Why are ransomware attackers not tracked down via bitcoin transactions?

Question

A bitcoin transaction has details of the incoming address as well as the outgoing address (where the bitcoins are being transferred), so my question is why that outgoing address has not done anything in tracking down ransomware attackers, like the WannaCry authors?

Answer 1

There is a chance that once the bitcoins have been converted into ‘real money’ or ‘real assets’ the ledger could leak information on the owners of those bit coins. But even then tracking and attribution can be very complex, but in answer to your question the reason in this case is probably that the attacker(s) haven’t ‘cashed’ them in yet.

Depending on who carried out the attack they may never do anything with the bitcoin they have as their attack may not have been financially motivated.

There are ways to launder bitcoins using services such as Bitlaundry, Bitmix or Bitcoinlaundry.

These laundry services work as follows: (credit to the description below)

1. Imagine that Alice wishes to send bitcoins to Bob.
2. Bob, sadly, is not well liked. Alice would rather not have anyone know that she sent Bob bitcoins.
3. So, Alice puts Bob's address in the form at BitLaundry.
4. Alice gets a one-time-use address from BitLaundry.
5. Alice sends the money to that address.
6. BitLaundry sends money out to recipients every 30 minutes.
7. (But, it doesn't send out Alice's money immediately, that might be suspicious..)
8. So, a random number of 30 minute segments later, BitLaundry sends the money out to Bob.
9. BitLaundry then deletes the database link between the one-time-use address and Bob.
10. Alice has sent money to BitLaundry, but people do this all the time. She's one of many.
11. BitLaundry has sent money to Bob, but BitLaundry has sent money out to a whole bunch of other people as well.
12. Alice and Bob are much less linked than they would have been otherwise.

Answer 2

Bitcoins carry with them a complete log of their entire transaction history.

So the bitcoins used to pay that ransom can forever be found. Whomever has them in their possession can be tracked down, at least elecronically. Transfering those bitcoins into other currency or goods could be used to track down the person who benefited from the bitcoin.

To avoid this, electronic criminals can use the same techniques that real criminals do; they launder their money.

Find someone who is willing to accept bitcoins sight unseen, and then give you some other asset (maybe more bitcoins, maybe cash) and forget that transaction occurred.

Doing this with "real money" is known as money laundering, and is a crime. Financial institutions that do this are shut down and their assets siezed.

As yet, bitcoin laundering facilities have not been shut down. Those who hold bitcoins that have been laundered are not held criminally responsible for the earlier transaction where it was used to pay a ransom. Either one of these actions would probably spoil the use of bitcoins as ransom funding.

In comparison to traditional currencies, bitcoin offers certain advantages in laundering.

If you want to launder using physical money, it requires moving that money around. And large cash transactions are tracked. So doing so on a large scale requires either wide spread physical, on the ground infrastructure, or a way to make large cash transactions look not like money laundering. Both of these are expensive and leave you vulnerable to police action.

You could instead launder using electronic money. But electronic US dollars ends up connecting you to the US banking system, and there are laws against the US banking system working with people doing money laundering or looking the other way. If you or they are caught, your electronic assets will be siezed, and you may be personally caught and prosecuted.

In comparison, bitcoins have no central bank beholden to a country that is trying to stop money laundering that states "the bits in this account are real bitcoins, and those bits over there are not". So you can set up financial insitutions that launder bitcoins for you.

Answer 3

Bitcoin can combine several transactions' outputs as a new transaction's input, and it can also split a single transaction's output among many recipients. This is because only balances are transferred in transactions, not individual units of bitcoin.

"Mixing" services do this to obscure where bitcoin is going. After inspecting one of these transactions, the best you can say is, for example, "10% of the bitcoin sent from address A ended up in address B, another 10% ended up in address C, ..." and so on.

After a few rounds of these mixing service transactions and regular transactions, tiny fractions of the ransom bitcoin is now distributed among many many addresses, including addresses controlled by all sorts of people just buying bitcoin on exchanges, receiving bitcoin for selling products, etc.

More in-depth and complex blockchain analysis is possible, and combined with other real-world data from exchanges and banks it may or may not be possible to eventually track down the owners of the original ransom addresses.

Answer 4

The main purpose of Bitcoin was to create an electronic equivalent of coins: exchangeable, verifiable, and fungible. If it were easy to defeat the pseudo-anonymity, then why bother using Bitcoin instead of existing financial systems? The same algorithms that protect privacy advocates and political dissidents from the snooping eyes of oppressive authorities (or just authorities in general, who are assumed to be oppressive) also protect "real" criminals from those same entities. You can't have one without the other.

Answer 5

They could also be cashing in the ransom by simply exchanging the wallet for a percentage of another colder wallet.