14 ms·
The statement of facts is linked to from the press release, and describes generally how the Feds were able to trace the stolen funds (they found a file listing
by danso 5y ago
The statement of facts is linked to from the press release, and describes generally how the Feds were able to trace the stolen funds (they found a file listing private keys, after gaining access to the suspect's cloud storage)
https://www.justice.gov/opa/press-release/file/1470186/download https://www.justice.gov/opa/press-release/file/1470186/downl...
> The 2017 transfers notwithstanding, the majority of the stolen funds remained in Wallet 1CGA4s from August 2016 until January 31, 2022. On January 31, 2022, law enforcement gained access to Wallet 1CGA4s by decrypting a file saved to LICHTENSTEIN’s cloud storage account, which had been obtained pursuant to a search warrant. The file contained a list of 2,000 virtual currency addresses, along with corresponding private keys.
> ...The connection among the VCE 1 accounts was further confirmed upon reviewing a spreadsheet saved to LICHTENSTEIN’s cloud storage account. The spreadsheet included the log-in information for accounts at various virtual currency exchanges and a notation regarding the status of the accounts
> ...Lichtenstein Email 2 was held at a U.S.-based provider that offered email as well as cloud storage services, among other products. In 2021, agents obtained a copy of the contents of the cloud storage account pursuant to a search warrant. Upon reviewing the contents of the account, agents confirmed that the account was used by LICHTENSTEIN. However, a significant portion of the files were encrypted
- colinmhayes 5y ago$4 billion has got to buy an awful lot of compute time, but still, how did they decrypt the file?
- danjac 5y agoPrivate key was uploaded to cloud storage that Feds had access to with a search warrant.
- raverbashing 5y agoA fancy (or even basic) dictionary attack has a very high chance of working.
- lupire 5y ago$4B should buy a very, very fancy dictionary.
- 14 5y agoRandom example but my passwords look something like chOf$Tyl83fhn@54R. I keep them written down because they are hard to remember. My threat model is no one. Seems so amateur to use a simple password that could be brute forced. Especially with so much on the line.
- gruez 5y ago>Seems so amateur to use a simple password that could be brute forced. Especially with so much on the line. There's selection bias going on because only dumb criminals get caught, so you only hear about the dumb opsec practices of those criminals. Conversely, you'll never hear about the opsec practices of that professional crew with perfect opsec that hacked an exchange/difi contract and disappeared into thin air.
- not2b 5y agoUntil the least bright member of the crew makes a mistake, gets caught, and turns in the rest. Being perfect is difficult to maintain forever, though it's possible in principle. It might require the thief to live like a grad student even though he has billions of dollars/euros worth of stolen wealth; being flashy attracts attention and if nothing else, the tax authorities.
- trhway 5y ago>how did they decrypt the file? keyloggers for example.
- avrionov 5y agoHere is the most likely approach: https://xkcd.com/538/ https://xkcd.com/538/
- fisherjeff 5y agoOne route would probably be to start with a warrant to search their house in hopes of finding some passwords written down somewhere
- pbhjpbhj 5y agoUnder what premise are they getting the warrant? This absolutely sounds like parallel construction.
- fisherjeff 5y agoI assume they’d get it on roughly the same basis as the warrant they got for the cloud storage. I’m also curious what here looks like parallel construction to you - I thought the statement of facts was surprisingly mundane, but perhaps I missed some red flags?
- tevon 5y agoIs it me or should he have literally just gotten a hardware wallet, transferred everything to that account, then burned the old key? Of course that txn would show up on-chain, but if you don't have possession of the private key for the first account, and no digital device has ever "seen" the hardware account then he would've been fine. This is assuming the key piece of evidence was his private key, and he wouldn't have been prosecuted without it. Additionally, putting your key in cloud storage sounds like the dumbest thing ever... Just memorize your seed phrase and write it down. Its 4bn for christ sake.
- pshc 5y agoYeah, a hardware wallet is good, although for a billion dollars, 100 hardware wallets would be better. Could even go so far as to split a private key into seven horcruxes using Shamir's Secret Sharing and bury them in locations around the world. Memorizing a seed phrase leaves you vulnerable to a $5 wrench attack, I wouldn't recommend it.
- mekster 5y agoFor the attacker, the problem isn't about protecting the crypto but to launder. If gov got to you, it probably doesn't matter how well you got it protected.
- GekkePrutser 5y ago> Memorizing a seed phrase leaves you vulnerable to a $5 wrench attack, I wouldn't recommend it. Of course the problem is the attacker may not know what method you used and resort to the $5 wrench attack anyway :) Not stealing $3.6B might be an even safer bet.
- jerrre 5y agostill: physical threat + seed phrase cracked > physical threat
- hnburnsy 5y agoThe famous Bitcoin family reportedly spread their hardware wallets across the globe. https://www.cnbc.com/2021/08/11/bitcoin-family-hides-bitcoin-ethereum-and-litecoin-in-secret-vaults.html?&doc=107011542 https://www.cnbc.com/2021/08/11/bitcoin-family-hides-bitcoin...
- ctvo 5y ago> ...Lichtenstein Email 2 was held at a U.S.-based provider that offered email as well as cloud storage services, among other products. Reads suspiciously like Gmail. Oh no. You stored your keys weakly encrypted on Google Drive?!
- hobo_mark 5y agoOr Microsoft, but yes, indeed...
- caf 5y agoOr Apple...
- GrantZvolsky 5y agoIt wasn't necessarily weakly encrypted. The key may have been compromised, which I find more likely.
- YarickR2 5y agoThermorectal cryptanalysis, for sure (relevant xkcd mentions pipe wrench, though)
- deleted 5y ago[deleted]
- EVa5I7bHFq9mnYK 5y agoI doubt it was weakly encrypted. But FBI has non-brute force decryption methods at their disposal.
- sschueller 5y agoA little thin on details. I wonder if they tracked down IP addresses at the exchanges.
- duxup 5y agoThere was a reward offered by Bitfinex. It's possible someone simply dropped a dime on these guys and after that everything fell into place.
- tyrfing 5y ago> they found a file listing private keys, after gaining access to the suspect's cloud storage That's backwards. It's how they wrapped it all up. The real trail is pretty clearly AlphaBay 2016/2017 transactions (under gov control around that timeframe), to KYC-flagged accounts at an exchange, with a web of accounts with real info linked together past there.
- cobookman 5y agoIf he instead started to draw NFTs, and sell it from his KYC account to his dirty wallet, could he still be convicted? What if only one out of every 100 NFTs his dirty wallet purchased was from his KYC account? Or what if he decided to create his own crypto-currency and it just so happened that his dirty wallet was an early investor of ETH to his fund. Seems like he could have done more to distance himself.
- saalweachter 5y agoStart a PAC for the decriminalization of money laundering, accept donations at a Bitcoin address, pay yourself a million a year to run it.
- twox2 5y agoThere wasn't a big NFT market until very recently.
- toomuchtodo 5y ago> Seems like he could have done more to distance himself. On a value system with an inherently public ledger that eventually has to hit a fiat off ramp with KYC/AML requirements? Nah. Everyone has quality opsec until they don't, and the record of your criminal activity is immutable and highly durable.
- EVa5I7bHFq9mnYK 5y agoSuppose he deposited it into AlphaBay and then withdrew from AlphaBay, and FBI didn't seize AlphaBay's logs. Where is the criminal immutable durable record now? There is no proof of connection between incoming and outgoing coins. Same principle with mixers.
- GekkePrutser 5y agoWow. Such hacking prowess. Such bad opsec. Weird. Ps not condoning the theft but I just find it strange that people with the skills to steal this much get caught using bog standard cloud storage. You'd think they could afford something better ;) Something along the lines of "you don't take notes on a criminal f** conspiracy" :)
- wolverine876 5y agoPeople are sometimes too busy to deal with the many details of 'perfect' opsec. In other circumstances, they hire a professional to handle it for them, but that is more difficult for criminals.
- SirYandi 5y agoThe article mentioned they were not thought to have conducted the hack itself.
- GekkePrutser 5y agoAh ok sorry I checked the comments only. Should have read TFA sorry :)
- EVa5I7bHFq9mnYK 5y agoThat's just author's speculation. Most probably he did conduct the hack himself, because he had private keys to all the original withdrawal addresses.
- digianarchist 5y agoHonestly don’t know why people don’t AES/GPG encrypt the keys and send a message to alt.anonymous.messages. That’s 30+ years of storage for free.
- vmchale 5y agomaybe he backed up to icloud by accident