The Federal Bureau of Investigation (FBI) on Monday claimed it has seized $2.3 million worth of Bitcoin paid by the Colonial Pipeline in a ransomware attack after obtaining a court order. The alleged funds were found on a North California server, but the federal agency refused to clarify how they managed to access the Bitcoin wallet. The DOJ claimed,
Law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victims ransom payment, had been transferred to a specific address, for which the FBI has the “private key,” or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address.
The early perception was that the FBI managed to get their hands on the private key to the Bitcoin wallet, but people with the understanding of the matter questioned how a hacker group so sophisticated that managed to shut down the whole infrastructure could not keep the private keys to their Bitcoin wallet safe.
One theory suggests that the hackers had put the Bitcoin into a custodian wallet of exchange in North California for selling and the FBI managed to track the funds and seize them before it could have been liquidated. This is more believable since the agency wont need a court order to seize Bitcoin if they had private key access.
Does FBIs Action Raise Bitcoin Network Vulnerability Concerns？
Connecting the dots between the Federal agencys claims and how the Bitcoin network functions, it seems there was no breach of security on the Bitcoin network. The FBI can for sure get a warrant to seize the funds from a custodial wallet, or against an exchange, which seems to be the case here.
One of the agencys spokesperson revealed that they cannot dwell into the means that the FBI used to gain access to the ransom Bitcoin and said,
“I dont want to give up our tradecraft in case we want to use this again for future endeavors,”