In May, the department (DEA) seized more than $500,000 in Tether-stablecoins from two Binance cryptocurrency exchange accounts that the agency suspected were being used to launder drug money. The seized funds were placed in DEA-controlled accounts, stored in a Trezor hardware wallet in a secure vault.
However, the attacker was able to trace that the DEA sent a test amount of $45.36 to the U.S. Marshals Service as part of the standard forfeiture DEA seizure process. The scammer rushed to create a cryptocurrency address whose first five and last four characters matched those of an address belonging to bailiffs.
The scammer transferred the stablecoins from the fake address to a DEA account to make it look like a test payment, and the agency thought the scammer’s address was actually that of the Bailiff Service. The perpetrator’s plan succeeded: the DEA didn’t check the address after making sure the first and last characters were similar. So the agency sent John Doe more than $55,000 in a single transaction.
When bailiffs noticed something amiss and alerted the DEA, the agency contacted the Tether operators, demanding they freeze the fake address so the fraudster couldn’t withdraw the cryptocurrency. However, Tether representatives said the money had “already evaporated”.
By involving the US Federal Bureau of Investigation (FBI) in the case, the DEA found out: Stablecoins were converted into ether and bitcoin, then transferred to another wallet. Investigators have not yet identified the wallet user, but noticed that two addresses on the Binance cryptocurrency exchange were transferring “gas commissions” – fees for using the computing power of the Etherium network – to the fraudster. Two Gmail email addresses were used to register these accounts on Binance, and agents are hoping Google will provide them with user information.
It turns out that the kidnapper had been moving large sums of money in ether in recent months. The scammer’s wallet now contains $40,000 worth of crypto assets, and he has received about $425,000 since June