The FBI is said to have got back most of the $4.4 million that Colonial Pipeline paid as ransom.

The US Justice Department announced Monday that most of the ransom money of $4.4 million paid by Colonial Pipeline to DarkSide, the alleged perpetrator of the cyber attack, has been recovered. According to US authorities, this gang operates from Eastern Europe, possibly Russia. (BBC)

Major victory against ransomware bad actors

According to Deputy Attorney-General Lisa Monaco, the FBI had “found and recaptured” 63.7 bitcoin worth $2.3 million, “the majority” of the ransom paid.

Notably, the value of bitcoin has declined sharply since the payment, hence the difference in valuation of the recovery.

“There is no place beyond the reach of the FBI to conceal illicit funds that will prevent us from imposing risk and consequences upon malicious cyber actors,” said FBI Deputy Director Paul Abbate. “We will continue to use all of our available resources and leverage our domestic and international partnerships to disrupt ransomware attacks and protect our private sector partners and the American public.”

Digital “car chase” – how the ransom was tracked and recovered

The FBI used a blockchain explorer, according to Bloomberg|Quint, to track the ransom payment once it was transferred by Colonial Pipeline to the hackers. To get the ransom amount, the attackers had to divulge their blockchain address – similar to a bank account, but for crypto assets.

As the Feds watched, the hackers “hopped” the funds through a string of wallets (as many as two dozen) in a strategy to cover their tracks and confuse followers of the money.

Ultimately, at the end of the trail, 63.7 bitcoins landed into a final address.

The FBI descended on this address, and recovered the money. However, to do this, they needed to have the “private key” of the wallet.

It is not understood how the Feds came to possess this key.

Possibilities:

• The FBI hacked the hackers
• An informant passed on the key
• An anonymous hacker hacked the hackers and handed the FBI the key
• The funds were held with an exchange, and the Feds forced them to hand over the key

Bitcoin on the back foot after FBI action

Bitcoin is slipping again today, and according to conjecture, this may be due to the news of the FBI recovering the Colonial Pipeline ransom.

The incident reminded the market that bitcoin transactions reside on a public ledger and are not battle-tank anonymous after all.

As this is being written, bitcoin is trading at $31,977, down a sizable 11.28%, according to Coindesk prices.

Related Story:    Colonial Pipeline Caved; Paid $5M Ransom To Hackers