Okay, so according to the news, the FBI has recovered the bulk of the Bitcoins paid as ransomware by the Colonial Pipeline Company, by acquiring the private key to the address where those Bitcoins were stored.

No news source I’ve seen has offered anything approaching an answer to the question: How did the FBI get ahold of that private key? Did the criminal masterminds behind the ransomware attack just leave it, unencrypted, on a hard drive or a piece of paper in a place where the FBI was likely to look?

At first I thought the most likely answer was that the FBI must have traded something for that key — say some sort of immunity (either from prosecution or, maybe, from something like a beating). But on second thought, it occurs to me that maybe hiding a private key from the FBI is trickier than it sounds.

I know plenty of good ways to hide private keys from thieves. You can write your key on a piece of paper (or better yet, etch it in metal) and store it in a safe deposit box. Or, for extra security (say if you’re worried about bank employees accessing those boxes), put half of it in one safe deposit box and the other in another, at a different bank. Or, if you’re worried about one of those banks being reduced to rubble in an earthquake or a terrorist attack (in which case no criminal could get your key, but neither could you), you can break the key into three parts, store parts A and B at Bank One, parts B and C at Bank Two, and parts A and C at Bank Three. Any one bank can disappear and you can still recover your entire key.

That secures your keys and makes them safe from criminals, but it does not make them safe from the FBI, which has the power to issue subpoenas to all of your banks and recover the contents of your safe deposit boxes. So maybe hiding your keys from the FBI is harder than it appears.

So let me try again: After etching them on metal, store parts A and B at Location One, parts B and C at Location Two, and parts A and C at Location Three, where you expect to have access to all of these locations (and only really need access to two of them) but none is particularly tied to you — i.e. not your house, not your car, not your safe deposit box. Maybe underground locations in the woods, though that feels a little sketchy to me. And then of course you might want to keep some sort of written record of those locations, which the FBI can find when they search your house or safe deposit box, whereupon they might wonder what’s so interesting about those locations that you felt the need to keep track of them….

You might think the safest thing is to memorize your key (or a mnemonic English phrase from which the key can be derived) and leave no record of it anywhere except in your own brain. That’s fine until dementia starts to set in, or until you’re hit by a bus (in which case your heirs are out of luck, though you might or might not care about that). Or you can leave written clues to the mnemonic that only you will be able to decipher, like “Word 9: The secret nickname I had for the girl I had a crush on in third grade”. This is of course also subject to the dementia problem.

So. Suppose you’re a master criminal, storing your ill-gotten gains as Bitcoins, which you want easy access to at all times for yourself (and maybe your heirs), but you want to keep completely inaccessible from law enforcement agencies with unlimited subpoena power. What’s your plan?

Update: More recent news reports indicate that the coins were seized from a custodial account — based in the United States, no less. In other words, my sarcastic reference above to “criminal masterminds” was not nearly as sarcastic as it should have been. It’s not that these guys failed to think of a clever scheme for hiding their keys; it’s that they never even bothered to try. The more interesting question, then, is how does Bitcoin fall 10% on the “news” that if you let someone else hold your private keys, you can lose your Bitcoins. (“Not your keys, not your coins”, as the saying goes.) The best answer I have (not just for this event but for a lot of Bitcoin volatility in general) is that anything even slightly unsettling leads to a small drop in prices, whereupon heavily leveraged investors fail to meet their margin calls, which leads to big selloffs. But that’s not a full answer until someone fleshes out the part where more sophisticated investors fail to jump in and take advantage of this buying opportunity. So maybe the dip, despite the coincidental timing, had nothing to do with the seizure.