U.S. Recovers $2.3 Million Ransom Paid to Colonial Pipeline Hackers

In a major blow, the U.S. Department of Justice on Monday said
it has recovered 63.7 bitcoins (currently valued at $2.3 million)
paid by Colonial Pipeline to the DarkSide ransomware extortionists
on May 8, pursuant to a seizure warrant that was authorized by the
Northern District of California.

The ransomware attack^[1]
also hobbled the pipeline company’s fuel supply, prompting the
government to issue an emergency declaration^[2], even as the company
shelled out a ransom amount of approximately 75 bitcoins^[3]
($4.4 million as of May 8) to regain access to its systems.

A week after the highly publicized incident, the
ransomware-as-a-service syndicate disbanded with a May 14 farewell
message to affiliates, stating that its internet servers and
cryptocurrency stash were seized^[4]
by unknown law enforcement entities. While DarkSide’s announcement
was perceived as an exit scam, the latest move from DoJ confirms
earlier speculations of law enforcement involvement.

Stating that “ransom payments are the fuel that propels the
digital extortion engine,” the DoJ said it followed the money trails^[5] left by the DarkSide
gang to a specific bitcoin address by reviewing the Bitcoin public
ledger, to which the proceeds of the ransom payment were
transferred, ultimately using the “private
key^[6]” the FBI had in its
possession to access crypto assets stored in the wallet in
question.

“There is no place beyond the reach of the FBI to conceal
illicit funds that will prevent us from imposing risk and
consequences upon malicious cyber actors,” said^[7]
FBI Deputy Director Paul Abbate. “We will continue to use all of
our available resources and leverage our domestic and international
partnerships to disrupt ransomware attacks and protect our private
sector partners and the American public.”

It’s not immediately clear how the intelligence agency came to
have the private key, but DarkSide had previously claimed to have
lost access to one of their payment servers.

Blockchain analytics firm Elliptic, which had identified the
bitcoin transaction representing the Colonial Pipeline ransom
payment, said the seized bitcoins represent 85% of the total ransom
amount which is typically reserved for affiliates, with the rest
going to the DarkSide developers. The Bitcoin address was emptied
at around 1:40 p.m. ET on Monday, Dr. Tom Robinson, Elliptic’s
co-founder and chief scientist, said^[8].

If anything, the seizure marks a first-of-its-kind orchestrated
effort led by the DoJ’s newly formed Ransomware and Digital
Extortion Task Force to confiscate a cybercriminal cartel’s illicit
profits by breaking into its bitcoin wallet.

“Holding cyber criminals accountable and disrupting the
ecosystem that allows them to operate is the best way to deter and
defend against future attacks of this nature,” Colonial Pipeline
CEO Joseph Blount said^[9]
in the statement. “The private sector also has an equally important
role to play and we must continue to take cyber threats seriously
and invest accordingly to harden our defenses.”