FBI hacks hackers’ bitcoin wallet, steals back most of pipeline ransom

The US has recovered most of the US$4.4 million ransom paid to a cyber-criminal gang responsible for taking down the Colonial Pipeline, which carries 45% of the East Coast’s supply of diesel, petrol and jet fuel, last month.

The cyber gang DarkSide – which US authorities said operates from eastern Europe and possibly Russia – infiltrated the pipeline and disrupted supplies for several days causing fuel shortages across the eastern US.

On Monday, Deputy Attorney-General Lisa Monaco said investigators had “found and recaptured” 63.7 bitcoin worth US$2.3 million, amounting to “the majority” of the ransom paid.

In a statement Joseph Blount, chief executive of the Colonial Pipeline Company, said his firm was grateful for the “swift work and professionalism” of the FBI, which helped to recover the ransom.

Commerce secretary Gina Raimondo said on Sunday that President Joe Biden would raise the issue of such attacks with Russian leader Vladimir Putin in a meeting planned for this month.

Stealing back a ransom shows how far the US is willing to go to deter cyber-criminals, says the BBC. It sends a powerful message to the gangs who have been operating with impunity for years in states like Russia.

The authorities are being vague about exactly how they did it. All they are saying is that the “private key” to the criminal’s bitcoin wallet is in the “possession of the FBI”.

With this key, which is effectively a password, agents were able to simply log in and send the digital coins to another wallet they control.

After the attack in May, Colonial made a cryptocurrency payment, and in return the company received a decryption tool so it could unlock the systems compromised by the hackers, although that was not enough to restart systems immediately, according to the Wall Street Journal.

A Colonial spokesman said that it would take months before some business systems were recovered and estimated that the attack would ultimately cost the company tens of millions of dollars.

At the time of the hack, the DarkSide criminal gang acknowledged the incident in a public statement.

“Our goal is to make money and not creating problems for society,” DarkSide wrote on its website. “We do not participate in geopolitics, do not need to tie us with a defined government and look for our motives.”