<p>It seems that the FBI seized their servers and found the private keys there.<br>
If you wanted to know if there was a flaw in Bitcoin software or the protocol, there is no evidence of that.</p>
<p><a href="https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/" rel="nofollow noreferrer">https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/</a>
<br><br><br>
<strong>Edit</strong>:</p>
<p>The latest news indicates that ransom's bitcoins were deposited in a California based custodial address (an exchange or wallet provider) and the FBI seized it with a <a href="https://upload.wikimedia.org/wikipedia/commons/2/2d/DarkSide_Bitcoin_Seizure_Warrant_June_7_2021_N.D._Ca.pdf" rel="nofollow noreferrer">DOJ warrant</a>.</p>
<p>So (astonishingly) it seems that the hackers lost their bitcoins because they used a custodial wallet (U.S. based) instead of one they had the private keys for.</p>
<p>The transactions flow also seems very easy to track: it is possible to do it by anyone even without knowing the ransom's address, knowing only its amount, as shown here:</p>
<p><a href="https://blog.wolfram.com/2021/05/25/sleuthing-darkside-crypto-ransom-payments-with-the-wolfram-language/" rel="nofollow noreferrer">https://blog.wolfram.com/2021/05/25/sleuthing-darkside-crypto-ransom-payments-with-the-wolfram-language/</a></p>

CC BY-SA 4.0
2021-06-08T13:58:21.730Z
Thank you - I was pretty sure it wasn't a blockchain vulnerability. Seems rather careless of the criminals not to have immediately transferred the coins to a more secure cold wallet. But good result for the FBI, well done
nonpoliticaltag
CC BY-SA 4.0
2021-06-08T13:47:42.820Z
2021-06-08T22:34:57.033Z
2021-06-08T22:34:57.033Z
leevancleef
<p>From Wikipedia:</p>
<p><a href="https://en.wikipedia.org/wiki/Colonial_Pipeline_cyber_attack" rel="nofollow noreferrer">Colonial Pipeline cyber attack</a></p>
<p>This article states that it is not known how the FBI obtained the private key of the address with the ransom in it. Can't find any other sources on this. Are there any theories or evidence of how this was done?</p>

<ransomware>
Colonial pipeline attack - how was ransom partially recovered
nonpoliticaltag
# Colonial pipeline attack - how was ransom partially recovered

(Asked by: username_0 on 2021-06-08)

From Wikipedia:

[Colonial Pipeline cyber attack](https://en.wikipedia.org/wiki/Colonial_Pipeline_cyber_attack)

This article states that it is not known how the FBI obtained the private key of the address with the ransom in it. Can't find any other sources on this. Are there any theories or evidence of how this was done?

**Tags:** ransomware


---

## 1 answers

### Answer by username_1 on 2021-06-08. Score: 5 | Accepted answer

It seems that the FBI seized their servers and found the private keys there.  
If you wanted to know if there was a flaw in Bitcoin software or the protocol, there is no evidence of that.

<https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/>
  
  
  
**Edit**:

The latest news indicates that ransom's bitcoins were deposited in a California based custodial address (an exchange or wallet provider) and the FBI seized it with a [DOJ warrant](https://upload.wikimedia.org/wikipedia/commons/2/2d/DarkSide_Bitcoin_Seizure_Warrant_June_7_2021_N.D._Ca.pdf).

So (astonishingly) it seems that the hackers lost their bitcoins because they used a custodial wallet (U.S. based) instead of one they had the private keys for.

The transactions flow also seems very easy to track: it is possible to do it by anyone even without knowing the ransom's address, knowing only its amount, as shown here:

<https://blog.wolfram.com/2021/05/25/sleuthing-darkside-crypto-ransom-payments-with-the-wolfram-language/>

> **Comments:**
> **username_0**: Thank you - I was pretty sure it wasn't a blockchain vulnerability. Seems rather careless of the criminals not to have immediately transferred the coins to a more secure cold wallet. But good result for the FBI, well done  

---

