Majority of the Money Paid to the Colonial Pipeline Hackers Recovered by FBI, Equivalent to 2.3 Million Dollars

Justice Department announced today that they were able to recover 63.7 bitcoins from an account associated with a group know as DarkSide. The 63.7 bitcoin value at the time of seizure is approximately 2.3 million dollars.

Disclose.tv tweeted, “JUST IN – FBI tracked and recovered millions in cryptocurrency paid to Colonial Pipeline ransomware hackers. US feds seized $2.3 of $4.4 million Colonial Pipeline ransom from a #Bitcoin wallet pursuant to an order from a federal court.”

US feds seized $2.3 of $4.4 million Colonial Pipeline ransom from a #Bitcoin wallet pursuant to an order from a federal court.

— Disclose.tv 🚨 (@disclosetv) June 7, 2021

During the press conference, a reporter pointed out that the group still walked away with approximately 2 million equivalent in bitcoins. The full press conference can be seen further down in the article.

A press release from the Department of Justice reads, “Following the money remains one of the most basic, yet powerful tools we have,” said Deputy Attorney General Lisa O. Monaco for the U.S. Department of Justice. “Ransom payments are the fuel that propels the digital extortion engine, and today’s announcement demonstrates that the United States will use all available tools to make these attacks more costly and less profitable for criminal enterprises. We will continue to target the entire ransomware ecosystem to disrupt and deter these attacks. Today’s announcements also demonstrate the value of early notification to law enforcement; we thank Colonial Pipeline for quickly notifying the FBI when they learned that they were targeted by DarkSide.”

“There is no place beyond the reach of the FBI to conceal illicit funds that will prevent us from imposing risk and consequences upon malicious cyber actors,” said FBI Deputy Director Paul Abbate. “We will continue to use all of our available resources and leverage our domestic and international partnerships to disrupt ransomware attacks and protect our private sector partners and the American public.” 

“Cyber criminals are employing ever more elaborate schemes to convert technology into tools of digital extortion,” said Acting U.S. Attorney for the Northern District of California Stephanie Hinds. “We need to continue improving the cyber resiliency of our critical infrastructure across the nation, including in the Northern District of California. We will also continue developing advanced methods to improve our ability to track and recover digital ransom payments.”

This comes after the Colonial Pipeline was shut down by an origination name DarkSide which is being reported as Russian hackers. The hackers demanded approximately 75 bitcoins which were paid to them.

Law enforcement was able to track multiple transfers of bitcoin and identified the 63.7 bitcoins. The FBI has the “private key” needed to access assets accessible from the specific Bitcoin address.

This news may help to deter others from hacking U.S. infrastructure in order to ransom for bitcoin.