Sleuthing DarkSide Crypto-Ransom Payments with the Wolfram Language

blog.wolfram.com

5 pointsblopeur6 comments

If the private key of the DarkSide's account was compromised by the US gov, then why aren't there any transactions outgoing from the main account to which the ransoms were funelled?

This account still has 107 BTC in it.

Thoughts?

https://www.blockchain.com/btc/address/bc1q2sewgrnau4e4gvceh...

Because that’s not the one that was compromised.

Do you have the address that was?

The warrant has the address (well, with the first part obscured.)

https://www.justice.gov/opa/press-release/file/1402051/downl...

You’re right. The compromised account had 63.7 BTC.

And from the verbiage here it sounds like the FBI might have already compromised the private key before the transfer?

https://threatpost.com/fbi-claws-back-millions-darksides-ran...

They explictly sought the warrant to allow them to use the private key that they already had to seize the funds, yes.

Reply on news.ycombinator.com