FBI "Recovers" BTC Ransom

Surely most here have heard the news today that the FBI apparently recovered more than half the ransom from the Colonial Pipeline ransomware event. Pic related from the seizure warrant to let the FBI take the funds. If you read the whole thing, the FBI essentially used blockchainexplorer.com and traced the ransom through like 3 wallets. Then without further explanation notes that the FBI "has the private key" for the final wallet, which had 69 BTC. A few points here do not add up for me: 1. How did the FBI obtain the key? 2. Why would the ransomware gang shuffle millions of dollars in BTC to 3 wallets without splitting it up, changing it to a privacy coin, etc? The doc notes the 69 BTC were left there since May 27. As for #1, I see basically two options: the FBI had it all along, or an informant or member of the ransomware group provided it to the FBI. Neither of which make much sense. Point #2 is also perplexing, that a group behind an extremely high profile attack is just going to leave the majority of the payment in a single wallet as BTC. As you know, the "DarkSide" ransomware has a "ransomware as service" model, meaning anyone can use the ransomware provided a cut goes to its creators. Putting it all together I submit for you my hypothesis: FBI did this themselves acting as an "affiliate" group for DarkSide. Ransomware groups don't want to affect critical infra or "take down the west" - they want money. The type of heat generated by the Colonial attack is not what they want. (And recall DarkSide did say it was not them, but an affiliate, that did it). Traditionally there have not been such attacks on infrastructure. Yet now all of a sudden we have two attacks on "infrastructure" in two weeks (Colonial and JBS). Both of which just happen to involve a type of ransomware with an affiliate/RaaS system.

https://www.washingtonpost.com/business/2021/06/07/colonial-pipeline-ransomware-payment-recovered/ "Officials did not explain how the FBI got the key." Can anyone explain how the FBI actually did this? And how exactly does one "seize" a bitcoin wallet? The whole thing sounds fishy.

BadBios exists. Privacy and security does not.

>literally calling a resource-extracting pipeline Colonial do angloids really?

getting the ransom in cash would have been easier and safer unironically.

>>16093 How so? You cannot access the drop site without being tracked. You need to physically reach the drop site (effort, especially if across borders).

FBI probably has a secured place in the blockchain of Bitcoin. The people that ransomwared were likely amatures using a simple program not skilled hackers. The group even apologized after and straight up said they only wanted money and didn't mean to cause trouble for people. The only shadey business is the fact that the oil company didn't just pay the money right away instead reporting to the news. 5 million is pocket change for an oil company. The company very likely did it to artificially raise the price of oil and gas for a while and cause panic buying. They actually profited from all this not took a blow.

>>16089 Is this supposed to be sarcasm? It sends oil to the entire east coast thus the original 13 colonial states.

>>16083 >2. Why would the ransomware gang shuffle millions of dollars in BTC to 3 wallets without splitting it up, changing it to a privacy coin, etc? The doc notes the 69 BTC were left there since May 27. Maybe they were worried about attracting a drone strike. The US has been executing foreign nationals without trial for decades for less than what these guys did. >>16085 No one knows how they got the key but seizing BTC is as easy as transferring it to an address that only you control. That's almost certainly what they did.

>>16083 >How did the FBI obtain the key? The 90 IQ """hackers""" bough their ransomware for about tree fiddy on malware.onion and send it over email. They deftly try to "launder" it on a public ledger (never heard of Wasabi?) before depositing it on Coinbase. FBI asks Coinbase nicely for the private key. fin. You don't need to resort to tinfoil hat soykaf to explain any of this, I say as someone who loves tinfoil hat soykaf.

>>16102 > tree fiddy Off-topic saged, but this just grates on me like nails on a chalkboard.

>>16085 If the attacker was using a web wallet or a wallet like coinbase or binance, it's possible that the site admin's cooperated and just gave them the key. But, I don't know for sure. It's just a hunch.

>>16101 There are CIA/NSA whitehats that actually think that ransomware actors should be drone striked. These people are fuarrrking insane and should never be taken seriously.

>>16105 >These people are fuarrrking insane and should never be taken seriously. But they will be. :^

What if the NSA knocked out the darkside servers and got all the bitcoin and handed it off to the FBI so parade around with?

>>16102 Most likely this. The FBI wants to make it sound like they broke BTC, but they most likely just came knocking on whatever retarded exchange they saved their BTC on or downloaded the unencrypted wallet file or some soykaf... By making it sound like they broke BTC they hope to make other ransomware actors get scared and stay away from doing those sorts of things

>>16083 Theory 1: I probably sound like a glowtard saying this but if it was the Ruskies then they would have no need for the money and could easily leave it somewhere unsafe on purpose to bring an end to the situation or as a power move. Theory 2: They originally had plans to transfer the funds to monero, but changed their minds when they realized the FBI/CIA/NSA was probably watching the whole world for those funds, and could probably disappear whoever they find, and it wasn't worth the risk, so like theory 1. They abandoned it on purpose. Theory 3: It was an actual conspiracy, maybe the company fuarrrked something up and needed time to get things operational again. Theory 4: The company actually paid them more than what we are told and made a deal with them to pay more and pretend the US government is actually competent enough to protect its businesses. The FBI operation was just a cover so the company would not be affected financially, and to protect the US economy.

>>16083 Tons of high profile attacks are done by skiddies. The group that did it offers ransomware as a service, so it's not improbable that some skids made their way into the pipeline computers, bought the RaaS, then failed to handle the bitcoin properly. From another article: >Elvis Chan, an assistant special agent in charge at the FBI's San Francisco office, said in a news call Monday that the funds were specifically seized from hacker subcontractors who had used the DarkSide ransomware to hack Colonial. > >He declined to give specifics of how the FBI was able to gain access to the wallet, but he said it did not rely on waiting for criminals to use U.S. cryptocurrency services. It did, however, rely on the fact that so much internet infrastructure is based in the U.S., where the FBI can get warrants. > >"I don't want to give up our tradecraft in case we want to use this again for future endeavors," he said. My guess would be the FBI got the IP address from monitoring the bitcoin network and then were able to seize it. Might have been that the skids used a web wallet or an exchange instead of their own bitcoin wallet, or maybe they bought a vps to use for their wallet.

>>16105 >Nobody cries over a dead terrorist (nor should they) Oh yea, not like the terrorist had family or friends. You can go all out on their deplorable actions, but you can't deny that their human too. Westerners show no fuarrrking empathy and I guarantee that causes half of the world's problems.

What the fuarrrk does the US government get out of doing these false flags on their own populace? The Most basic claim would be that its to defame either Russia or China but most of the population seems to just have blamed the US government for it so any sort of PsyOps seems to have failed

>>16114 >most of the population seems to just have blamed the US government for it No, they blamed the corps that run the pipeline. Big oil and the government are already on the outs with the whole electric cars and windmills push, so that just seems like an extra benefit. Congress is already pushing through an anti-ransomware bill that will no doubt make more everyday soykaf illegal with absurd penalties so they can selectively enforce it on the undesirables.

>>16113 >one guy says thing and even admits its a unpopular opinion Critics of westerners show a lack of reading comprehension and lack of compassion. Now I am saying this because of what one person (you) have said. Let me gift you a little bit of information: >Westerners, as a group, lack identity and are very individualistic >Many westerners do not consider more than one reaction, nor do they consider the reactions past that initial reaction. Let me give you an example: "Oh, if I hit this bee hive, the bee hive will not be here anymore. Oh. No. Why are they stinging me? This is insane, I hate bees." >Most westerners are not involved with interactions with people outside of their own country in any meaningful way. At best, the average westerner has a random interaction in some video game online. If you don't understand yet, please be honest and I can give you more information. >>16114 >What the fuarrrk does the US government get out of doing these false flags on their own populace? If this is a real question, it's disappointing. I will answer with the assumption that it is, in fact, a real question. I will be simple and not go too indepth. Perhaps this entire thing will jump start your brain. The government gets more control. >Fake oil crisis = increases the money the oil industry makes This lines the pockets of those in power and gives the oil industry more money. It also will make people more relaxed with the idea of the US invading places that sell oil to help "reduce the price" -- A solid majority of Americans either don't think about the fact that we are holding a gun to the head of those in control of this oil and the ones that do, rarely talk about it. >Scare people into wanting "this problem to get fixed before we start on the smaller ones" Danger to life? Danger to materials? Danger to income access? These are the things that keep the average american up at night. They will forgo all to make sure those 3 things are ok. Reminder that they tend to want their families to be safe, fed, and as happy as possible. We can let X and Y slide for now because we really need to get this hacker terrorism dealt with! >We need to spy on everyone to make sure to stop terror. Do I need to lead you for this one or can you figure it out yourself? Perhaps you wanted to just know an end goal? Money. Control. Votes. They want more money all the time. They want to extend their control everything they don't feel they have enough. They want votes every 2 years. I don't want to write anymore. Good luck.

>>16083 >1. How did the FBI obtain the key? >b FBI >larp as ransomware gang >return 50% of what you stole >take part in media circus >profit from crime & public praise as heros feds unironically run pedo websites and other crime networks for years and only close them in as a 'sting' operation when journalists start investigating who owns them - but using 0days as part of a ransomware larp is beneath them? lol!

>>16118 100% this. Not only FBI. CIA and NSA too. fuarrrk them.

obviously it was the Canadians. Can you not see? They are on the verge of conquering America!

>>16120 lol, I didn't expect that one

>>16113 How old are you, lain? If you spent more than 5 years on the anglo Internets, you sooner or later realize that 95% of smiley face pypo are sociopaths. Angloids literally lack empathy due to institutionalized bodily and psychological abuse since early childhood.

>>16118 That's pretty much my thought. Either that, or the affiliate group that did it was led by and/or largely comprised of FBI informants. Wouldnt be the first time informants instigate/entrap others into a crime and then the few in the group that weren't informants get arrested. That's basically every "attempted terrorism" case since 9/11.

Regarding the "skids left btc on an exchange wallet" theory. I'm no expert on cryptocurrency so could be wrong.. but is it even possible to know that a given address is part of a particular exchange by looking at the blockchain? e.g how would the FBI know to subpeona coinbase or whoever with the address alone?

Idk there has to be to it than some skids having it sit on an exchange because I believe it was paid in monero (there were articles saying the 5 mil was paid in a privacy coin) so unless they had it paid directly into an exchange wallet and didnt move it at all that would mean either A. The feds can trace monero B. They didnt actually recover the exact funds and just paid back colonial to seem less incompetent than they are. IMO this is more likely to me. So many lainons think the feds are super leet but I think they are pretty incompetent in reality. Who has skills and wants to work for them? Its just bootlickers, ex military and hackers that get caught and forced into service

>>16130 >how would the FBI know to subpeona coinbase or whoever with the address alone? They wouldn't, they'd ask coinbase nicely "is this one of yours" or maybe "give us a list of your addresses" and coinbase would say "yes sir right away sir"

>>16132 The ransom was definitely paid in Bitcoin, not Monero, all news outlets report Bitcoin.

>>16134 Crypto exchanges need to cooperate with law enforcement to be compliant with US regulations.