back
5 comments
Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.
The FBI doesn't need the VPS to be in the United States for that

The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters

FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances.

Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain.

[1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012)

but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets

The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.
I am by far no ransomware expert, but it really seems like amateur hour if they were running a Linux based Bitcoin full node using the mainline CLI daemon and client, with a wallet, on some hosting company geographically within the United States. Why would it need to be in the US?
I only know a few criminal hackers, but within that sample their skillset is really niche. They know what they know well, but otherwise they're just trying to solve problems like any engineer.

Kinda like data scientists - they can be masters with a couple of libraries and concepts, but if you have a data science team you also are more or less guaranteed to have a jupyter notebook open to the world, or something along those lines.

Don't underestimate the stupidity/incompetence of these ransomware devs. Many cybercriminals have been caught for unbelievably dumb reasons.
The connections need to pass through the US just once in order to give the US a chance to attack it.

Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.

> The connections need to pass through the US just once in order to give the US a chance to attack it.

Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.

True, but it would be far less common I reckon.
So many questions. Why are they running a bitcoin node on a vps? do they need to make automated payments or something? it's very easy to run a bitcoin node locally, or even airgap the signing keys.
Really? That seems like something fairly obvious to attempt to prevent from an attacker's viewpoint.
How? A keylogger? Cache somewhere?
>Based on ... I have probable cause to believe that the aforementioned property may be seized...

Forgive me if this is a dumb question; I have not used a blockchain explorer for anything consequential. Isn't that wallet just the last place it ended up? So, you have chain of custody but does that prove that the owner of that wallet is the "target"?

I think generally speaking, someone in possession of stolen property isn't entitled to keep that property even if they had nothing to do with the theft and had no reason to believe it was stolen. That prevents them from being guilty of a crime - but authorities can still come seize the property without compensating them at all for their loss.

In a way it's similar to getting stuck with counterfeit money. You didn't do anything wrong, but no one is going to just hand you the replacement real money you "deserve" - you just got unlucky.

Nope, but the recipient is welcome to come to the US, show up at the FBI and ask for it back.
The Laywer did a great job explaining Bitcoin.

Can anyone here (hn) add anything?

It seems like steps in the investigation, or process to identifying the bad guys were left out.

The wetware is always the weakest link.
This is why all these gangs will now switch to Monero the moment they get BTC paid.