how did government retrieve ransomware bitcoin?

[22bits]

https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside

Any ideas how they would have retrieved the bitcoin,

We will continue to target the entire ransomware ecosystem

-- makes me curious how they would technically retrieve the coins unless they located the individual and got the device they were on.

[mk4]

From what I've read, apparently the funds was sent to a "hosted wallet", so either an exchange, or a custodial wallet. Basically a huge amateur mistake from the cyber criminals.

[Wexnident]

They had the key to the wallet it seems.

As alleged in the supporting affidavit, by reviewing the Bitcoin public ledger, law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address, for which the FBI has the “private key,” or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address.

No idea how they actually got it though. Probably a leak or they had an insider or something.

[22bits]

the funds was sent to a "hosted wallet"

That would explain it, but hard to believe that people with the skill level to pull the entire venture off would be so inept as to put the funds on a hosted wallet.  Would certainly explain it though. 

[Pmalek]

I can't wrap my head around the idea that the FBI "had the private key" of that address. If it was a centralized exchange, I'd understand if they put pressure on that exchange to block that particular account. But the exchange would certainly not give out its private keys. If the hackers used a custodial wallet, I'd like to know which one, and how did the FBI get the private key of the address from it? From the report, it doesn't look like the FBI managed to infiltrate the computers used by the thieves and gained access to the keys that way. They already had the keys.

Maybe it's important to consider that the FBI has released fake custodial crypto wallets that are being used as we speak. Similar to the fake apps they created that led to the arrest of an international drug cartel not that long ago. Another reason not to use unknown, custodial and closed source apps. 

[o_e_l_e_o]

If it was a centralized exchange, I'd understand if they put pressure on that exchange to block that particular account. But the exchange would certainly not give out its private keys.

You can't put too much faith in anything bitcoin related reported in the media, or even in court documents. The majority of people are completely unaware as to how bitcoin works. When they say that the FBI "had the private key", they could mean anything from they actually had the private key, to they could work out who had it and pressurized them to transferring the bitcoins, to anything in between. If it was owned by an exchange or web wallet, perhaps they agreed to hand it over on the basis of anonymity, since any service willingly handing over users' bitcoin to third parties would obviously take a serious hit to their reputation.

However...

Maybe it's important to consider that the FBI has released fake custodial crypto wallets that are being used as we speak. Similar to the fake apps they created that led to the arrest of an international drug cartel not that long ago.

This was also my first thought. It was just revealed that the FBI have, over several years, created a fake company, developed, manufactured, and sold over 12,000 fake phones loaded with fake encryption software, and used all that to collect data, spy on people, and intercept communications. Creating a fake crypto wallet is absolutely trivial by comparison. If the software you are using is not open source, then it could very well be a government honeypot.

[shahzadafzal]

-- makes me curious how they would technically retrieve the coins unless they located the individual and got the device they were on.

Here's what I think happened...

FBI did nothing... this is all drama and speculation. We know the Governments and feds are so scared of bitcoin and they will go to any extend to damage bitcoin reputation. Here is the possible scenarios what really could have happened.

- This was FBI stunt and part of the plan, FBI transferred some of bitcoins to their own wallet and later got it back with some media publicity. Original ransome was never recovered.
- If they had access to the private keys they did not need the court's "seizure warrant" to access bitcoins. This warrant was for stealing or in other words accessing the private keys.

It's exactly the same way as if the criminal stole the money and then later they deposited the stolen money to one of the bank accounts and FBI got access to bank and froze that bank account. Which is extremely unlikely to happen.

Any way remember never trust any exchange whether it's coinbase, binance or your third party mobile wallets. Not your keys not your coins. 

Also keep in mind even if you have access to your private keys still there is no guarantee that your "wallet service provider" also don't have the copy of your keys.

OFFLINE wallets and HARDWARE Cold storage wallets are the only safe options.

[Pmalek]

You can't put too much faith in anything bitcoin related reported in the media, or even in court documents. The majority of people are completely unaware as to how bitcoin works. When they say that the FBI "had the private key", they could mean anything from they actually had the private key, to they could work out who had it and pressurized them to transferring the bitcoins, to anything in between. If it was owned by an exchange or web wallet, perhaps they agreed to hand it over on the basis of anonymity, since any service willingly handing over users' bitcoin to third parties would obviously take a serious hit to their reputation.

You are right about that. I think your theory about the FBI making a deal with the cryptocurrency exchange to hand over the coins makes the most sense. The entire report about them "having the private keys" could be just a fabrication created to not put that centralized exchange in a bad spot business-wise. 

This was also my first thought. It was just revealed that the FBI have, over several years, created a fake company, developed, manufactured, and sold over 12,000 fake phones loaded with fake encryption software, and used all that to collect data, spy on people, and intercept communications.

Although Entrochat wasn't created by the FBI, as soon as you mentioned encryption software, it made me think of that. I was planning to write a thread about it, but I am not quite sure where to post it as it's not really related to any bitcoin type of discussions. Maybe Serious Discussion could be appropriate. Everything can be broken with enough interest and coordination.

[Weawant]

From what I've read, apparently the funds was sent to a "hosted wallet", so either an exchange, or a custodial wallet. Basically a huge amateur mistake from the cyber criminals.

I agree, this is the easiest way government can retrieve Bitcoins that came from ransomware scams.

Either they have a special agreement with these medium to operate and in exchange, they will be granted access when a criminal used their platform to liquidate the dirty assets they have.

I just feel bad about the criminal, he has to train more though his efforts were all gone to waste. But he deserves it.

[NeuroticFish]

I first thought that they've intercepted communication. But afterwards I've read one post that made quite a lot of sense too:

The FBI recovered the private keys from a seized server. In other words, the group was INCREDIBLY sloppy with their keys and this resulted in the FBI gaining access to their wallets.

And if this is the case, sorry, I don't feel sorry for them.

Actually, I don't feel sorry for them for multiple reasons:
* ransomware is extrotion and that's not OK
* they've used Bitcoin
* they were sloppy and made it easy for govt get the funds back, making Bitcoin look weak in the eyes of those not understanding it

[ubercool]

In my honest opinion, I don't feel an international hacker group will be so sloppy to giveaway or not be cautious about their private keys.
If it was transferred to some custodial wallets then I might say they have caught it. But if not then this might be a complete scam pulling by the government to everyone whose thinking that holding Bitcoin will keep them out of government's sight.

[Ryker1]

Well, as I read in most news regarding hacking or theft through cryptocurrency--the NBI retrieve private key and then they had an access to the bitcoin through the device of the criminal that has used it, and another factor when the criminals send their bitcoin into a centralized exchange which is easy to the government to tell the exchange to freeze the account while they had an investigation. This should NBI has an expert on how to understand bitcoin and on how to get the private key, something using brute force to the computer user if they don't know the password and access the wallet. However, I think last month or this year there is news one cybercriminal has been caught but the bitcoin did not compensate because the criminal did not tell to them the private key. So --not all bitcoin being retrieve while the criminal has caught.

[ranochigo]

First of all, there is no way to verify how they did it. They can simply say that they had a $5 wrench attack on one of their perpetrators and there is no reason for people to not believe it. As long as their story is remotely plausible, then there is no reason to believe otherwise. The most you can do is to eliminate the most unlikely scenarios and narrow it down further.

Tl;dr: Whatever reasoning that they will give can potentially be fabricated, I would take anything that they say with a pinch of salt. There is no reason to prove that they did seize a server or if they did coerce a certain exchange to give back the funds.

[o_e_l_e_o]

The FBI recovered the private keys from a seized server. In other words, the group was INCREDIBLY sloppy with their keys and this resulted in the FBI gaining access to their wallets.

That's certainly the chain of events according to Adam Back: https://twitter.com/adam3us/status/1402179970277982210

* ransomware is extrotion and that's not OK

There are a lot of victimless crimes that I don't think should be crimes and I have sympathy for the people who are prosecuted for these crimes. Ransomware is absolutely not one of them. I've seen entire hospitals go down from ransomware attacks. There's not much you can do in a hospital when you can't run any lab tests, you can't take any x-rays or scans, you can't look up any results or electronic patient records. Sometimes you can't even administer drugs because they need to be electronically signed out and the relevant computer is bricked. These are people's lives, and this is never OK. Anyone performing ransomware attacks deserves to be punished.

[mk4]

You are right about that. I think your theory about the FBI making a deal with the cryptocurrency exchange to hand over the coins makes the most sense. The entire report about them "having the private keys" could be just a fabrication created to not put that centralized exchange in a bad spot business-wise. 

You gotta get used to modern "jOuRnALiSm" mate. I mean, take a look at this description from this Forbes article[1] about this:



The explanation was so bad that it was almost like the implication was as if the DOJ just took out a tool called a "private key" and they can automatically unlock any wallet they want.

[1] https://www.forbes.com/sites/jonathanponciano/2021/06/08/crypto-markets-crash-again-after-doj-seizes-23-million-bitcoin-ransom/?sh=2bf38fe4215a

[22bits]

That's certainly the chain of events according to Adam Back: https://twitter.com/adam3us/status/1402179970277982210

  Very good explanation of what happened, incredibly sloppy and hard to believe the stupidity but apparently what happened.

[Pmalek]

The explanation was so bad that it was almost like the implication was as if the DOJ just took out a tool called a "private key" and they can automatically unlock any wallet they want.

Oh, you didn't know that there is an app available for Windows 10 that allows you to extract a private key from any address out there and it's completely free and absolutely not malware-infected at all...

Joking aside, I can't be angry with a journalist for not knowing the workings of Bitcoin and the blockchain. What pisses me off is when I see that someone reports maliciously about crypto, but obviously knows nothing about how it works. I am OK with the lack of know-how as long as the general idea of the piece is not about how Bitcoin should be avoided at all costs, that it brings only trouble in the world, is only used by drug dealers, and similar nonsense.

[o_e_l_e_o]

Joking aside, I can't be angry with a journalist for not knowing the workings of Bitcoin and the blockchain.

I disagree. That is the definition of bad journalism. The whole point of being a journalist is to report accurate facts and information. If you don't know or understand something, then you are expected to find out before you write about it, or not write about it at all. We've seen plenty of examples of terrible journalism over the past few years with the likes of Fox news spewing crazy conspiracy theories, and this kind of thing is no difference. Writing what your readers/viewers want to read/hear as opposed to what is actually true, either intentionally or because you are too ignorant to know any better and too lazy to find out.

Most media will have an editorial line they will have been told to push. Their owners, just like people like Warren Buffet, have no interest in helping bitcoin along. They much prefer fiat since all their investments are based in fiat, along with its ability to help them buy politicians and influence elections.

[CryptoStar19]

Joking aside, I can't be angry with a journalist for not knowing the workings of Bitcoin and the blockchain.

I disagree. That is the definition of bad journalism. The whole point of being a journalist is to report accurate facts and information. If you don't know or understand something, then you are expected to find out before you write about it, or not write about it at all. We've seen plenty of examples of terrible journalism over the past few years with the likes of Fox news spewing crazy conspiracy theories, and this kind of thing is no difference. Writing what your readers/viewers want to read/hear as opposed to what is actually true, either intentionally or because you are too ignorant to know any better and too lazy to find out.

Most media will have an editorial line they will have been told to push. Their owners, just like people like Warren Buffet, have no interest in helping bitcoin along. They much prefer fiat since all their investments are based in fiat, along with its ability to help them buy politicians and influence elections.

Popular media, like any other entity out there, is ultimately looking for further profits which comes from larger audiences... controversial topics tend to gain higher viewership, this is why routinely we see media articles that in one way or another try to claim that the bitcoin network was somehow 'hacked' --because headlines like that would be read a lot more than if they described the soundness of bitcoin (which would be no "news" in a way).

For better or worse, the goal of popular media is not to deliver news, but rather to increase the size of its audience by delivering controversial topics even if they are not factual. For a long while now news has been more like entertainment than news.

[Pmalek]

I disagree. That is the definition of bad journalism. The whole point of being a journalist is to report accurate facts and information. If you don't know or understand something, then you are expected to find out before you write about it, or not write about it at all.

Those were the good old days my friend. You would have to take a trip to the past if you want to see that. Investigative and research-based journalism is a Walkman nowadays. Journalists, or more precisely article writers, are agenda pushers and click creators. Clicks, likes, and shares. Spectacular claims and thought-provoking headlines that leave you disappointed when you are done with the piece.