Vigilante hacker burns hundreds of BTC held in wallets used by Russian intelligence

Vigilante hackers burned about $300,000 worth of bitcoin found at about 1,000 addresses allegedly linked to Russian intelligence agencies via the OP_RETURN feature in 2022, according to a Chainalysis investigation.

An anonymous vigilante group has reportedly discovered 986 unique Bitcoin addresses that they claim were used by Russian security services between March 2022 and April 2022.

They leaked addresses using the text storage functionality of the OP_RETURN function used to mark BTC transactions as invalid, burning most of the BTC contained within the addresses.

The vigilantes also sent some of the BTC to an address used to collect donations to Ukraine with the following message:

“Please help Ukraine with money from GRU Khakir.”

They marked the address with three other messages.

• “From GRU to SVR. Used for hacking!”
• “GRU vs. GRU. Used for hacking!”
• “GRU to FSB. Used for hacking!”

The GRU is Russia’s foreign military intelligence agency. SVR is a foreign information service. FSB is the Federal Security Service. All three are intelligence agencies.

Russian link

The vigilante group did not provide any concrete evidence to claim ties to Russian intelligence through OP_RETURN messages, but Chainalysis’ investigation found in a now-deleted blog post by a Russian cybersecurity firm called HYAS , I found that two addresses were mentioned.

Three addresses, 1DLA46sXYps3PdS3HpGfdt9MbQpo6FytPm and 1L5QKvh2Fc86j947rZt12rX1EFrCGb2uPf, were used by SVR to “buy infrastructure used in the infamous Solarwinds hack,” according to the blog post.

Additionally, a third address was also confirmed to have links to Russia and was reportedly used by the GRU in a disinformation campaign targeting US politicians.

Chainalysis says:

“The fact that the OP_RETURN message appears to have been accurate for three addresses lends credence to the claims for the other addresses.”

“pure intention”

According to Chainalysis, OP_RETURN hackers burned hundreds of thousands of dollars apparently trying to “leak” the address to the public.

“Our hypothesis is that the OP_RETURN sender did this to increase the likelihood of transaction discovery and associated prosecution.”

The research firm added that the fact that the hackers willingly waived such sums gives more weight to their claims that these addresses were used by Russian security services.

Additionally, the hackers burned hundreds of BTC before donating the rest to Ukraine to make clear their “pure intentions” and “support for the Ukrainian cause.”

An article first appeared on CryptoSlate about vigilante hackers burning hundreds of BTC held in wallets used by Russian intelligence agencies.