Curriculum·Graduate·G103
Fund-Flow Tracing and Forensics
The Colonial Pipeline ransom, May 2021. The operator paid the DarkSide group about 75 bitcoin to restore a fuel pipeline serving the US East Coast.
Start with lesson 14 lessons · about 2.1 hours · free account to read in full
Lesson 1 opens on
Colonial Pipeline ransom, May 2021
4 million dollars, to restore service. The payment did not vanish. On a public ledger every transfer is a recorded edge from one address to another, so the FBI followed the ransom hop by hop across the transaction graph as it was split and moved, until a large portion landed in a wallet whose private key investigators were able to obtain.
The lessons
- G103-01Following a transfer graphModel a set of transactions as a directed graph of value flowing between addressesabout 30 min · opens on Colonial Pipeline ransom, May 2021
- G103-02Through a mixer, and the peel chainRecognize a peel chain: a large sum shedding small amounts through a long chain of addressesabout 31 min · opens on PlusToken Ponzi, 2019
- G103-03Across bridges and chainsExplain how a cross-chain bridge moves value between ledgers and what it leaves recorded on eachabout 31 min · opens on RenBridge cross-chain laundering, reported 2022
- G103-04The endpoint: exchange, seizure, or dead endName the three kinds of endpoint a trace reaches: a regulated service, a seizure, or a dead endabout 31 min · opens on NetWalker ransomware takedown, January 2021