Ulrich Schmidt details the case that saw South Korean authorities handed back a huge haul of stolen crypto.
Hackers who stole 320.88 Bitcoin (BTC), then worth approximately $40 million, have unexpectedly given it back to the South Korean government.
South Korean authorities announced that they had received the Bitcoin after those responsible for the hack returned the stolen funds to the authorities’ wallet. No suspects have been arrested or private keys seized by the authorities.
Whilst it is unclear why the funds were returned, it is understood that the South Korean authorities’ swift action following the discovery of the theft left the thieves with no possibility to liquidate the stolen funds. South Korean authorities had asked domestic and international exchanges to freeze any transfers from the linked addresses, making it nearly impossible for the hackers to convert the Bitcoin into cash.
Faced with this liquidation issue, as well as the decreasing value of the stolen funds – which had dropped to being worth $21million – the hackers were left with limited options. The outcome represented a clear victory for the authorities – showing the value of decisive action.
Once the authorities realised the funds had been returned, they moved the Bitcoin to a secure wallet at a well-known South Korean exchange in order to prevent any repeat thefts. Investigations are ongoing to track those responsible for the hack. Officials have emphasised their determination to arrest the thieves and to understand exactly how the theft was carried out. It is thought the Bitcoin was stolen as the result of a phishing attack that saw police staff tricked into giving away wallet login info.
Possible
As blockchains are transparent, it can be possible for investigators to track stolen funds as they are moved between wallets. Equally, this presents hackers with an opportunity to return assets if they want to be treated leniently if caught and / or find it impossible to move the proceeds of the theft.
The best lesson to be learnt from this case is that speed is the name of the game. Anyone that has become victim to a phishing attack must contact their wallet/exchange provider, the authorities and a lawyer as soon as possible. Government authorities and investigators are becoming faster at alerting exchanges, who then freeze the funds.
That said, hackers are becoming more adept at transferring the funds away swiftly and making it difficult to follow their trail. We have seen the professionalisation of crypto theft over recent years. Certain nation states now actively engage in evading sanctions via crypto, meaning they have an active interest in supporting exchanges and mixers that allow them to launder stolen or illegal funds. As such, whilst countries such as the US and the UK can sanction exchanges that allow stolen funds to be moved through them, the increasingly professionalised criminal landscape is making this extremely difficult.
