Talking about this with friends.  FBI doesn’t give any details, of course, but says they traced it to a Wallet and seized it.  How do you think they got it back?

Our theories are:

-Traced it to an exchange, Forced it to be turned over
-Hacked the hackers
-Cracked the encryption


https://www.usatoday.com/story/news/politics/2021/06/07/cryptocurrency-ransom-paid-colonial-pipeline-hack-mostly-recovered/7589909002/

Interesting, reading that thread, the FBI claimed in their court filings they had the private keys to one of the accounts used by the hackers.  Seems very unlikely, unless again, it was moved to an exchange and the exchange gave them the keys.

It is also possible, the government is running a mixing service, and recovered the coin when the hacking group tried to launder the stolen coin via mixer.

The government specifically did not reveal how they recovered the coin. If they had not specifically kept this a secret, I would have speculated they seized the coin when they deposited it to an exchange.

I would find it fairly unlikely the government hacked the hackers, and very unlikely they were able to crack their private keys.

Seems plausible.  They would still need a seizure warrant, I assume, right?  I can't imagine the hackers would leave the money in an exchange, although it's possiblle it was part of their laundering plan.

I suppose it's also possible the FBI just seized some innocent guys money after the hackers exchanged it several times by now.


The seizure warrant was authorized earlier today by the Honorable Laurel Beeler, U.S. Magistrate Judge for the Northern District of California.
...
As alleged in the supporting affidavit, by reviewing the Bitcoin public ledger, law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address, for which the FBI has the “private key,” or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address. This bitcoin represents proceeds traceable to a computer intrusion and property involved in money laundering and may be seized pursuant to criminal and civil forfeiture statutes.

DOJ Statement: https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside

The thing is, they explicitly stated they had the private key "in possession" in the affidavit. That was before they received the warrant I believe. The warrant only granted them right to move the fund - but it seems the FBI did not obtain the key via legal seizure.

If that address was indeed a custodial one, then the timeline would be:

1. an exchange gave FBI the key without the presence of a warrant telling it to do so (edit: or there were separate legal actions we haven't heard of yet).
2. the FBI then lodged an affidavit in the morning of 7 Jun 2021 (https://www.justice.gov/opa/press-release/file/1402056/download), which basically said "I have the key please let me move the coins"
3. the FBI received warrant on the same day, 9:10 am (https://www.justice.gov/opa/press-release/file/1402051/download)
4. then they made the transfer at 10:40am (https://www.blockchain.com/btc/tx/943f2d576ed8d9f388ba75eb82fe35cce29479b84121827ac368a5a94f44cf7a)

This seems off... unless we take away (1) and assume FBI somehow got the key on their own. I mean, if they managed to get the key from an exchange, why didn't they have a warrant ready at the time?

edit 2 - or, they intentionally lied in the affidavit about having the private key, and used the warrant to force a certain exchange to make the transfer. I'm not even sure if there's a point in doing this - maybe they wanted us to believe they cracked the encryption?

The first option seems to be the most possible one out of the three. It is virtually impossible to crack the encryption. If they are indeed capable of cracking the encryption, then the value of Bitcoin will become close to zero. And the second option is also very unlikely. Because I don't expect the hackers to be some noobs, who would use compromised emails or simple passwords. It looks to me that the hackers were in a hurry to cash out, and they sent a part of their stash to an exchange where it was seized and handed over to the FBI.

I would have believed this joke.. but then I noticed "Tesla". Do you really want us to believe that Tesla, which can't even produce quality EVs is going to somehow produce a quantum computer which can crack the Bitcoin private key?  First let them take care of their overpriced pieces of junk, rather than poking their nose at things that are beyond their comprehension. Obviously Elon Musk will put up a tweet claiming that he will work with the "Dogecoin developers" to make it possible and the market will sing praises for him.

asking how? lol as If FBI will reveal what strategy they use to make this happen. This is a sacred action mate and that is what they are mastering now . and i think This will continue developing not only from Ransom detecting but also the hacking and scamming in which rampant in this community.

I see, that makes sense. So if we rule out the possibilities that an exchange just handed FBI their key; and that the FBI hacked the hackers; and (of course) that FBI cracked bitcoin with quantum computers... what are the odds?   Could it be possible that the FBI somehow scammed the hacker with their mixer, and only then applied for a warrant to move the coins further?  

..I'm also surprised that the hackers didn't even bother to try something like CoinJoin first.

Yep, this sounds much more reasonable than any other theories...

I'd say blowing a virtual identity for this particular incident seems totally worth it. They managed to send a strong message.