US charges two Russian crypto hackers

[TravelMug]

US DOJ has filed charges against two Russian hackers in connection of stealing $16 million worth of currency from trading platforms, Poloniex, Binance, and Gemini. The two Russians hackers are:

(1) Danil Potekhin (aka cronuswar)
(2) Dmitrii Karasavidi;

Here is the official court documents: https://www.documentcloud.org/documents/7211805-Potekhin-Superseding-Indictment.html

Washington - Today, in a coordinated action with the U.S. Department of Justice and the U.S. Department of Homeland Security, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two Russian nationals for their involvement in a sophisticated phishing campaign in 2017 and 2018 that targeted customers of two U.S.-based and one foreign-based virtual asset service providers. American citizens and businesses were among the victims of this malicious cyber-enabled activity, which resulted in combined losses of at least $16.8 million.

“The individuals who administered this scheme defrauded American citizens, businesses, and others by deceiving them and stealing virtual currency from their accounts,” said Secretary Steven T. Mnuchin. “The Treasury Department will continue to use our authorities to target cybercriminals and remains committed to the safe and secure use of emerging technologies in the financial sector.”

Danil Potekhin (Potekhin) and Dmitrii Karasavidi (Karasavidi) are being designated pursuant to Executive Order (E.O.) 13694, as amended by E.O. 13757, which targets malicious cyber-enabled activities, including those related to the significant misappropriation of funds or personal identifiers for private financial gain. Potekhin and Karasavidi are also the subjects of an indictment unsealed today by the Department of Justice.

Potekhin created numerous web domains that mimicked those of legitimate virtual currency exchanges. This tactic, known as spoofing, exploits Internet users’ trust in known companies and organizations to fraudulently obtain their personal information. When unwitting customers accessed Potekhin’s spoofed websites and entered their login information, Potekhin and his accomplices stole their login credentials and gained access to their real accounts. The attackers then employed a variety of methods to exfiltrate their ill-gotten virtual currency: using exchange accounts created using fictitious or stolen identities; circumventing exchanges’ internal controls; swapping into different types of virtual currency; moving virtual currency through multiple intermediary addresses; and a market manipulation scheme in which inexpensive virtual currency was purchased at a fast rate to increase demand and price, then quickly sold for a higher price to glean quick profit. Karasavidi laundered the proceeds of the attacks into an account in his name. He attempted to conceal the nature and source of the funds by transferring them in a layered and sophisticated manner through multiple accounts and multiple virtual currency blockchains. Ultimately, the stolen virtual currency was traced to Karasavidi’s account, and millions of dollars in virtual currency and U.S. dollars was seized in a forfeiture action by the United States Secret Service.

Potekhin and Karasavidi’s actions underscore the evolving threat that global financial institutions face from cybercriminals, who employ a variety of sophisticated schemes to profit at their victims’ expense.

OFAC closely coordinated today’s action with the United States Secret Service’s San Francisco Field Office and with the U.S. Attorney’s Office for the Northern District of California. Treasury is committed to collaborating with law enforcement to respond to evolving threats from malicious actors who exploit virtual currencies and target legitimate virtual asset service providers and their customers.

https://home.treasury.gov/news/press-releases/sm1123

In as much as these hackers trying to obfuscate their identity thru elaborate scheme, still the US government was able to track and trace the stolen crypto's to this individuals. So hacking is just one part of the equation, the other part is how to hide yourself which is very difficult since blockchain analysis is also evolving very quickly.

[philipma1957]

US DOJ has filed charges against two Russian hackers in connection of stealing $16 million worth of currency from trading platforms, Poloniex, Binance, and Gemini. The two Russians hackers are:

(1) Danil Potekhin (aka cronuswar)
(2) Dmitrii Karasavidi;

Here is the official court documents: https://www.documentcloud.org/documents/7211805-Potekhin-Superseding-Indictment.html

Washington - Today, in a coordinated action with the U.S. Department of Justice and the U.S. Department of Homeland Security, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two Russian nationals for their involvement in a sophisticated phishing campaign in 2017 and 2018 that targeted customers of two U.S.-based and one foreign-based virtual asset service providers. American citizens and businesses were among the victims of this malicious cyber-enabled activity, which resulted in combined losses of at least $16.8 million.

“The individuals who administered this scheme defrauded American citizens, businesses, and others by deceiving them and stealing virtual currency from their accounts,” said Secretary Steven T. Mnuchin. “The Treasury Department will continue to use our authorities to target cybercriminals and remains committed to the safe and secure use of emerging technologies in the financial sector.”

Danil Potekhin (Potekhin) and Dmitrii Karasavidi (Karasavidi) are being designated pursuant to Executive Order (E.O.) 13694, as amended by E.O. 13757, which targets malicious cyber-enabled activities, including those related to the significant misappropriation of funds or personal identifiers for private financial gain. Potekhin and Karasavidi are also the subjects of an indictment unsealed today by the Department of Justice.

Potekhin created numerous web domains that mimicked those of legitimate virtual currency exchanges. This tactic, known as spoofing, exploits Internet users’ trust in known companies and organizations to fraudulently obtain their personal information. When unwitting customers accessed Potekhin’s spoofed websites and entered their login information, Potekhin and his accomplices stole their login credentials and gained access to their real accounts. The attackers then employed a variety of methods to exfiltrate their ill-gotten virtual currency: using exchange accounts created using fictitious or stolen identities; circumventing exchanges’ internal controls; swapping into different types of virtual currency; moving virtual currency through multiple intermediary addresses; and a market manipulation scheme in which inexpensive virtual currency was purchased at a fast rate to increase demand and price, then quickly sold for a higher price to glean quick profit. Karasavidi laundered the proceeds of the attacks into an account in his name. He attempted to conceal the nature and source of the funds by transferring them in a layered and sophisticated manner through multiple accounts and multiple virtual currency blockchains. Ultimately, the stolen virtual currency was traced to Karasavidi’s account, and millions of dollars in virtual currency and U.S. dollars was seized in a forfeiture action by the United States Secret Service.

Potekhin and Karasavidi’s actions underscore the evolving threat that global financial institutions face from cybercriminals, who employ a variety of sophisticated schemes to profit at their victims’ expense.

OFAC closely coordinated today’s action with the United States Secret Service’s San Francisco Field Office and with the U.S. Attorney’s Office for the Northern District of California. Treasury is committed to collaborating with law enforcement to respond to evolving threats from malicious actors who exploit virtual currencies and target legitimate virtual asset service providers and their customers.

https://home.treasury.gov/news/press-releases/sm1123

In as much as these hackers trying to obfuscate their identity thru elaborate scheme, still the US government was able to track and trace the stolen crypto's to this individuals. So hacking is just one part of the equation, the other part is how to hide yourself which is very difficult since blockchain analysis is also evolving very quickly.

this is a nice find.  as to tracing abilities of the gov  maybe the hackers were a bit dumb or maybe just maybe the mixers they used were setup by governments.


We won't know as we won't see a digital  trail to follow .  But it seems to me a government run mixer would be the best way to catch them.


note I moved my comment to correct spot

[Kemarit]

I would say that these hackers didn't take care of their footprints and that's why the US government was able to follow their tracks and identify them through their names.

So I agree that it's only one part of the equation, and that's why perhaps government are offering a $625,000 now on someone who can break Monero because most likely hackers are going to used it instead of Bitcoin and US government wanted to stay on top of the game. And because Bitcoin are no longer viable crypto for these criminals as they are easily been identified by blockchain analysis.

[mk4]

I would say that these hackers didn't take care of their footprints and that's why the US government was able to follow their tracks and identify them through their names.

Most definitely the case. It's mind boggling how some people have the skills to hack accounts, but not enough knowledge to actually effectively CoinJoin and/or mix the coins. Thankfully it seems like they're incompetent in the privacy side of things though.

[cryptomaniac_xxx]

I would say that these hackers didn't take care of their footprints and that's why the US government was able to follow their tracks and identify them through their names.

Most definitely the case. It's mind boggling how some people have the skills to hack accounts, but not enough knowledge to actually effectively CoinJoin and/or mix the coins. Thankfully it seems like they're incompetent in the privacy side of things though.

I totally agree, it's kinda like ironic how intelligent these hackers are in finding ways to get unauthorized access and to be able to stole millions worth of cryptocurrency in top exchanges but lacks the knowledge on how to 'fence' those illegal funds. But I will get them the benefit of the doubt to used CoinJoin that time just because it's not yet gaining some attention. But still exchanging these stolen funds with the personal data of the hackers is mind blowing.

[philipma1957]

I would say that these hackers didn't take care of their footprints and that's why the US government was able to follow their tracks and identify them through their names.

So I agree that it's only one part of the equation, and that's why perhaps government are offering a $625,000 now on someone who can break Monero because most likely hackers are going to used it instead of Bitcoin and US government wanted to stay on top of the game. And because Bitcoin are no longer viable crypto for these criminals as they are easily been identified by blockchain analysis.

biggest issue is how 'honest' is a coin mixer

are they all in the hands of one government or another  and if you use large amounts of hot coins you will be caught?

It is very possible that  is true.

[kryme]

Not sure how these court cases usually play out, but in theory a good lawyer is going to ask the government how they tracked these users down and unless it's a sealed case, those methods should be made public, no?

[Jating]

Not sure how these court cases usually play out, but in theory a good lawyer is going to ask the government how they tracked these users down and unless it's a sealed case, those methods should be made public, no?

I think it should be made public in my opinion, but then again, it will just used blockchain analysis as how they identified the culprit, but if you look at the court documents, these hackers didn't hide their identify, in fact it is there in plain sight that's why it is easy for government authorities to name then with blockchain footprints.

@philipma1957 - you have a point though, there are numerous seizures of big mixers already and it's very unlikely that a famous mixer hasn't been taken down even if there's report that it has been used by criminals to mix stolen coins, hmmm. Are they secretly working with the government?

[Kemarit]

I would say that these hackers didn't take care of their footprints and that's why the US government was able to follow their tracks and identify them through their names.

So I agree that it's only one part of the equation, and that's why perhaps government are offering a $625,000 now on someone who can break Monero because most likely hackers are going to used it instead of Bitcoin and US government wanted to stay on top of the game. And because Bitcoin are no longer viable crypto for these criminals as they are easily been identified by blockchain analysis.

biggest issue is how 'honest' is a coin mixer

are they all in the hands of one government or another  and if you use large amounts of hot coins you will be caught?

It is very possible that  is true.

It's not that far from the truth, maybe some coin mixer are under the government? Just another conspiracy theory but it is not far fetch and it's really possible. As for the honestly of some mixers, there are a lot who have pulled a exit scam already, so I would say that they can't be really trusted specially if you are going to mix huge amount of bitcoins or even those hot coins.

[philipma1957]

If i were a major government I would have at least Two mixers under my control.

It is so easy to do for them. Run it legit until someone moves a lot of “bad” coins and seize them for auction.

[imstillthebest]

If i were a major government I would have at least Two mixers under my control.

It is so easy to do for them. Run it legit until someone moves a lot of “bad” coins and seize them for auction.

with these idea your giving people an idea to not use mixers because  people use mixers because they thought it was decentralized and they dont wana get tracked but this idea is also great to catch the person that are guilty for doing illegal and bad deeds  and besides , they wont also know that the mixer they use is run under by government because owners wont also said that publically  . on the other hand i dont think that the caught hackers are not smart to forgot to conceal thier selves but it could be that authorities are just smarter than them .

[Yaunfitda]

If i were a major government I would have at least Two mixers under my control.

It is so easy to do for them. Run it legit until someone moves a lot of “bad” coins and seize them for auction.

with these idea your giving people an idea to not use mixers because  people use mixers because they thought it was decentralized and they dont wana get tracked but this idea is also great to catch the person that are guilty for doing illegal and bad deeds  and besides , they wont also know that the mixer they use is run under by government because owners wont also said that publically  . on the other hand i dont think that the caught hackers are not smart to forgot to conceal thier selves but it could be that authorities are just smarter than them .

Nah, I will still used mixers though, if I wanted to hide my track from the prying eyes of those alphabet agencies. But come to think of it, possible right? So probably he is playing devil's advocate here, but not implausible, maybe one of our favourite mixers <insert name here> are really under the government control that's why they've always caught this thieves.

[audaciousbeing]

This is a move that I would personally encouraged because it sends a message to people that the crypto world is not a free for all that you can come in because you have a special skill or smarter than other but you believe that those skills can not be put into better use than to steal people resources and make them cry just because they wanted to earn legitimate inflow of a platform that they have been provided such opportunity. Kudos to the United States government agencies for taking this initiative.

[Jating]

If i were a major government I would have at least Two mixers under my control.

It is so easy to do for them. Run it legit until someone moves a lot of “bad” coins and seize them for auction.

with these idea your giving people an idea to not use mixers because  people use mixers because they thought it was decentralized and they dont wana get tracked but this idea is also great to catch the person that are guilty for doing illegal and bad deeds  and besides , they wont also know that the mixer they use is run under by government because owners wont also said that publically  . on the other hand i dont think that the caught hackers are not smart to forgot to conceal thier selves but it could be that authorities are just smarter than them .

On the contrary, we really don't know if there are state sponsored mixers now.

I will point you to a thread, maybe you haven't seen this, but it is a good read, Breaking Mixing Services.

Anyways, this thought of a mixer run by government or at least in their control could be unlikely, but it could also be "true and practical for them".

[coolcoinz]

This is a move that I would personally encouraged because it sends a message to people that the crypto world is not a free for all that you can come in because you have a special skill or smarter than other but you believe that those skills can not be put into better use than to steal people resources and make them cry just because they wanted to earn legitimate inflow of a platform that they have been provided such opportunity. Kudos to the United States government agencies for taking this initiative.

They have no jurisdiction in Russia. We've seen numerous times how the Russian government denied extradition of their citizens to the EU and the US, so this decision by US government is just for show. It will all change if those hackers are dumb enough to travel to the EU and get caught there, but as long as they stay in Russia they'll rather get employed by the secret service than sent for trial to the States.

[dhemasm]

After see some response here, Looks like it's really hard to arrest the hacker/theft if they are overseas, If the State can't even handle it how about some country especially my country (Indonesia) Can Handle it (If the hacker come from Russia or the other Country that have different jurisdiction).

Well it make me not sure if i must report it my local police, I also have case. My fund was stolen ($4000) from my Ethereum address (https://etherscan.io/address/0x2D923A09Bf3110b21381A528552700531dE83F63) January and 2 days before (Uni Airdrop) It sended to binance but after contacting the support the process it's more complicated.

Thanks for this one, I will make it as refrence for my case.

[Yaunfitda]

This is a move that I would personally encouraged because it sends a message to people that the crypto world is not a free for all that you can come in because you have a special skill or smarter than other but you believe that those skills can not be put into better use than to steal people resources and make them cry just because they wanted to earn legitimate inflow of a platform that they have been provided such opportunity. Kudos to the United States government agencies for taking this initiative.

They have no jurisdiction in Russia. We've seen numerous times how the Russian government denied extradition of their citizens to the EU and the US, so this decision by US government is just for show. It will all change if those hackers are dumb enough to travel to the EU and get caught there, but as long as they stay in Russia they'll rather get employed by the secret service than sent for trial to the States.

I do agree, but it's also good coming from the US government to really send this kind of message, not just for the Russians hackers, but the Chinese or even Iranian. They could be persecuted in absentia, and could b found guilty. So the ball now goes to those cyber threat personalities, their world started to become small as they can't travel outside of Russia now, otherwise they will be caught.

[dhemasm]

I do agree, but it's also good coming from the US government to really send this kind of message, not just for the Russians hackers, but the Chinese or even Iranian. They could be persecuted in absentia, and could b found guilty. So the ball now goes to those cyber threat personalities, their world started to become small as they can't travel outside of Russia now, otherwise they will be caught.

Yeah giving messages is good but of course action is needed even though I find it difficult, Like some of the previous messages Some countries have different jurisdictions. And maybe the country (Which is opposite and has a and balance power with the State like China, Russia, Iran) would prefer hiring them as agents (I suppose?) Rather than extradition a "Talented" Person.

Also I think if I become a hacker who stole and have more than $ 1 Million in my wallet, staying in my country and enjoying life is enough rather than traveling abroad (Personal Opinion) hahaha.

[Lucius]

Karasavidi laundered the proceeds of the attacks into an account in his name. He attempted to conceal the nature and source of the funds by transferring them in a layered and sophisticated manner through multiple accounts and multiple virtual currency blockchains. Ultimately, the stolen virtual currency was traced to Karasavidi’s account, and millions of dollars in virtual currency and U.S. dollars was seized in a forfeiture action by the United States Secret Service.

This part of the article explains very clearly how these two hackers were discovered, and it shows enough how intelligent they really are - they are actually very stupid if they thought they would not be caught. If you put so much effort into masking the whole operation and blurring the trail, then in the end you don't use your name - because if you get almost $17 million in your account, no special blockchain analysis is required to raise a red flag on such an account.

Fools like this get caught sooner or later, but how many do you think will never get caught?

[zasad@]

I only do not understand 1 thing, why make the names public? The American intelligence services have many opportunities to track these people down, detain them abroad, transfer them to the United States and charge them with a crime.
They can seize stolen coins without publishing personalities.
I may be wrong, but this data release seems to be politically motivated.