A U.K. high court has ordered crypto exchange Bitfinex to freeze an account holding 96 Bitcoin (BTC) worth about $865,000 linked to a ransomware attack on an unnamed Canadian company.
According to a court filing, the attack happened in October 2019 and involved more than 1,000 computers at the company being hijacked by ransomware. The court filling was originally issued on December 13th 2019.
Following the attack, the hackers demanded a $1.2 million payment in BTC in return for a key to decrypt the encrypted files on the affected computers.
The company had insurance against cybercrimes and deferred to its insurance company to sort out the ransomware attack. After negotiating with the hackers, the insurance company – the litigant in the U.K. court case – paid a lower amount than originally demanded, specifically 109.25 BTC worth $950,000 at that time.
The decryption key was provided some 24 hours after the ransom payment had gone through. Following that, the insurance company hired blockchain analytics firm Chainalysis Ltd. to trace where the Bitcoin payment went, subsequently tracing 96 of the 109.25 BTC to an account on the Bitfinex exchange, whilst the rest was converted into fiat.
Madeleine Kennedy, director of communications at Chainalysis, confirmed their implication in the case via the following statement:
“I can confirm a leading cyber insurer used Chainalysis software to investigate ransomware payments made on behalf of their clients and trace the flow of funds from the point of extortion to known services such as exchanges. A significant amount (96 BTC) related to that payment was traced to a Bitfinex user. The insurer’s lawyers successfully petitioned the courts to freeze any funds related to the extortion.”
In the meantime, the court ordered Bitfinex to freeze the account and share its know-your-customer (KYC) information about the account’s owner. The judge has imposed a January 18th deadline for Bitfinex to turn over the information. A search of the court database did not reveal any further filings on the case.
Bitfinex and its parent firm, iFinex, are listed as defendants – “D4” and “D3,” respectively – in the filing. However, the exchange said in a statement it has been working with the claimant to trace the Bitcoin and it is not now seen as being involved with the crime.
When reached for comment, Bitfinex general counsel Stuart Hoegner said in a statement that “Bitfinex has robust systems in place to allow it to assist law enforcement authorities and litigants in cases such as this.”
The case is reportedly the first time the UK’s High Court has treated Bitcoin as a form of property and may also set a legal precedent.