Bitcoin’s price slipped again Tuesday. The reason for the move was unclear, however it may be related to concerns over security of the cryptocurrency after U.S. officials managed to recover most of the ransom paid to hackers that targeted Colonial Pipeline. CNBC’s Becky Quick and Andrew Ross Sorkin discuss. For access to live and exclusive video from CNBC subscribe to CNBC PRO: https://cnb.cx/2NGeIvi
U.S. law enforcement officials said Monday they were able to recover $2.3 million in bitcoin paid to a criminal cybergroup involved in the crippling ransomware attack on Colonial Pipeline.
“Today we turned the tables on DarkSide,” Deputy Attorney General Lisa Monaco said during a press briefing, adding that the money was seized via a court order.
At the briefing, FBI Deputy Director Paul Abbate said agents were able to identify a virtual currency wallet that the DarkSide hackers used to collect payment from Colonial Pipeline.
“Using law enforcement authority, victim funds were seized from that wallet, preventing Dark Side actors from using them,” Abbate said.
The FBI declined to say precisely how it accessed the bitcoin wallet, citing the need to protect tradecraft.
Elvis Chan, FBI assistant special agent in charge, told reporters that even foreign-based cybercriminals like DarkSide typically use American infrastructure at some point in the course of a crime. When they do, it gives the FBI a legal window to recover the funds.
DarkSide, believed to be a Russian-based criminal organization, operates as a “ransomware as a service” business model, which means its hackers develop and market ransomware hacking tools and sell them to other criminal “affiliates” who then carry out attacks.
It is still unclear who DarkSide’s affiliates were in the Colonial Pipeline attack.
DarkSide’s sweeping ransomware assault on Colonial Pipeline last month forced the company to shut down approximately 5,500 miles of American fuel pipeline, leading to a disruption of nearly half of the East Coast fuel supply and causing gasoline shortages in the Southeast and airline disruptions.
Ransomware attacks involve malware that encrypts files on a device or network that results in the system becoming inoperable. Criminals behind such cyberattacks typically demand a ransom in exchange for the release of data.
Colonial Pipeline paid nearly $5 million ransom to the hackers, one source familiar with the situation confirmed to CNBC. It was not immediately clear when the transaction took place.
The FBI has previously warned victims of ransomware attacks that paying a ransom could encourage further malicious activity.
The government has stopped short of moving to ban ransomware payments altogether, out of concern that it would have little impact on whether or not companies pay ransoms and simply discourage them from reporting attacks.
Monday’s announcement was part of a broader effort to counter the private sector’s longstanding reluctance to publicly report cyberattacks and involve the government in its responses.
“The message here today is that [if you report the attack], we will bring all of our tools to bear to go after these criminal networks,” Monaco said.
Officials stressed the advantages to be gained by companies that report cyberbreaches quickly to the FBI.
“Victim reporting not only can give us the information we need to have an immediate real-world impact on the actors. … It can also prevent future harm from occurring,” Abbate said.
“The private sector also has an equally important role to play and we must continue to take cyberthreats seriously and invest accordingly to harden our defenses,” Colonial Pipeline CEO Joseph Blount said in a statement Monday evening.
Turn to CNBC TV for the latest stock market news and analysis. From market futures to live price updates CNBC is the leader in business news worldwide.
The News with Shepard Smith is CNBC’s daily news podcast providing deep, non-partisan coverage and perspective on the day’s most important stories. Available to listen by 8:30pm ET / 5:30pm PT daily beginning September 30: https://www.cnbc.com/2020/09/29/the-news-with-shepard-smith-podcast.html?__source=youtube%7Cshepsmith%7Cpodcast
Connect with CNBC News Online
Get the latest news: http://www.cnbc.com/
Follow CNBC on LinkedIn: https://cnb.cx/LinkedInCNBC
Follow CNBC News on Facebook: https://cnb.cx/LikeCNBC
Follow CNBC News on Twitter: https://cnb.cx/FollowCNBC
Follow CNBC News on Instagram: https://cnb.cx/InstagramCNBC