Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

justice.gov

Post reply on HN
Print view View original

81–90 of 296 posts

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#81

Post by tiahura »

shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

“I'm supposed to believe some elite Russian hacking group keeps …”

Why not. Remember Elite Russian GRU hackers identified because they all registered their cars with the DMV at the same address? https://www.bellingcat.com/news/uk-and-europe/2020/10/22/rus...

Smart people do dumb things.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#82

Post by rejectedandsad »

koheripbal wrote: post #60
alex_young wrote: post #55

Colonial paid $4.4M in BTC around May 6th. Coindesk shows BTC/USD around $58K on May 6th. FBI recovers $2.3M in BTC today. Current BTC/USD around $34K today. 34 / 58 = .58 4.4 * .58 = 2.552 Looks like they recovered more or less all of it? [1] https://www.coindesk.com/price/bitcoin

Colonial paid 75 BTC, and they recovered 63.7 BTC.

I'm guessing the rest was fees/etc coming out of the crypto tumblers they used?

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#83

Post by rejectedandsad »

labrador wrote: post #67

Don't they mean Putin in an agreement with the Biden administration made Darkside give some money back as a way of easing American public tensions and political fallout ahead of the summit?

If that is what they did, that's a fantastic diplomatic success story

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#84

Post by colechristensen »

shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

People overestimate criminals. The ones that get caught, especially.

What would you do if you were a foreign intelligence service? Participate in attacks yourself?

No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idiots, it makes people think the claims of your connection to the crimes are even less likely.

Tricks and disinformation are the name of the game.

If you actually were elite, you would hide and practice and save your actual actions for critical moments and not show your hand for a few million dollars. Or you'd go into security consulting which is a far safer, more profitable, and overall smarter thing to do.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#85

Post by paulpauper »

ulzeraj wrote: post #14
walrus01 wrote: post #8

The most interesting and unknown question is how the DOJ/FBI came to be in possession of the private key.

A private key is not needed if the funds are on an exchange. Apparently there is a warrant to seize property on Northern California so I guess it might be Coinbase. And yeah... if the crackers sent the funds to an exchange they were comically dumb.

the prefix ix bc1. coinbase does not use this

https://www.blockchain.com/btc/address/bc1qq2euq8pw950klpjca...

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#86

Post by Applejinx »

staticassertion wrote: post #75
lowdest wrote: post #53

Earlier quoted context omitted.

It's also a very old technique to proxy attacks through countries without extradition treaties.

I don't disagree, obviously. But the question here is if it's reasonable to find that hackers in countries that we consider to be political enemies disproportionately are the ones hacking us. There are numerous incentives that, to me, make it not only reasonable but extraordinarily likely.

Plus, recent political history and the kinds of benefits delivered by political actors suggest several things: hacking's taken on a special significance as wielded by state actors, there's a considerable amount of delegation to shall we say less expert practitioners who are only loosely controlled, and there's a great deal of effort put forth to deny ANYTHING of the sort ever goes on, ever ever.

To me all this seems par for the course. There's nothing unusual about any of it. It's what you would expect. It's basically like distributed stochastic terrorism, indirectly/loosely driven by a more capable state actor with specific intent to establish deniability.

Not even plausible deniability. Just some convenient way to say 'Nyet! And we are VERY OFFENDED that you would even suggest such a thing!'.

Just the fortunes of war, really.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#87

Post by koheripbal »

remarkEon wrote: post #34
yamrzou wrote: post #4

There are more technical details in the linked affidavit (page 6 and 7): https://www.justice.gov/opa/press-release/file/1402056/downl... They kept following transactions on the blockchain, but it's not clear how the private key became in the posession of the FBI.

>Based on ... I have probable cause to believe that the aforementioned property may be seized... Forgive me if this is a dumb question; I have not used a blockchain explorer for anything consequential. Isn't that wallet just the last place it ended up? So, you have chain of custody but does that prove that the owner of that wallet is the "target"?

Nope, but the recipient is welcome to come to the US, show up at the FBI and ask for it back.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#88

Post by chii »

colechristensen wrote: post #84
shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

People overestimate criminals. The ones that get caught, especially. What would you do if you were a foreign intelligence service? Participate in attacks yourself? No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idi…

> If you actually were elite

exactly. Look at stuxnet - nobody knew it was an attack until it was over!

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#89

Post by koheripbal »

paxys wrote: post #79

> The Special Prosecutions Section and Asset Forfeiture Unit of the U.S. Attorney’s Office for the Northern District of California is handling the seizure Hah, of course the DoJ office doing bitcoin investigations is in San Francisco. Also interesting that they were able to recover only $2.3M out of the $4.4M paid. I wonder if Colonial Pipeline will ever see this money.

They recovered 63.7 out of 75 BTC. The USD price just changed in the interim.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#90

Post by dheera »

shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

Also, how exactly do you "seize" cryptocurrency without hard forking it?
Post reply on HN