How the Colonial Pipeline attackers cashed out their bitcoin ransom

Last month, a cybercrime group called DarkSide trained its fire on the Colonial Pipeline — one of the largest fuel veins in the southeast United States. The group seized the pipeline's network and demanded a bitcoin ransom for its return.

The resulting delay in service dried up gas stations in Georgia, North and South Carolina. Colonial eventually paid up, sending DarkSide 75 bitcoin, worth around $5 million at the time.

Then DarkSide started trying to cash out.

A few years ago, this would have been a much simpler task: there were plenty of cryptocurrency exchanges that wouldn’t have asked for identification before changing the money, or that were relatively easy to defraud.  

But regulators around the world have since cracked down on crypto money-laundering, and blockchain analytics specialists have gotten better at following the money.

“Over the past decade, the proportion of all proceeds of crime in Bitcoin being sent to exchanges for laundering has dropped approximately 30%,” says Tom Robinson, co-founder and chief scientist at the blockchain analytics firm Elliptic. 

That’s made crypto money laundering such a sophisticated challenge that professional services have arisen to meet the need, Robinson says. DarkSide apparently took advantage of one of those services. 

The world’s #1 darknet market

Elliptic has identified a bitcoin wallet used by the DarkSide hackers, who are believed to be Russian, and noted that it received 75 BTC from Colonial Pipeline on May 8. 

According to the firm’s analysis, the cybercrime group sent 18% of that stash to “a small group of exchanges.” An additional 4% was laundered through what Robinson calls the “world’s largest darknet marketplace,” called Hydra. 

Elliptic has chronicled how Hydra has filled a hole left by the closure of other prominent darknet marketplaces — and gotten very rich doing so. AlphaBay, one of the largest dark web markets, had collected $500 million in bitcoin payments before it was shut down in 2017 and its former moderator was sentenced to 11 years in prison.

As of last year, Hydra had received $1.4 billion in bitcoin payments.

Elliptic isn’t the only analytics firm that’s been watching Hydra grow into a powerhouse. “Over the past year, over $100 million in funds have flown into Hydra per month, and oftentimes significantly more than that,” says Kim Grauer, director of research at Chainalysis.

A big difference between AlphaBay and Hydra is that the latter primarily serves only Russian-speaking customers, says Grauer’s colleague Carles Lopez-Penalver, Chainalysis’s cybercrime analyst.

“Most darknet markets service customers and vendors from the West due to how easy and relatively cheap it is to deliver the funds,” Lopez-Penalver says, adding that deliveries inside some of the countries that Hydra serves are unusually difficult and require regional specialization. “Having a darknet market specific to the area makes economic and logistic sense.”

Robinson points out that cybercrime has flourished in former Eastern Bloc countries, in part because local authorities are reluctant to prosecute cybercrime against foreigners — and because these countries lack extradition treaties with the nations where the targets reside. 

Bitcoin to cash

As a result, there’s a high demand from Russian-speaking cybercriminals for services that can convert their illicitly gained digital assets into traditional money. 

According to a 2019 report from the investigative Russian media site Project, vendors on the Hydra platform sell illegal transactions like drug trading, counterfeiting documents and currency, hacking services, and, yes, crypto-money laundering. 

Hydra offers a variety of ways to help users exchange crypto for money that can be more easily used in the real world. Some vendors will exchange prepaid debit cards for bitcoin, while others send rubles to a digital wallet or bank account for a fee. 

Some sellers on Hydra also offer a specialized courier system that “sets it apart from other marketplaces,” says Dave Jevans, CEO of the blockchain analysis firm CipherTrace. 

“Dark markets typically use a sell-and-ship model that leaves law enforcement and investigators multiple breadcrumbs for potential tracking,” Jevans explains. Hydra, on the other hand, uses a courier system. “Neither buyer, seller nor courier ever cross paths in person,” he says.

In a recent blog post, Robinson described a specific vendor on Hydra whose couriers, called “droppers,” bury vacuum-sealed packages of cash five to 20 centimeters below ground in a specific location for the customer to pick up later. This particular service costs customers around 7% of the exchanged amount.

It's also risky. "Thieves known as 'seekers' sometimes trail the treasure men and steal the deliveries," writes Robinson.

According to Robinson, the extreme lengths that people are willing to go to cash out is "telling" and it reflects the success that regulators around the world have had at eliminating crypto money laundering opportunities at crypto exchanges.