Live data from Hacker News

DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

justice.gov

21–30 of 296 posts

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#21
post #14

Earlier quoted context omitted.

A private key is not needed if the funds are on an exchange. Apparently there is a warrant to seize property on Northern California so I guess it might be Coinbase. And yeah... if the crackers sent the funds to an exchange they were comically dumb.

The press release specifically mentions that the cryptocurrency was seized through FBI having posession of the private key.

Did the crackers surrendered the private keys? And if so why was a warrant issued?

https://www.elliptic.co/hs-fs/hubfs/Screenshot%202021-06-07%...

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#22
post #6
post #4

There are more technical details in the linked affidavit (page 6 and 7): https://www.justice.gov/opa/press-release/file/1402056/downl... They kept following transactions on the blockchain, but it's not clear how the private key became in the posession of the FBI.

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.

The FBI doesn't need the VPS to be in the United States for that

The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters

FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances.

Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain.

[1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012)

but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#23

LOL... I simply don't believe any of these press releases. For all we know, the government negotiated a deal with the cyber-attackers to create this press release as a way to try to thwart future attacks. Seriously wouldn't put it past them one bit.

Do you have a specific reason to not believe it?

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#24
This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There needs to be a serious audit of CME derivatives trading. There will come a day when some oil futures trader pays a ransomware group or an employee at a pipeline company and makes billions.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#25
post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

No, they’re not elite, they’re just script kiddies with a payout mechanism.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#27
post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

"Russians did it!" - the modern Bugs Bunny

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#28
post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

I was reading the article in utter confusion too. I personally think it's the authorities trying to save face, as I don't think even a computer-literate high school kid would make these mistakes.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#29
post #8

The most interesting and unknown question is how the DOJ/FBI came to be in possession of the private key.

If they carried out the attack they would have had the private key in their possession.

gigglesnort

or by "in possession of the private key" they mean "Coinbase generated the private key earlier and just gave it to the FBI"

the amateur hour doesn't stop there though

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#30

LOL... I simply don't believe any of these press releases. For all we know, the government negotiated a deal with the cyber-attackers to create this press release as a way to try to thwart future attacks. Seriously wouldn't put it past them one bit.

Or, maybe something like the FBI knows who's behind it through other means (friendly foreign government, etc.). They contact them and let them know they are going to prosecute to the full extent of the law, long prison sentences. The hackers offer to give the money back in exchange for not being prosecuted, FBI agrees, private key is supplied by hackers.

It's possible they underestimated how serious things would get and got cold feet.

Post reply on HN