The U.S. Department of Justice (DoJ) has recovered most of the $4.4 million Colonial Pipeline paid to the DarkSide ransomware. On May 7, Colonial Pipeline (the company that manages the largest natural gas pipeline in the U.S.) was hacked by the DarkSide ransomware gang, forcing it to shut down the pipeline. This resulted in temporary natural gas shortages on the U.S. East Coast.
Due to the critical nature of the outage, Colonial Pipeline paid a $4.4 million ransom to the hackers to obtain a decryption key and quickly bring its systems back online.
Read also: DarkSide ransomware gang made $90 million in 9 months
The DarkSide ransomware gang has shut down its "operation"after facing heavy scrutiny from the US government and law enforcement.
The DoJ announced, on June 7, in a press conference that it had seized a cryptocurrency wallet used by the DarkSide ransomware gang, which contained the ransom paid by Colonial Pipeline.
In a statement filed in the U.S. District Court for the Northern District of California, an FBI said law enforcement gained control of a private key belonging to a Bitcoin belonging to the gang, which contained the Colonial Pipeline ransom.
See also: The DarkSide ransomware gang ends its "operation"!
Access to the private key of the cryptocurrency wallet allows full access to the wallet and the funds contained within it. Using that private key, the FBI recovered 63.7 Bitcoins paid by Colonial Pipeline, Deputy Attorney General Lisa Monaco. With Bitcoin’s price having fallen significantly to $36,000 from its high of $63,000 in April, the recovered Bitcoins are worth about $2.26 million at today’s prices.
It is unclear how the FBI gained access to the private key for DarkSide's wallet, however on May 14, the gang claimed to have lost access to one of its payment servers.
Furthermore, a few hours after the seizure, the DarkSide ransomware gang reported to its associates that the money from the payment server (which belonged to it and its customers) was transferred to an unknown account.
Suggestion: Coveware: Ransomware victims' ransom payments have increased
Monaco also stated that this is the first operation of its kind conducted by the recently launched Ransomware and Digital Extortion Task Force
Specifically, he stated the following: "The seizure announced today was made in the context of the recent operation of the Ransomware and Digital Extortion Task Force, which was created to investigate, disrupt and prosecute ransomware and digital extortion activity. It is the first operation of its kind by the Task Force."
This recovery may be the first time the US government has publicly stated that it has recovered ransoms paid to a ransomware gang.
