Hacker transferred bitcoins stolen from FSB, SVR and GRU to Ukraine

By nigratan

nigroll.com

2 min

May 1, 2023

An unknown hacker (who may even be a member of the Russian special services) has identified 986 bitcoin wallets controlled by the FSB, the Foreign Intelligence Service and military intelligence (Main Directorate of the General Staff of the RF Armed Forces). He destroyed $300,000 worth of bitcoins in them, and then began to transfer the cryptocurrency to Ukraine.

This was told by CoinDesk, which received a case report from Chainalysis, an American company engaged in blockchain analysis and cryptocurrency operations. Chainalysis' clients include the US government.

According to Chainalysis, to find intelligence wallets, an unknown person used a feature that documents transactions on the bitcoin blockchain. This happened before the start of the war in Ukraine, and the hacker sent out a message in Russian, in which he stated that these wallets were used by special services to finance hacker operations.

It is not known whether this is true, but the fact that third parties have previously linked the addresses of at least three of these wallets to Russia adds credibility to such a statement, Chainalysis notes. Two of them were related to the attack on the American IT company Solarwinds in 2020, during which more than 200 client organizations around the world were affected. In the US, Solarwinds is considered one of the most serious cyber attacks that led to data leakage from a number of US agencies, as well as NATO, the UK government, the European Parliament, Microsoft, and others. 2016

At first, the hacker wanted to destroy bitcoins from the found wallets, and using the OP_RETURN function, which cancels previous transactions, he did this with $ 300,000 worth of cryptocurrency, Chainalysis estimated. According to its experts, his willingness and ability to do this confirm the statements of the hacker.

But after the Russian invasion of Ukraine, he began sending cryptocurrencies to wallets opened by the Ukrainian government to raise funds to fight aggression, Chainalysis noted: “In fact, the mysterious hacker stopped destroying money and started sending it to help Ukraine.”

At the same time, according to her analysis, he received access to the crypto wallets of the Russian special services not as a result of hacking, but with the help of “insider actions”.

“Put simply, this person could have infiltrated a hacker network working for Russia, or could have been a member of the Russian intelligence services who switched sides,” Chainalysis said in the report.