US Seizes 63.7 Bitcoin From Colonial Pipeline Ransom

The U.S. Department of Justice announced on June 7, 2021 that it had seized approximately 63.7 bitcoin connected to the ransom Colonial Pipeline paid after the DarkSide ransomware attack. The agency valued the seized BTC at approximately $2.3 million when it made the announcement.

The recovery was consequential beyond its dollar value. It demonstrated that Bitcoin’s public transaction history could help investigators trace criminal proceeds—and that traced assets could be seized when authorities also obtained the cryptographic credentials needed to move them. The record did not show that investigators broke Bitcoin’s cryptography or gained a general ability to reverse transactions.

From the ransom address to the seizure

An FBI affidavit filed in the U.S. District Court for the Northern District of California on June 7 described the government’s evidence. Colonial, identified as “Victim X” in the filing, reported an unauthorized network intrusion and ransomware attack on or about May 7. Systems involved in its business were affected, prompting the company to remove portions of its critical infrastructure from operation.

The affidavit said Colonial was instructed on May 8 to send approximately 75 BTC, calculated at approximately $4.3 million on that date. Investigators examining the Bitcoin public ledger found that the designated address received two payments totaling 75.0005 BTC. They then traced transfers through additional addresses and located approximately 63.7 BTC attributable to the payment.

U.S. Magistrate Judge Laurel Beeler authorized the seizure warrant on June 7. The Justice Department said the FBI possessed the private key for the address containing the recoverable funds. Possession of that key—not observation of the blockchain alone—provided the ability to transfer the bitcoin under the warrant.

Using the rounded quantities announced by the government, 63.7 BTC represented approximately 84.9% of the roughly 75 BTC ransom by bitcoin count. That is a Coinburn calculation, not a percentage reported in the court filing. The calculation is necessarily approximate because the government described the seized amount as “approximately” 63.7 BTC while the affidavit recorded the original receipts more precisely as 75.0005 BTC.

Why the recovery mattered

The action placed Bitcoin’s competing properties in sharp institutional focus. A user can create and transact through addresses without placing a legal name directly on the public ledger, but transfers between those addresses remain visible. Investigators can follow that history, combine it with evidence obtained elsewhere and seek judicial authority against identified assets.

Traceability, however, is not the same as custody. A public address and its transaction history do not reveal its private key. The June 7 records did not explain how the FBI obtained the key or identify the infrastructure associated with the address. Any claim that the government hacked Bitcoin itself, compelled a particular exchange or exploited a weakness in the protocol went beyond the disclosed evidence.

Deputy Attorney General Lisa Monaco described the seizure as the first operation of its kind by the Justice Department’s recently established Ransomware and Digital Extortion Task Force. FBI Deputy Director Paul Abbate said the bureau had identified more than 90 DarkSide victims across U.S. critical-infrastructure sectors. Those were contemporaneous government representations, not independently adjudicated findings about every victim or participant.

Valuation and remaining uncertainty

The $4.3 million and $2.3 million figures were government estimates tied to two different snapshots: the approximately 75 BTC payment on May 8 and the approximately 63.7 BTC seizure announced on June 7. They are not a continuous market-price series, an execution record or evidence that the recovery caused a change in Bitcoin’s market price.

The event-day record established the warrant, the tracing account and the seizure. It did not disclose the method by which authorities acquired the private key, determine the final disposition of the funds or adjudicate the liability of every person associated with DarkSide. This reconstruction therefore treats the government’s attribution and forfeiture allegations according to their June 7 procedural status rather than as later-proven conclusions.