Justice Dept. Claws Back $2.3M Paid by Colonial Pipeline to Ransomware Gang
Summary: The U.S. Department of Justice recovered $2.3 million in Bitcoin that Colonial Pipeline paid to DarkSide ransomware operators after a May 7 attack, out of a 75 Bitcoin (about $4.4 million) payment. The DOJ said law enforcement tracked multiple bitcoin transfers and identified roughly 63.7 bitcoins, representing the affiliate's share of the ransom, at an address for which the FBI holds the private key.
What's compelling: Elliptic's analysis found 47 victims paid DarkSide a total of $90 million in Bitcoin, an average of just under $2 million per payment - and the FBI's recovery covered only the affiliate's 85% cut, not the developer's 15%, which shows how much ransom money moves through channels law enforcement cannot reach.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026