US returns $154M in bitcoins stolen by Sony employee
bleepingcomputer.com
bleepingcomputer.com
But the really big question (not addressed in the article) is this: How did the FBI get the private key(s) for the wallet?
Tends to be effective. The entire US justice system relies on this dynamic. It cannot handle even a couple of percent of cases making it to trial.
Like the could have also seized is electronic devices and just found a copy of the key somewhere.
And I would bet the FBI is not going to say publicly. It could be beneficial to the US Government to have people believe they have the capability to just steal private keys, even if in fact they just negotiated for it.
Ultimately, the point is “once law enforcement has you and your devices in their hands, it’s probably all over”.
I like how the lawyer in this interview doesn't seem impressed by the system he has to work in.
[counter-intuitively you have to tell law enforcement you don't want to speak, you cannot just remain silent to invoke your right to silence: "The Court held that because Thompkins did not say he wished to remain silent or did not wish to speak to the officers, he had not invoked the right to remain silent." https://www.tdcorg.com/article/invoking-right-to-silence-mus... ]
https://www.washingtonpost.com/news/true-crime/wp/2017/11/02...
> [When] a suspect in an interrogation told detectives to “just give me a lawyer dog,” the Louisiana Supreme Court ruled that the suspect was, in fact, asking for a “lawyer dog,” and not invoking his constitutional right to counsel.
This is both normal and good. Suggesting otherwise would be ridiculous.
The private key seizure and the arrest happened on the same day (Dec 1).
Their wording actually in other cases makes it seem like they have already derived the private keys and move to seize it once establishing any US nexus. They’ll say things like “we noticed we had that private key” and ask a judge for forfeiture, which is surprisingly professional restraint but curious.
Should be investigated further.
People should use multisig in something brazen and see if it still happens. Taproot helps make multisig use indistinguishable from non-multisig.
and then I see poeple defending btc price action being legit
if this guy was able to do that, in a company that is part of nasdaq, has sec watching it and so on, imagine whats happening on binance and all those others offshore/shady exchanges
The guy was caught in short order so he really wasn't able to do it. You can steal money pretty easily in the traditional financial system with a simple forged check. Money will likely go through initially but you also will likely be caught in short order.
My point is, coinbase still allowed 154millions USD to be washed on it's exchange. By a random guy who clearly didnt even bother cover his back, imagine what actual organized crime is doing with offshores exchanges.
KYC isn't meant to prevent money from moving at all, it's meant to enable tracing of the money.
Just the fact that he was in tokyo (japan), instead of a non US aligned country, such as Russia or China, that he had his private keys easy accesible and that he stayed in BTC instead of going for another crypto more anon friendly, says a lot of the stupid nature of this "criminal"
But once again, my whole point is, coinbase allowed a random person to deposit 154 millions USD and withdraw 3.8k btc with absolutely no problems? and in a quickly way, according to the original article
I think its safe to assume that the banks said, okay the money went to coinbase, and coinbase just said yeah about that, he used the money to buy BTC and withdrew it to this wallet and thats about it
the guy was located cause he didnt even try to hide himself, the rest is history.
my point remains, if this, that was a such dumb crime, managed to convert the stolen funds into BTC using coinbase with absolutely no problems, then its easy to assume that real and strong money going to biggest offshores exchanges is from illicit sources.
I don't get why that was not an option.
Coinbase does not serve PRC citizens or Russians (see https://www.coinbase.com/places). Exactly so that any money laundering can be caught by US government.
Don’t put words in a mouth that never said it.
And as a person (citizen), yes. As a business, one doesn’t care if bread or guns they make help potential criminals to live or murder. If you don’t ask your customers if they are “bad guys who have all the paperwork but still stolen this money” at the doorstep, don’t blame others. Regulations are there for you to not trouble your head about it, just follow them.
Why are you stating this as if it an unquestionable fact? It sure as hell isn't.
To go into more detail, claims like "he was only barely caught" shadow the possibilities of him being caught later, which never had a chance to be realized. i.e. it may appear that he was caught randomly but we owe it to truth to at least dig into what would have happened if that had failed - and that likely requires a domain expert to know the actual security measures in place.
A single person controlled the transfer instructions via email for a $150M insurance transfer.
By falsifying the email instructions for the fiat transfer $150M was sent directly to his personal account (no red flags there).
Then he was able to transfer $150M from his personal account to coinbase (no red flags there).
Why is your focus on the coinbase conversion from fiat to Bitcoin?
This does not happen in crypto.
Despite all the deflection, law enforcement was able to recover the Bitcoin. Contrary to your point law enforcement and regulators alike have successfully brought legal actions (civil) and prosecutions (criminal) in the blockchain space just as they have against traditional institutions.
The insurance company, banks, and coinbase are all to happy cryptocurrency was involved at some point so they can do some magic hand waving, and blame cryptocurrency. I would ask why bother, but obviously it’s a successful PR campaign to excuse their own ineptitude.
This is a downright lie, I’m not sure why people keep repeating it. Doesn’t stand to the least bit of scrutiny, BEC schemes are stealing billions and billions via the traditional financial system. Once that money gets sent overseas, nothing is easy.
[0] -https://www.documentcloud.org/documents/21165768-us_vs_rei_i...
It's also that multiplying the current price by the number of coins just doesn't mean anything. The resulting number doesn't represent anything real.
It is also true for any regular stock. “Market cap” is just an indicator value of a stock at a given time, not the value, and no one expects all of it to be sold at that sum, because of market dynamics. The resulting number doesn't represent anything real regardless of the asset class. The only difference between crypto and some stock market traded company shares is that the latter has usually a known non-zero value at the assets level, everything else is just a thin air of trust and expectations. You may see cryptohead-ance as crypto’s base assets.
The market cap of crypto doesn't even indicate anything. "Buying every bitcoin" doesn't mean anything. There's no value in doing so, unlike buying an entire company.
I think you err in this part. It doesn’t mean anything to you, if you’d buy that. Well, buying all of rice doesn’t mean anything to me (I can’t eat it for unrelated reasons and have no other uses beyond that). But other people value some properties of crypto, in the same way they value e.g. Intel much more than its raw factory floors and assets. Nobody would buy crypto if they thought it is worthless. But they have thought otherwise. They bought it at 0.00001, at 0.1, at 100 and at 60000 USD. You are basically saying that you don’t need crypto, even all of it for zero money. Well, this is a personal choice, not something one has to argue with or prove to others. People define value by supply and demand. Market cap is an aggregate indicator of their supply/demand equilibrium times the circulation volume.
If you buy every bitcoin, you have nothing. I don't meant that in the sense that bitcoin isn't backed by anything, I mean that in the sense that bitcoin is only meaningful when it is traded between people. If you buy every single bitcoin, bitcoin is dead. It is a nonsensical thing to do. Trying to figure out the price for which it can be done is nonsense, as well.
That’s not really a compelling story.
The only thing that was mine on the check was the account number.
Yet the check sailed through and was honored and my account debited.
The bank insisted this was all my fault. The bank insisted they couldn't do anything about it. The bank insisted I call this number, which simply gave me more runaround. So I decided to camp out in the branch manager's office, until they gave up and refunded me the lost money.
The cake topper on all this is they then tried to sell me expensive check "security" paper.
What a sick joke.
What was surprising to me, is that my legacy account# were still in the system (My bank was bought and then bought... 4 times.. over the years).
Good you got your money back m
In this case, the wallet was emptied.
The traditional similar thing would be the bank account that is emptied.
A forged check would not be sufficient at all. Even for 0,05% of the amount stolen here and it would only be where checks are valid ( would be worthless outside the US)
Do you honestly think being part of the nasdaq is a sign of legitimacy?
He opened up the account in the employer's name, submitted notarized documents, etc.
https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery
"Thirty-five fraudulent instructions were issued by security hackers via the SWIFT network to illegally transfer close to US$1 billion from the Federal Reserve Bank of New York account belonging to Bangladesh Bank, the central bank of Bangladesh. Five of the thirty-five fraudulent instructions were successful in transferring US$101 million, with US$20 million traced to Sri Lanka and US$81 million to the Philippines. The Federal Reserve Bank of New York blocked the remaining thirty transactions, amounting to US$850 million, due to suspicions raised by a misspelled instruction.[2] All the money transferred to Sri Lanka has since been recovered. However, as of 2018 only around US$18 million of the US$81 million transferred to the Philippines has been recovered.[3] Most of the money transferred to the Philippines went to four personal accounts, held by single individuals, and not to companies or corporations"
and then they point to the user experience of how banks at least pretend like the money was returned, which is convenient for the user, something that is also possible to do with using an optional bank custodying crypto deposits.
My comment was not intended to promote the idea that the existing financial system is comparable in the frauds and crimes that happen, just that it's an overstatement to say people never steal millions in an irreversible way.
The difference in this case is that he allegedly wasn't authorized, which means he's going to jail. But how is the bank supposed to know that?
Some classic social engineering when he calls Citibank and convinces them to change they email address they have on record for approving transactions.
I have no idea how this passed Coinbase's KYC limits, there must be much more to the story here. I can't imagine that it was a typical self-serve trade via their web UI, he surely developed some form of OTC relationship with Coinbase to pull off buying this much BTC and successfully withdrawing it.
~$144m of May 2021 BTC turned into ~$221m in December at the time of seizure, if they decide to realize the gains.
He fraudulently opened a Coinbase business account for SA Reinsurance, a Sony Life subsidiary. The SA Reinsurance documents he submitted were legitimate, but he was not authorized to open such an account.
You know how people criticize these blockchains for having slow transaction rates? Yeah, well, combine that with the fact that all of the transactions are public and that they tend to be interconnected (it’s a network after all) and it isn’t hard to see why chain analysis isn’t particularly difficult.
My point is, even if this guy didn’t use Coinbase and went way off into the wilderness, they’d find him. I think the FBI et al let a lot of the lesser crimes go “unsolved” so criminals don’t get too smart about this too easily.
Again — for better or worse, a lot of crimes that matter to you and I are just not that important to people who view the full ecosystem of criminality from 10,000 feet up. Some of those dark markets are a lot darker than the others...
Back to your point, how are you planning on converting your fiat into crypto, and are you sure that all of the other wallet addresses etc associated with the transaction are totally “clean?” And remember, ISPs etc are going to give up all of that info easily, so can you guarantee that those other wallets you used weren’t ever opened or accessed on the same network / IP / etc? Once you start aggregating data points it’s not terribly difficult for most transactions. Yes, there’s still some that are super hard, but you can imagine that de-anonymizing those would be a very fun detective game, rather than an impossibility that causes investigators to give up.
Also compounded that some markets require Monero - why would they require something that makes their jobs harder?
>"This case is an example of amazing work by FBI agents and Japanese law enforcement, who teamed up to track this virtual cash. Criminals should take note: You cannot rely on cyptocurrency to hide your ill-gotten gains from law enforcement," said Acting U.S. Attorney Randy Grossman.
Heh... I would wager most of the world's USD is equally virtual.
Reality: FBI junior recruit hits you with a wrench until you tell them what the key is.
IE rather than biding time for multiple days and sending threatening ransom notes, if the money simply turned up a day later with a transaction description of "I don't think you meant this for me."
But then, it isn't exactly hard for people to guess the motive behind a days holding of large sums of money and the "business email compromise" is pretty blatant.
No idea how to turn fiat into crypto not through a Coinbase though
The hadline makes it seem Sony had so many bitcoins, and they were stolen. No, Sony had cash, it was stolen, and got converted. An equivalent headline might be "US returns $154M in Lamborghinis stolen by Sony employee." and you'd be wondering Why Sony had so many Lamborghinis...