$20M Vanishes From U.S. Government Wallets

Earlier today, Bitcoin.com News shared that the U.S. government's (USG) crypto wallets had been busy, with documented seized funds being pulled from Aave.

Crypto wallets linked to the U.S. government appear to have been compromised, with around $20 million in digital assets vanishing from the government's stash. The bulk of the funds, primarily made up of stablecoins, were converted into ethereum “through suspicious addresses linked to a money laundering service,” the crypto intelligence firm Arkham Intelligence announced Thursday evening.

According to the announcement, the USG-linked address 0xc9E received government seized funds linked to the Bitfinex hackers from 9 separate USG seizure addresses, including [0xE2F]. This address is linked to funds being seized by the U.S. Marshals Service (USMS) from the Bitfinex hack, as mentioned in court documents.

“The funds were moved to wallet 0x348 which has begun selling the funds to ETH,” Arkham noted, adding that they believe the attacker is already laundering the proceeds.

Earlier today, Bitcoin.com News reported that the U.S. government's crypto wallets had been active, with documented seized funds being pulled from Aave. Following that, a cumulative net total of approximately $20 million has now been shifted from the government's stash.

“U.S. Government linked address appears to have been compromised for $20M,” Arkham announced at around 3:43 p.m. Eastern Time.

Arkham also revealed a court document from the case against Lichtenstein and Morgan, which references Aave, Curve Finance, and Yearn Finance, as well as the “0xE2F” wallet. The case is linked to the Bitfinex hack.

According to the document, approximately 1,999,723.976 in tether (USDT) was contained within Yearn Finance Liquidity Pool address 0xaC8, around 3,689,545.195 USDT was contained within Yearn Finance Liquidity Pool address 0xE2F, and approximately 1,700,000 USDT was contained within Yearn Finance Liquidity Pool address [0x681].

However, the compromised ethereum (ETH) address was not officially reported as being transferred to the USMS, onchain analyst Ergo BTC pointed out in another report.

The analysis highlights inconsistencies and potential security lapses related to the handling of seized cryptocurrency in the documents. Specifically, Ergo highlights conflicting information between transaction IDs (txids) and the custody agencies mentioned in the Bitfinex forfeiture document.

“These discrepancies raise questions about the accuracy and completeness of the government’s reporting on seized cryptocurrency,” Ergo wrote.

Ergo adds that the compromised ETH address was not officially reported as being transferred to the US Marshals Service (USMS) in the Bitfinex forfeiture document. However, 74 BTC from a change output, which was reportedly seized by the USMS, has already been spent. Ergo references a specific transaction ID (txid) for this.

Additionally, another 3,100 BTC from a set of seizure-related transactions, not reportedly seized by the USMS, have also been spent, the analyst notes, providing another txid.

“These discrepancies suggest that either the government’s reporting is inaccurate or that the funds were compromised after being transferred to a different agency,” Ergo writes.

Despite these issues, Ergo suggests it’s “Unlikely that all Bitfinex seized assets have been compromised,” noting that these moves likely occurred after realizing the need for improved “device hygiene.”