So the DOJ announcement yesterday has been rattling around in my head all night and I want to get it down before the news cycle moves on to whatever's next. The Justice Department said they clawed back $2.3 million of the ransom Colonial Pipeline paid to DarkSide last month. Not all of it — the company handed over about $4.4 million in bitcoin back in May, and by the time the feds moved, the price had dropped enough that 63.7 of the 75 bitcoins only added up to that $2.3 million figure. Still, they got a chunk of it back, and they did it by tracing the wallet on the blockchain and then, apparently, just having the private key.
That last part is the bit that's been bugging me. Deputy AG Lisa Monaco said in the presser that investigators tracked the payment to a specific address and had "the private key" for it, which let them move the funds themselves rather than asking an exchange to freeze anything. Nobody's fully explained how they got that key and I don't think they will, not publicly anyway. Maybe a seized server, maybe a subpoena to whatever wallet service DarkSide was sloppy enough to use, maybe an informant. Doesn't really matter for my point here.
My point is this: bitcoin has never been the untraceable ghost money that half the news coverage over the past decade wants you to believe it is. Every transaction on that chain is sitting in a public ledger forever, in the open, for anyone with the patience to look. That's kind of the whole design. What's hard is connecting a wallet address to a real human being, and that's a completely different problem than "tracing the money," and reporters keep conflating the two. I've been annoyed about this specific conflation since roughly 2013 when I was writing about Silk Road on this very blog, so forgive me the rant, it's a old one.
The actual lesson from this, if there is one, is narrower and less dramatic than "the FBI beat crypto." It's that ransomware crews who cash out through custodial services, or who reuse addresses, or who just aren't careful about opsec, are exposed the moment law enforcement cares enough to look. DarkSide, going by their own leaked forum posts, seemed to think this was a fairly low-risk business line. I'd guess this recovery, small as it is relative to the total ransomware economy, changes that calculus for at least a few of these groups, or at least makes them switch which coin they demand. Monero's non-traceable by design in a way bitcoin genuinely isn't, and I'd bet actual money we start seeing more ransom demands in XMR before the year's out. Watch that space.
Colonial itself has taken its lumps in the coverage for paying at all, which I think is a little unfair given they were staring down a shutdown of fuel supply to something like half the East Coast. Easy to say "never pay the ransom" from the outside. Harder when you're the one explaining to a governor why gas stations in six states are running dry. Not defending the decision as good policy, just saying the moral clarity a lot of op-eds brought to it this week felt cheap.
One thing I keep coming back to, unrelated but stuck in my head from the same news cycle: this is apparently the first time the Justice Department's new ransomware task force, the one they stood up specifically after Colonial, has actually clawed money back. Barely a month old and already had a case. That's not a coincidence, that's just how bad the last twelve months have been for critical infrastructure attacks — there was enough raw material sitting around that a brand new task force didn't have to wait long for a headline case to work.
Anyway. I don't have a tidy bow to put on this one. It's a genuinely interesting use of forensic blockchain work, it's a smaller recovery than the headlines make it sound, and it will not stop the next pipeline or hospital or school district from getting encrypted next week. Off to go stare at my own backup scripts and feel briefly responsible.