The below referenced WSJ article, describes one of the keys that led to their capture. Apparently, one specific purchase they made was that of a 500$ Walmart gift card. The purchase was made in 2020, providing a Russian based email service, but using and IP from a provider in NY. The gift card was purchased using BTCs sent from an address that was amongst a cluster of addresses that the federal agents was investigating (I figure not the original addresses from the robbery, but derived through chain analysis).
The gift card was subsequently used from the Walmart App to purchase goods, and deliver them to their home address. Additionally, one of their real more frequent emails was used to tie the purchase/delivery cycle.
The agents managed to get access to the email account and their Cloud account (probably one led to the other), and eventually to the encrypted files, which contained access codes and BTC addresses of essentially all their assets (I can’t be sure if all this was hosted on Exchanges with multiple identities – some being their real ones-, or whether they has any hardware wallets – the latter is not referenced).
The way I see it, some of the internal keys to the chain of events are:
- Chain analysis
- The Walmart gift card reseller must have still had all the TX data (email, IP, BTC address, voucher code, etc.), and the agents gained access to this information (linking a monitored BTC address to a Walmart voucher code). It would be nice to know who the reseller was, and their alleged data policy.
- Not quite sure on the ISP provider’s role, but he probably sent all available data too (the article does not make it clear if the NY provider was a plain ISP or a VPN provider).
- The email account, used to redeem the gift card, seemed to be a real account that was made accessible to the authorities (i.e. gmail or alike, I figure).
- The Cloud account was made accessible to the authorities (so either the keys were in the email, which I doubt, or the service is in a jurisdiction than can easily be accessed by the authorities through a court order or such).
- The encrypted files on the cloud account were no match for the investigator’s cracking tools. Perhaps they had weakish passwords, or we’re more exposed than we believe.
There were human errors covering their tracks, possibly thinking they were pretty well in the clear, and not thinking through the Gift Card ties. Nevertheless, the investigators undoubtedly have powerful resources to link, monitor and even crack what one may naively believe is well hidden and protected.
See:
https://web.archive.org/web/20220215224322/https://www.wsj.com/articles/bitcoin-bitfinex-hack-crypto-laundering-morgan-lichtenstein-11644953617