Bitcoin is not so anonymous and the creators of WannaCry have noticed it fast

Almost three months ago the massive cyberattack WannaCry....

Almost three months ago the massive cyberattack WannaCry, which caused Telefónica to close its intranet as well as numerous companies around the world. The attack has had significant costs for many companies, although not all have decided to pay to recover the data: they have only managed to raise $ 140,000.

The way to claim money has been in the form of Bitcoin, because it allows to stay outside the international financial circuit that would make it difficult to hide from the creators of malware. However now the creators have faced a difficult challenge: to turn the Bitcoin into current money.

The technique used by the authors of WannaCry

Bitcoin is a criptomoneda with many characteristics but there is one that does not have: the anonymity of the transactions. It is true, seeing a Bitcoin account we can not deduce who is the owner (it is only a number and the one with the private key is able to access the account), but any transaction that is made is registered and public. And to convert the Bitcoin into money (dollars, for example) you have to go through an exchange, a bureau de change.

The problem is that the exchange houses are companies and they do business with money change and therefore are subject to very strict regulation. In fact the exchange BTC-e was closed by the authorities as it was facilitating money laundering and its founder was considered a ciminal (it has helped to bleach 4,000 million dollars).

Therefore, if the creators of WannaCry want to recover the money they can not send it directly to an exchange. And since they are not fools, a few days ago tried to overshadow the money by making multiple transactions to new accounts of Bitcoin for the authorities to lose track of money (this technique is called bitcoin mixer).

But obfuscation is not so easy

The problem is that confusing the authorities is not so easy. Yes, the 140,000 euros in Bitcoin ended up in multiple accounts and with many transactions, but in the end they have to reach an exchange. And they used Shapeshift.io, not to turn them into money but to turn them into another criptomoneda, Monero, that does have characteristics of anonymity. The main feature of Shapeshift is that it is not necessary to register.

However either the authorities or Shapeshift detected that the money came from WannaCry and blocked the funds. The creators of malware have lost their money. All the mess they set up in May for nothing (or, yes, it could be an attack run by North Korea and the money does not matter, in this case the attempt to withdraw funds is just a strategy to divert attention).

Future rasomware attacks

In the future the hackers will have learned some lessons. First, that Bitcoin is not the best currency to ask for a ransom because its conversion to physical money is complicated. They could always have used Bitcoin to buy items on the Deep Web, but honestly doing this with $ 140,000 is unproductive.

Second, that maybe they should have asked for redemption in more anonymous coins, like Monero. It is true, however, that with Bitcoin there is always some guarantee of having an investment assured and with good liquidity, in smaller currencies there could be problems to convert into dollars or could be devalued quickly. However if in the end the strategy is to convert to Monero better do so from the beginning.

And third, if you call the attention the authorities will focus more on you and the obfuscation will be more complicated. Better to target smaller targets than throw the internal telephone network or cause problems to the public health system of the United Kingdom. The bitcoin mixer process does not work if there are a lot of people watching what you do with the money.