Reuters
Published Jun 07, 2021 03:41PM ET
Updated Jun 07, 2021 08:16PM ET
By Sarah N. Lynch, Christopher Bing and Joseph Menn
WASHINGTON (Reuters) -The Justice Department on Monday recovered some $2.3 million in cryptocurrency ransom paid by Colonial Pipeline Co, cracking down on hackers who launched the most disruptive U.S. cyberattack on record.
Deputy Attorney General Lisa Monaco said investigators had seized 63.7 bitcoins, now valued at about $2.3 million, paid by Colonial after last month's hack of its systems that led to massive shortages at U.S. East Coast gas stations.
The Justice Department has "found and recaptured the majority" of the ransom paid by Colonial, Monaco said.
An affidavit filed on Monday said the FBI was in possession of a private key to unlock a bitcoin wallet that had received most of the funds. It was unclear how the FBI gained access to the key.
A judge in San Francisco approved the seizure of funds from this "cryptocurrency address," which the filing said was located in the Northern District of California.
Colonial Pipeline had said it paid the hackers nearly $5 million to regain access. Bitcoin was trading down nearly 5% around 1800 ET (2200 GMT). The cryptocurrency's value has dropped to around $34,000 in recent weeks after hitting a high of $63,000 in April.
Bitcoin seizures are rare, but authorities have stepped up their expertise in tracking the flow of digital money as ransomware has become a growing national security threat and put a further strain on relations between the United States and Russia, where many of the gangs are based.
"Right now, prosecution is a pipedream," Vice President John Hultquist of the Mandiant cybersecurity firm said in praising the move. "Disrupt. Disrupt. Disrupt."
The hack, attributed by the FBI to a gang called DarkSide, caused a days-long shutdown that led to a spike in gas prices, panic buying and localized fuel shortages. It posed a major political headache for President Joe Biden as the U.S. economy was starting to emerge from the COVID-19 pandemic.
The White House urged corporate executives and business leaders last week to step up security measures to protect against ransomware attacks after the Colonial hack and later intrusions that disrupted operations at a major meatpacking company.
Deputy FBI Director Paul Abbate, who spoke at the same news conference as Monaco on Monday, described DarkSide as a Russia-based cybercrime group.
Abbate said the FBI was tracking more than 100 ransomware variants. DarkSide itself victimized at least 90 U.S. companies, including manufacturers and healthcare providers, he said.
Colonial Chief Executive Joseph Blount, who will testify before the Senate on Tuesday, said in a statement that the company had worked closely with the FBI from the beginning and was "grateful for their swift work and professionalism."
"Holding cyber criminals accountable and disrupting the ecosystem that allows them to operate is the best way to deter and defend against future attacks," Blount said.
Commerce Secretary Gina Raimondo said on Sunday the Biden administration was looking at all options to defend against ransomware attacks and that the topic would be on the agenda when Biden meets Russian President Vladimir Putin this month.
Tom Robinson, co-founder of crypto tracking firm Elliptic, said that the bitcoin wallet from which the funds were taken had contained 69.6 bitcoins. The seizure announced on Monday was of just 63.7 bitcoins, which Robinson said likely represented the share that had gone to the DarkSide "affiliate" who had initially hacked into Colonial.
Investigators say DarkSide often used a partnership model with other hacking groups to compromise numerous victims.
DarkSide would normally keep a smaller share for its role in providing the encryption software and negotiating with the victim, Robinson said. On Monday, minutes after the first funds were transferred out, the rest followed. The U.S. government might have seized that second amount as well but not announced it yet, Robinson said.
The FBI affidavit filed on Monday said that the bureau had tracked the bitcoin through multiple wallets, using the public blockchain and tools. Small amounts were shaved off the initial 75 bitcoin payment along the way.
The remaining amount reached the final wallet on May 27 and stayed there until Monday.
Written By: Reuters
Trading in financial instruments and/or cryptocurrencies involves high risks including the risk of losing some, or all, of your investment amount, and may not be suitable for all investors. Prices of cryptocurrencies are extremely volatile and may be affected by external factors such as financial, regulatory or political events. Trading on margin increases the financial risks.
Before deciding to trade in financial instrument or cryptocurrencies you should be fully informed of the risks and costs associated with trading the financial markets, carefully consider your investment objectives, level of experience, and risk appetite, and seek professional advice where needed.
Fusion Media would like to remind you that the data contained in this website is not necessarily real-time nor accurate. The data and prices on the website are not necessarily provided by any market or exchange, but may be provided by market makers, and so prices may not be accurate and may differ from the actual price at any given market, meaning prices are indicative and not appropriate for trading purposes. Fusion Media and any provider of the data contained in this website will not accept liability for any loss or damage as a result of your trading, or your reliance on the information contained within this website.
It is prohibited to use, store, reproduce, display, modify, transmit or distribute the data contained in this website without the explicit prior written permission of Fusion Media and/or the data provider. All intellectual property rights are reserved by the providers and/or the exchange providing the data contained in this website.
Fusion Media may be compensated by the advertisers that appear on the website, based on your interaction with the advertisements or advertisers.