Tether Froze $300K of Stablecoin Hacked After Victims Left Wallet Keys in Evernote

The U.S. government is pursuing a civil forfeiture claim on more than 300,000 units of the tether (USDT) cryptocurrency after they were reported stolen in a hack earlier this year.

The funds, co-owned by Shixuan Cai and business partner Lin Jian Chen, were later frozen by operator Tether Ltd. after Cai reported the theft to the Los Angeles Police Department (LAPD) in April, court documents filed on Thursday show.

Now the U.S. government wants to finalize the legal seizure of those assets, saying they are in violation of Section 1030 of the Civil Forfeiture code, for “fraud and related activity in connection with computers.”

Back in February, Cai purchased 300,900 USDT – a stablecoin linked to the price of the U.S. dollar – through the cryptocurrency exchange Binance. Cai then transferred those funds to a personal wallet co-owned and managed with Chen.

Just four minutes after Cai had transferred the tether from Binance to the personal wallet, the funds were transferred again, but without the business pair’s permission, to a wallet address ending in 8869.

Hours later the funds were split, with two-thirds (200,600 USDT) of the funds going to yet another wallet address ending in 44c2, while 100,301 USDT remained in the 8869 wallet.

Cai contacted Chen the following day attempting to uncover how the funds had been moved, learning Chen had recorded their private key, used for authorizing transfers from their wallet, in an Evernote account.

Read more: Total Stablecoin Supply Nearly Doubled in Q3, Adding Record $8B 

Evernote is a note-taking and task management application that stores information on the cloud and is accessible across multiple devices owned by an individual or individuals if shared.

Hackers masking their IP address through a virtual private network (VPN) found the wallet key in Evernote and conducted multiple intrusions between Jan. 26 and Feb. 5, Chen later learned.

The key was used to authorize the transaction from their personal wallet to the destination wallet ending in 8869. Cai reported the theft two months later on April 9 to both Tether Ltd. and the LAPD. The funds were temporarily frozen by Tether pending an investigation.

A week later, Special Agent Patrick Leighton of the U.S Secret Service (USSS) was contacted by a Tether representative, who said an unidentified individual was requesting a lifting of the freeze on the USDT so the person could transfer the USDT to another cryptocurrency.

Leighton asked Tether to provide the unidentified individual’s contact details and request the individual to get in touch with the agent. Shortly after, Leighton was contacted by an individual who identified himself only as “Kamil,” using the email address “qlYyq2t5iKIbBfxu@protonmail.ch.”

Kamil told Leighton the funds originally belonging to Cai and Chen were transferred to him by an unidentified business partner who in turn had received the funds from an undisclosed person in China.

The China-based individual was said to have asked Kamil to handle the transfer of Cai and Chen’s funds to purchase ether on the Kyber network because they were “not familiar with cryptocurrency.”

Kamil claimed he wanted to split Cai and Chen’s funds into equal amounts over three wallets and that he would receive 15% of the total funds for conducting the intended transactions on behalf of his partner.

No further details were provided to Leighton regarding the alleged partner, with Kamil claiming he had already destroyed evidence of his partner’s information.

See also: Chinese Authorities Crack Down on Gambling Sites Using Tether Stablecoin

By May, Judge Pedro Castillo of the U.S Central District Court of California issued a seizure warrant for the roughly 300,000 USDT and in June issued an order extending the time for the USSS to execute the warrant.

At that time, Tether Ltd. unfroze the stablecoin funds at the behest of the USSS before the warrant was executed and the funds transferred to a wallet controlled by the U.S. government.

“Tether routinely assists law enforcement agents and seeks to further their legitimate objectives,” Tether CTO Paolo Ardoino told CoinDesk. “Tether will always play by the rules, obey the law, and try to be supportive of the wider digital token community.”

Cai and Chen’s stolen crypto assets will remain in the government’s possession subject to the Court’s jurisdiction pending the U.S. government’s claim of fraud, court documents show.

The case is a reminder never to leave any wallet keys or recovery phrases stored online where they may be accessed by bad actors.

Edit (12:00 UTC, Oct. 26 2020): Adds comment from Tether.

See court document in full below: