Mysterious US government crypto hack, nearly all stolen funds returned

The crypto industry is baffled by a new, mysterious case involving the US government losing around $20 million worth of crypto assets in an apparent hack, only to have almost all the stolen funds returned within 24 hours.

Cybernews previously reported that blockchain activity showed unusual transactions involving two addresses, where stablecoins such as USDC, USDT, aUSDC, and Ethereum (ETH) were “suspiciously moved.” Some of the funds were quickly transferred to exchanges.

Shortly after, blockchain analysts from Arkham Intelligence reported that a cryptoasset address linked to the US government had received $19.3 million worth of tokens, effectively recovering about 88% of the stolen assets. Since then, no further updates have been issued, and the address in question has not received any additional inflows.

Pseudonymous blockchain investigator ZachXBT also claims that $19.2 million has been returned.

“This amount does not include the funds already transferred to instant exchanges (Switchain, HitBTC, N Exchange),” he stated on his Telegram channel.

No further details about the mysterious case have been provided, leaving crypto market participants puzzled as to what this hack and the swift return of funds might imply.

Commentators on X (formerly Twitter) remarked that "something smells funny" and that "stealing from the government and getting a $1m bounty is wild."

"Somebody is trying not to go to jail. Not sure if the US govt plays the whole 10% bounty game like these crypto companies do," noted X user MountainMoses.

Others speculated it could be an "inside job" potentially involving an agent who attempted to take the funds but reconsidered once the transfer became public.

The stolen and returned funds are reportedly connected to assets seized from the 2016 Bitfinex exchange hack. The US government currently holds around $13.7 billion in Bitcoin (BTC), approximately 44% of which came from the Bitfinex hack seizure in January 2022, with the remainder obtained through Silk Road-related seizures in 2020 and 2022.

In their weekly newsletter, digital asset-focused financial firm Galaxy Digital reminded that it’s not unheard of for a US Federal agency to be exploited.

"A key detail of this story is that the wallet that was drained was not one of the originally seized key pairs; the funds were moved and consolidated in (0xc9E) a fresh government wallet, meaning no-one outside of the Marshals should have access to the private keys," they added. They concluded that Marshals have either had the secret key for the wallet stolen by an employee, "or more likely, an employee involved in their on-chain activities got phished or fell victim to malware."