Partnered With:

FBI Seizes Darkside Extortion, Is Bitcoin's Private Key Really Breaked?

Read this article in 5 Minutes

The U.S. Department of Justice announced it has recovered some of the cryptocurrency ransoms previously paid by Colonial Pipeline to the ransomware Darkside.

原文标题：《 FBI 查封 DarkSide 勒索款比特币私钥被攻破？》

Originally written by Peckshield

Earlier, Colonial Pipeline, the largest US fuel Pipeline, was attacked by ransomware called Darkside, which demanded a ransom of $5 million in bitcoin. Colonial Pipeline delivered the ransom of 75 BTC on May 9, Beijing time.

According to Peckshield's anti-money laundering and anti-fraud system CoinHolmes, Colonial Pipeline delivered a ransom of 75 BTC, These 75 BTC were transferred to two wallet addresses beginning with BC1QXU and BC1Qu5, respectively, accounting for about 84% and 16% ransom, respectively.

Peckshield has previously analyzed that Darkside, a ransom-as-a-service (RaaS) group, has developed an entire chain of "ransom-as-a-service" (RaaS), in which developers provide tools and methods to others in return for a cut of the profits. As you can see from the cash flow chart, this time the FBI is freezing the extorted downstream funds (starting with BC1QXU, 63.7BTC), and the developer's funds have not been touched since they were received (starting with BC1Q5, 11.2BTC).

The 63.7BTC belonging to the blackmail downstream, which starts with BC1QXU, goes first to an address beginning with 3EYKXQ, then to an address beginning with BC1QQ2, and then in two separate moves to the target address beginning with BC1QPX (the address where the FBI has a private key, 63.7BTC) and another address (5.9BTC).

An affidavit filed on Monday said the recovery came after the Federal Bureau of Investigation acquired the private key to a key wallet in the transfer, but did not disclose how the FBI obtained the key.

"It is likely that the FBI traced the ransomware's server proxy in the United States and was intercepted, where the private keys may be stored," said Peckshield anti-money laundering experts.

Earlier Darkside's website had been blocked and they sent a message announcing their disbanding and transferring the money on the payment server to an unknown address.

"We used to help the police to track involved in money laundering cases of virtual currency, in general, money flows through tracking and analysis, analysis of trading mode and the counterparty information, if the criminal suspect to use money laundering, centralized trading institutions can trade through the centralized positioning mechanism, and judicial certificate, issued by blocking suspected money involved, locking suspects involved. However, In the case of Colonial Pipeline, the assets did not flow to a centralized trading facility, so it is unlikely that the FBI seized the money in this way. In addition, there is no indication that a private key may have been compromised, and our judgment is that the FBI will seek to recover the ransom money from the server proxy." "Explains Peckshield, an anti-money laundering expert.