Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

justice.gov

Post reply on HN
Print view View original

161–170 of 296 posts

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#161

Post by Scoundreller »

kart23 wrote: post #153
shiado wrote: post #149

Here is the FBI controlled address, presumably a Coinbase deposit address https://www.blockchain.com/btc/address/bc1qq2euq8pw950klpjca... Which got funds from https://www.blockchain.com/btc/address/3EYkxQSUv2KcuRTnHQA8t... This is the wallet explorer used for clustering the wallet https://www.walletexplorer.com/wallet/123085fff68ee703/addre... I have no idea why they censored out parts of the bitcoin addresses as goo…

I'm confused. That account had a little over *69 btc this morning, yet the FBI affidavit said it only has 63.7 btc. What's up with the disparity? https://www.justice.gov/opa/press-release/file/1402056/downl... *edited

See point 31. At some point, 11btc went to one place and 64 went to another. I guess the 11 is still outstanding from the FBI.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#163

Post by kart23 »

shiado wrote: post #159
kart23 wrote: post #153

Earlier quoted context omitted.

I'm confused. That account had a little over *69 btc this morning, yet the FBI affidavit said it only has 63.7 btc. What's up with the disparity? https://www.justice.gov/opa/press-release/file/1402056/downl... *edited

They only seized 69.6 as that's what was transferred to an exchange. It's interesting they split the resulting funds into two addresses. One to presumably return to who paid the ransom and the rest which would be held until whoever is indicted can prove they are not proceeds of crime (lol good luck).

oops, you're right, I misinterpreted the 'total received' line

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#164

Post by belltaco »

csomar wrote: post #118
sneak wrote: post #39

Earlier quoted context omitted.

As someone who has been on the receiving end of federal seizure orders for cryptocurrency private keys, they were in my case satisfied by publishing a transfer (signature) to a USG address, not actual disclosure of private key material, despite that being explicitly stated in the order.

What's a USG address?

USG =US Govt.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#165

Post by Scoundreller »

shiado wrote: post #159
kart23 wrote: post #153

Earlier quoted context omitted.

I'm confused. That account had a little over *69 btc this morning, yet the FBI affidavit said it only has 63.7 btc. What's up with the disparity? https://www.justice.gov/opa/press-release/file/1402056/downl... *edited

They only seized 69.6 as that's what was transferred to an exchange. It's interesting they split the resulting funds into two addresses. One to presumably return to who paid the ransom and the rest which would be held until whoever is indicted can prove they are not proceeds of crime (lol good luck).

You can see the split here: https://www.blockchain.com/btc/address/bc1qu57hnxf0c65fsdd5k...

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#166

Post by mike00632 »

acdha wrote: post #122
TZubiri wrote: post #93

Earlier quoted context omitted.

Why not? Why would you assume an attacker uses all of the best cloaking tactics? This doesn't seem like a complex attack at all: monitor common 0 day vuln feeds, attack, install off the shelf ransomware sold by 5$. It might as well have been a script kiddie.

That’s my prediction: these guys are like bike thieves who found out the hard way that they just stole a bike belonging to the police chief and so it’s actually being investigated rather than written off. I don’t think they were remotely prepared for this level of scrutiny.

My thoughts exactly. Isn't the tactic to phish multiple potential victims and then they just get email responses from the victims whose data was caught? From the attackers' perspective they could have accidentally made a big catch instead of "targeted critical national infrastructure".

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#167

Post by tacostakohashi »

t0mbstone wrote: post #156
shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

The reason why this story doesn't make sense is because it's most likely a lie. Think about it for a second. If they wanted to discourage copycat criminals, the easiest way to do it would be to claim they seized the crypto, right? But what proof do we have that the feds actually seized anything? Is the bitcoin transaction publicly listed anywhere where we can audit what happened? And even if you see the coins were mo…

> what proof do we have that the feds actually seized anything?

I'm sure the feds will sell the bitcoin in the fullness of time, like this:

https://www.usmarshals.gov/assets/2020/febbitcoinauction/

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#168

Post by acdha »

paulpauper wrote: post #138
colechristensen wrote: post #84

Earlier quoted context omitted.

People overestimate criminals. The ones that get caught, especially. What would you do if you were a foreign intelligence service? Participate in attacks yourself? No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idi…

hacker gangs can make tens of millions dollars. No security consultant makes that much.

Gangs are multiple people, they have higher expenses (can’t go to a normal bank, have to pay off local police, etc.), and the long-term prospects are risky so they need to get rich and find safe places to store the money after laundering it. Plus every so often you get on the wrong side of someone nasty and end up involved in something much riskier or dead.

Even if you’re completely amoral, getting a hefty paycheck, 401k, etc. is going to be appealing to most people with that skill level. It’s not a coincidence that a lot of this happens in places where people have poor career options which makes that more appealing.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#169

Post by fomine3 »

tracedddd wrote: post #133
edgyquant wrote: post #104

Earlier quoted context omitted.

I don’t think it’s an understatement to say that their reach kind of is. If sanctioned the US government could almost certainly 51% attack any given crypto and redirect funds to whoever they want. This isn’t what happened but it’s laughable to think the US government isn’t capable of tracking down the account and seizing coins.

I doubt they could 51% Bitcoin with any sort of haste. Perhaps with a few year plan. Simply put it’s a procurement issue. There are limited ASICS and they are distributed among many operators, mostly foreign. There aren’t massive ASIC stockpiles in the US just waiting to be purchased. A government 51% attack would probably involve doing a private chip run.

Also even if 51% attack is succeeded, then BTC price would crash so victim can't collect original $.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#170

Post by Scoundreller »

vmception wrote: post #22
ianhawes wrote: post #6

Earlier quoted context omitted.

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.

The FBI doesn't need the VPS to be in the United States for that The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private…

The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.
Post reply on HN