extortion for 10 million in bitcoin

[refinement5]

Hello,

How in the world does one hide 10 mil in BTC?!?!
I am mad and i wish that those guys go to jail!

I see some hackers are extorting big companies for large sums.
This got me thinking - if you have a fair amount of crypto, lets say bitcoins, how can you "cash out", but without relying upon exchanges (As most exchanges require KYC nowadays?)
I am asking because I feel both powerless and angry at the same time some cyber criminals, who seem to be able to operate "under the radar".

When I started to use the Internet in 1999 it was a bit like the "wild west" in terms of online payments
Nowadays a lot of things have changed. We literally have bugs with cameras and microphones (a.k.a. smartphones), NSA is tracking our every move, etc.

So how in the world do the bad guys "cash out" when they do such extortion?

Isn't it easy for the FBI / NSA to track down an address that the funds were siphoned to?
I know it is only quasi anonymous.

I mean even if the criminals use only MONERO or ZCASH or SPECTRECOINS i still feel that there should be an EASY way to catch the criminals.

How do they cach out?
My only though on this is -
-"p2p based exchanged"
-"local exchange"
-"hand over BTC on a flash drive for cash"
-OR BE A STATE SPONSORED ACTOR WITH AN UMBRELLA

[petahasher]

Isn't it easy for the FBI / NSA to track down an address that the funds were siphoned to?

I mean even if the criminals use only MONERO or ZCASH or SPECTRECOINS i still feel that there should be an EASY way to catch the criminals.

No, it's not easy to track coins. And even if they did track the coins, it's not easy to trace the owners of the addresses.

Converting to fiat is not difficult. Those coins you mentioned are even more difficult to track, there is no "EASY" way for any of those especially.

[mocacinno]

bitcoin is indeed pseudo-anonymous. If a hacker is payed in bitcoin, about anybody with enough time and willpower would be able to follow the trail of unspent outputs used as input for new transactions.
If the trail would end with a hotwallet belonging to an exchange (or any KYC service), it would take a 3 letter agency just a small amount of time to get the name of whoever exchanged the BTC for fiat.

However, there are tons of ways to break the link... Mixers and coinjoin for example, or exchaning to a high anonimity coin like monero and back to BTC.

The bottom line is: with "normal" coins like bitcoin, litecoin, ETH,... A competent hacker is able to break the link between the stolen funds and the addresses finally holding the stolen funds. An incompetent hacker should get caught (altough i doubt law enforcement has enough knowledge, willpower and time to try to track all funds aquired by illegal activity, so i think even incompetent hackers will get away with their crime most of the time... But that's just my gut feeling after reading the understaffing/underfunding/incompetence of law enforcement in the newspaper).

[refinement5]

thanks for educating me
why are those "mixer" services even legal then....
does not seem that can be used for anything meaningful, other than "cheating the system"

if the FBI has an attorney signed subpoena would the mixer service reveal who mixed what and when

oh let me guess, they are registered in Panama....

i wish those crypto-thieves have accumulated enough money for their hospital bills and lawyers
 

[mocacinno]

thanks for educating me
why are those "mixer" services even legal then....
does not seem that can be used for anything meaningful, other than "cheating the system"

if the FBI has an attorney signed subpoena would the mixer service reveal who mixed what and when

oh let me guess, they are registered in Panama....

i wish those crypto-thieves have accumulated enough money for their hospital bills and lawyers
 

no, mixers are an important part of the crypto ecosystem. They protect me against a $5 wrench attack.
I mix and/or coinjoin allmost all funds i get. I don't want anybody to know how much crypto assets i hold, so if i'm ever doxxed, criminals won't enter my house and demand my private keys... Tip: I don't hold a lot of crypto assets...

Privacy is a human right, and since most "normal" crypto currencies lack a good privacy, a privacy enhancing service should be legal.

You are right tough, most mixers operate completely anonymous so they don't get subpoena's from any law enforcement agency. They're simply not registered businesses. Some are even 100% without a clearnet mirror (only accessible over tor)

[refinement5]

Thanks for all the details!

As far as i have heard even TOR is not completely anonymous.
There are supposedly many rouge nodes operated by agencies and law enforcement.
I once installed it in order to try it out and it was painfully slow. "the price of privacy" I guess.

Many computers (Trusted computing platform) also have beacons and backdoors integrated on a hardware level.
Canvas fingerprinting and other techniques can be used to ID the exact machine used to access a given website.

So why don't agencies actually raid those useless scumbags who extort hospitals?
Looks like unless the victim is a bank or a "buddy", they let them get extorted.

Some states and universities also recently paid out huge ransoms.

How is that even a thing, i really don't get it, esp if "big brother" is so overseeing and all mighty.
Turns out crooks can still operate in 2020, as if it is 1999.

And you wonder why "normie" people hate on crypto.

[mocacinno]

There were some vulnerabilitys, if a governement agency controlls enough entry and exit nodes, they might be able to find you.
There were also some vulnerabilities in the tor browser, but they're usually patched pretty quick.

That being said: even for a governement agency, it's not as simple as parsing the logs from some of their nodes, decrypting the data, tracing the user, sending a courtorder to the isp and drag 100% of the culprits to jail. The whole process relies on luck, a user has to have a circuit where both the entry and exit node were owned by the same governement (and afaik, they use a reputation system), then the user has to send unencrypted data that proves he/she commited a felony, then the user should have used his home pc without VPN and he should be located in a jurisdiction where law enforcement could arrest him/her.

But let's not dig this deep, i think most governements don't care enough, nor have the technical knowhow to go after those ransomware providers. For god's sake, a company that works in the same branche as my company was attacked not so long ago, and they released details: the ransomware providers had a controll and command server hardcoded in their ransomware, they even had a helpdesk that could be reached by mail and phone... No need to go to the darkweb, they were working in plain sight, but still nobody was able to arrest them.

[Hannu]

Isn't it easy for the FBI / NSA to track down an address that the funds were siphoned to?

I mean even if the criminals use only MONERO or ZCASH or SPECTRECOINS i still feel that there should be an EASY way to catch the criminals.

No, it's not easy to track coins. And even if they did track the coins, it's not easy to trace the owners of the addresses.

Converting to fiat is not difficult. Those coins you mentioned are even more difficult to track, there is no "EASY" way for any of those especially.

Yeah, NSA is not a problem but FBI/CIA is? Still planning my large scale mining, 70,2 Million US Dollars is so big sum of money on month, I can buy a townhouse in Finland "New Land" area. Tears on happiness, hope Venture Capital can help. Oh, the day of joy, when you can get to get transportation from the Vuosaari harbor area. Now especially when there are no co-workers places open and jobs, annoying.

[Adriane14]

They are probably disillusioned about money greed take their mind, the soul is rotten enough to even think of that maybe they already sold their soul for temporary happiness. Well, I understand them they are pushed to their limits by this bitter world. A chip installed to every human can solve this anyway but I hope it will be for the good and not for invading our privacy. Bill will make his move now I hope we are really ready for this.

[CristianOff]

Hey there,
I come from a cybersecurity background so I have heard and seen many things
From 1,000 Bitcoins stored on a hard drive (multiple wallets) we were forced to destroy to
$100,000 of Ethereum in a hacker's self developed wallet that only God knows how to open.
I think someone disassembled that wallet so it was not the easiest task to do.

Those people are criminals most of the time but that's expected anyway. The worst case I have seen
was a prostitution ring between Spain and UK where money would be transferred in crypto between
two "almost bosses" which were trading girls. I would call them "lords of the ring".

I believe there is an article in russian that I will try to find. One guy had his own hotel in the middle of nowhere
and claimed to get "thousands of clients" paying in crypto. He was obviously putting his money into the system
making it look like it was legit coming from other wallets. Unfortunately the guy was not smart enough to know
about blockchain analysis so maybe that's why he was caught. It was before the crypto boom but you see that
cryptocurrency is so appealing to criminals.



We get then the real hackers, those masters who are difficult to catch and play every step extremely safe. I don't
know anything about them yet other than:

• They use monero, Zcash or other anonymous cryptocurrency to transfer crypto
• They always obfuscate their IP and leave almost no identity traces
• Something else that if I say, I'm really afraid it will help smaller criminals get away with stealing millions in crypto.
  This thing really helps criminals hiding their identity to making it almost impossible to be caught.
  It goes beyond monero and other safe crypto.

[andulolika]

With localbitcoins you can meet people face 2 face to sell/buy bitcoins for cash, you can just use a modical exchange in the exchange as way to contact the trader then simply deal with him and even avoid fees, but think lbc deserves some fees.
WIth bitcointalk you could buy gold if you announced your request properly and buy in person for btc. Note how btc doesn't need purity test, lol.

[refinement5]

Good point about gold purity test he he!
I know a person who was mining ETH and never gave his details on any KYC exchange, he was dealing on some local market and got his FIAT funds via some app like cashapp or paypal or revolut, but the police shut down this service after about 2 years and froze their assets in bank accounts.
about 75K euros.

PAMP VERISCAN is pretty safe tho.

Also you don't have to physically carry around / move the gold if you know what you are doing.
1 OZ bars are pretty small also, nice price per weight ratio.
However unless your assets values for less than 100 000 euros /usd, it is not worth it to pay rent for a safe.

I am interested in the Russian article, as i know Russian very well.

Thanks for the discussion.
This is not a 1 man operation, it is an organized crime ring.
I asked some security folks and they told me FBI won't care, unless the crypto-theft is for more than 100K. (ic3.gov)
Same goes for Europol. I have alerted all CSIRT and CIRT teams about this, FBI and NSA were also informed.

However 10 mil puts a big target on the scammer's forehead and a lot of agencies will be monitoring for them.
maybe even rouge agents on local p2p markets could turn up for such sums.

[andulolika]

Good point about gold purity test he he!
I know a person who was mining ETH and never gave his details on any KYC exchange, he was dealing on some local market and got his FIAT funds via some app like cashapp or paypal or revolut, but the police shut down this service after about 2 years and froze their assets in bank accounts.
about 75K euros.

PAMP VERISCAN is pretty safe tho.

Also you don't have to physically carry around / move the gold if you know what you are doing.
1 OZ bars are pretty small also, nice price per weight ratio.
However unless your assets values for less than 100 000 euros /usd, it is not worth it to pay rent for a safe.

I am interested in the Russian article, as i know Russian very well.

Thanks for the discussion.
This is not a 1 man operation, it is an organized crime ring.
I asked some security folks and they told me FBI won't care, unless the crypto-theft is for more than 100K. (ic3.gov)
Same goes for Europol. I have alerted all CSIRT and CIRT teams about this, FBI and NSA were also informed.

However 10 mil puts a big target on the scammer's forehead and a lot of agencies will be monitoring for them.
maybe even rouge agents on local p2p markets could turn up for such sums.

I don't like banks and I wouldn't pay them to keep my metals safe, banks used to pay gangsters to steal from people so they have to use banks, I'm more of having a bomb inside my metal stash, you open it wrong you fucked.
10 million isn't really that  much anymore with btc this expensive.

[Hannu]

Good point about gold purity test he he!
I know a person who was mining ETH and never gave his details on any KYC exchange, he was dealing on some local market and got his FIAT funds via some app like cashapp or paypal or revolut, but the police shut down this service after about 2 years and froze their assets in bank accounts.
about 75K euros.

PAMP VERISCAN is pretty safe tho.

Also you don't have to physically carry around / move the gold if you know what you are doing.
1 OZ bars are pretty small also, nice price per weight ratio.
However unless your assets values for less than 100 000 euros /usd, it is not worth it to pay rent for a safe.

I am interested in the Russian article, as i know Russian very well.

Thanks for the discussion.
This is not a 1 man operation, it is an organized crime ring.
I asked some security folks and they told me FBI won't care, unless the crypto-theft is for more than 100K. (ic3.gov)
Same goes for Europol. I have alerted all CSIRT and CIRT teams about this, FBI and NSA were also informed.

However 10 mil puts a big target on the scammer's forehead and a lot of agencies will be monitoring for them.
maybe even rouge agents on local p2p markets could turn up for such sums.

I don't like banks and I wouldn't pay them to keep my metals safe, banks used to pay gangsters to steal from people so they have to use banks, I'm more of having a bomb inside my metal stash, you open it wrong you fucked.
10 million isn't really that  much anymore with btc this expensive.

Its lot of money put Millions of dollars on large scale mining farms. Yeah, I know. BTC I trust.

[Subbir]

We all believe BTC, but it'll be an enormous risk for Bitcoin extortionate traders at the present the condition of the market is far worse that's why it might be better for the bank to suspend the currency without trusting them. there'll be no risk and therefore the price of Bitcoin will rise.

[refinement5]

I would like to believe in BTC but so far usage is limited to scumbags laundering money way less legitimate stuff.
I guess this is the price of freedom or whatever, but I despise the criminals.
And I hate the fact that we live in a digital world where everything is interconnected and etc, and still some retards manage to 'operate under the radar'.

I guess they must enjoy a life time of hiding...

The (supposedly) Russian based hackers from REvil now attacked Donald Trump, Madonna, Lady Gaga and some other famous people with lots of $$.
I think this is the last nail in their coffin.

On a side note - I found some guys doing the opposite -
1. Obtain stolen credit cards from hacker forums or via phishing and smishing.
2. They use the stolen cards to buy "advertisement web traffic" that pays out in BTC for referrals
3. They use the victims cards to buy more and more "ad traffic", until the cards get declined.
4. Add new card, rinse and repeat.
5. The revenue from this "Ad traffic monetization" gets payed out in BTC.
Supposedly "Super secure".
I immediately alerted Interpol, Europol, FBI, NSA and the web hosting firm.

It is schemes like this that give crypto a bad name.
And i doubt will be large scale adoption, until those illicit usage patterns are shut down. 


F the scammers and their "smart ways to make money and cheat the system". I hope they can go to hell. And take the stolen funds with them as well.
(the system is flawed as well - due to QUANTITATIVE EASING.)

Just my 2 cents and my perspective (I am a crypto n00b).

[mocacinno]

I would like to believe in BTC but so far usage is limited to scumbags laundering money (99%) and 1% legitimate stuff.
--snip--

Any statistics to backup this quote?
I have no idear which percentage of the tx are for illegal purposes, but i've been part of the community for ~6 years, and my gut feeling tells me it's the other way around (>95% legit, <5% illegal). But, like your post, i don't have actual statics to back up my claim (just my gut feeling).

The problem here is that the mainstream media only reports on the bad aspects of crypto. They don't care if newegg adopts bitcoin, or if bitgild sells a ton of gold, or if binance exchanges millions from KYC'ed people, if bob pays alice for some artwork, if UNICEF receives tons on crypto donations,... . But if a ransomware asks for $30.000 in btc to unlock a company's server, they jump in and make it look like crypto currencies are only used for illegal purposes.
Mainstream media thrives on negative reports, especially if it marginalizes a small group of people. It's beneficial for them, they can scare people about a technology they do not use, it makes their readers feel good about themselves and scared about crypto, and it makes them buy newspaper subscriptions.

So, if you've only read mainstream media, i'm pretty sure you'll end up with the belief most of cryptospace is filled with illegal things,... But it isn't. These are real people, and just like in "normal" society, most of them are good folks, but a small percentage is bad. It doesn't matter of these bad players use crypto or fiat to conduct bad transactions tough...

As for the fact you reported a scam ring: the only thing i can say is "kudos". It doesn't matter if somebody is stealing fiat, crypto or physical items,... Thiefs and scammers should be stopped and reported, and i sincerely hope they'll catch these guys.

[Ucy]

What 10 million in btc are you referring to? You mean past exchange hacks or the extortion?

Well you can certainly "cash out" without relying on exchanges or things like that but the new owner of the fund (who could be innocent) will still be at risk if it is from crime.
 Fiat currency is not speared from the kind of exchange. A criminal could easily distribute his loot to innocent people in exchange for Gold, cars, lands, etc and resell them.

This shouldn't be an excuse to track innocent people without accountability and rule of Law.
I think with a well built decentralized technology, you could successfully and easily track funds from crime without violating innocent people's privacy/anonymity, or  breaking the Law.
Let's not allow fear and emotions make us give up our freedom and important rights to things we don't really know about

[andulolika]

I would like to believe in BTC but so far usage is limited to scumbags laundering money way less legitimate stuff.

The usage of btc is limitless and vaster than one would expect, it is true that it's filled with scammers but you really wanna claim IRL people is much better?
I'm not sure how you can claim it is limited to laundering money and non-legit stuff but perhaps you should explore a bit more, note that any bussiness that isn't gambling is likely to have a hard time, btc is good to be saved not spent hence the difficulties normal bussinesses are experiencing with crypto, this along how expensive btc getting to move. I could go deeper but I don't feel like writting right now.

If you insist anyhow I will make later a list of legit stuff you can do with crypto, gaming is changing btw .

I guess I will do no harm leaving these three links here:
ageofrust.games
pineapplearcade.net
(these two requiere quite a bit of skill and knowledge)
and this one is quite amazing project I weren't aware what it actually is till few days ago otherwise would of vested heavily in their packages last summer.
https://thesixdragons.com/ and the steam link https://store.steampowered.com/app/749950/The_Six_Dragons/

All these are crypto games and legit usage and the first two games are mostly puzzles that reward btc.