of the bitcoin addresses as goo…

I'm confused. That account had a little over *69 btc this morning, yet the FBI affidavit said it only has 63.7 btc. What's up with the disparity? https://www.justice.gov/opa/press-release/file/1402056/downl... *edited

They only seized 69.6 as that's what was transferred to an exchange. It's interesting they split the resulting funds into two addresses. One to presumably return to who paid the ransom and the rest which would be held until whoever is indicted can prove they are not proceeds of crime (lol good luck).

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#160

Post by tgsovlerkhgsel » Tue, Jun 08, 2021, 2:27 AM UTC

koheripbal wrote: post #16

ulzeraj wrote: post #14

Earlier quoted context omitted.

A private key is not needed if the funds are on an exchange. Apparently there is a warrant to seize property on Northern California so I guess it might be Coinbase. And yeah... if the crackers sent the funds to an exchange they were comically dumb.

The warrant does not imply that the coins were on an exchange. The warrant only indicates that they needed legal authority to seize coins, wherever they are. It seem more likely that the FBI/NSA had and gained some access to the gang's infrastructure and seized the money. Transmitting ransom money to an exchange without any type of tumbler or atomic swapping, that it's not a realistic scenario. Maybe they tried to us…

> Transmitting ransom money to an exchange without any type of tumbler or atomic swapping, that it's not a realistic scenario.

Maybe not nowadays, but some time ago, after the possibility of tracing transactions was already well known, criminals were still a) first sending all the ransoms they collected directly from the initial ransom address to one address, linking them b) then sending them to their exchange account. No tumbling or obfuscation whatsoever.