US Recovers Most of Ransom Colonial Pipeline Paid to Hackers

Deputy Attorney General Lisa Monaco is followed by FBI Deputy Director Paul Abbate as she arrives to speak about the Colonial Pipeline ransomware attacks during a news conference at the Justice Department in Washington on June 7, 2021. Jonathan Ernst/Pool/Reuters

The United States has seized most of the cryptocurrency paid to hackers that took hostage portions of Colonial Pipeline’s system last month leading to soaring gas prices and station outages.

The Department of Justice seized nearly 64 bitcoins, worth about $2.3 million. The action was made possible by a search warrant authorized by U.S. Magistrate Judge Laurel Beeler. In an affidavit (pdf) supporting the warrant application, authorities said they reviewed bitcoin’s public ledger and pinpointed the transfer of the ransom to a specific address. They then obtained the private key, or the rough equivalent of a password, required to access the assets. It’s not clear how agents obtained the key. The warrant (pdf) authorized them to seize property located in the Northern District of California.