Justice US recovers most of Colonial oil pipeline ransom

The US Department of Justice recovered most of the ransom paid by Colonial Pipeline on Monday. For this, the ministry collaborated with the FBI, which managed to obtain the private key of the wallet. How the FBI did this is unclear.

Now 63.7 bitcoin, converted 1.89 million euros, of the paid bitcoin is justified, writes the Department of Justice. The hackers demanded “about 75 bitcoin” as a ransom. The Department managed to recover this money by collaborating with both Colonial Pipeline and the FBI. When the oil pipeline company was attacked in early May, the company contacted the US government. The company knew at the time that it was being attacked by the DarkSide group and communicated this to police forces.

Colonial Pipeline decided on May 8 to transfer the requested ransom to the attackers. Knowing that this was going to happen, the police forces were able to track the transaction and the bitcoin. The cryptocurrency went to “a specific address” through multiple transactions. The FBI had the private key to this address and was able to access the ransom money through it. How the FBI got this private key is not clear. After permission from the judge, the ministry decided to recover the amount.

Reuters spoke to crypto tracking company Elliptic and writes that the wallet contained 69.6 bitcoin. Elliptic suspects that the portion of 63.7 bitcoin was earmarked for DarkSide’s “partner” who carried out the first hack on Colonial Pipeline. Investigators tell Reuters that Russian group DarkSide often works in partnership with other hacking groups to attack multiple targets at once. DarkSide would take a smaller share of the ransom, supply the encryption software and negotiate with the victim. The wallet is now empty. It is not clear whether the government has also reclaimed the rest of the bitcoin.

The Colonial attack shut down the pipeline, which runs from the Texas coast to New Jersey. Nearly half of the US east coast is supplied with oil by the pipeline. The attack caused crowds at gas stations. This crowds again caused scarcity at some gas stations.