The endpoint: exchange, seizure, or dead end

Graduate · enrolled learners

This lesson opens with NetWalker ransomware takedown, January 2021.

What happened

NetWalker was a ransomware-as-a-service operation: Chainalysis traced more than 46 million dollars in NetWalker ransoms from August 2019, and US authorities counted at least 305 victims in 27 countries. In January 2021 a coordinated action charged a Canadian affiliate, Sebastien Vachon-Desjardins, alleged to have obtained at least 27.6 million dollars; on 10 January law enforcement seized about 454,530 dollars in cryptocurrency, ransom payments from three separate attacks, and Bulgarian authorities took down the group's dark-web site. Blockchain analysis tied at least 345 addresses to Vachon-Desjardins going back to February 2018. Neither the DOJ nor Chainalysis says how the 454,530 dollars was seized or how he was identified. What the record does show is where the trail ended: once he was identified, Canadian police searching his home in Gatineau seized C$742,840 and 719 bitcoin, about 21.85 million dollars at the time, and he was later sentenced to 20 years. The trail was on-chain the whole way, and bitcoin in his own wallets was fully visible; it became reachable at the point where the trail met a person investigators could name and search.

The decision point

A trace is not finished when you run out of hops; it is finished when it reaches an endpoint, and the endpoint, not the length of the trail, decides whether the trace can become anything. There are three. A regulated service, an exchange with identity records, is where an address can be tied to a person, frozen, subpoenaed, or seized, and it is where most enforcement actually happens. A direct seizure, obtaining the wallet's key as in the Colonial Pipeline case, is rarer and decisive. A dead end, funds resting in self-custody with no owner anyone can name or reach, in a non-cooperative jurisdiction, or truly pooled in a mixer, is a trace that is complete and unactionable: you can see exactly where the money is and do nothing about it. The analyst's final tracing skill is reading which endpoint they have reached, because a perfect trail to a dead end and a short trail to an exchange are worth very different things, and confusing visibility with reach is a common mistake.

Recorded loss

$454,530

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.