Those same files were later dumped for free, leading to the creation of WannaCry ransomware, as well as several others

May 30, 2017 19:34 GMT  ·  By

Bitcoins worth about $24,000 that were sent to the Shadow Brokers, the group that dumped online NSA classified documents that led to the creation of WannaCry ransomware and other similar tools, have been moved from the original wallet. 

The money comes from a failed auction where the hackers tried to get people interested in the files they had. Since people didn't really show that much interest in the documents, the group eventually dumped everything online for free.

While that original auction may not have drawn too much attention, it's almost certain that the subscription service they've just announced, where people need to pay north of $21,000 in exchange for one monthly leak, will get a lot more fans.

It is believed, therefore, that the Shadow Brokers managed to steal a lot more NSA files than they led people to believe in the first place.

Those Bitcoins they received before the original dump have been moved to multiple addresses, which led many people to believe that the group plans to obfuscate the transactions before exchanging the Bitcoins for traditional currencies.

An effort to shake off the trail

F-Secure cybersecurity expert Mikko Hypponen told the BBC that he's had an alarm on the bitcoin wallet since the group announced themselves. "I was surprised when I got an alert that they had emptied the wallet," he told the publication.

He also claims that this was a risky move since the wallet didn't have that many coins (only about 10BTC) in them and, by withdrawing them, the hackers risked revealing their identity.

Motherboard writes that the coins in the auction address have been moved through a series of addresses in increasingly smaller denominations, which may indicate they are trying to make it more difficult to trace back the money to the original address.

If someone manages to track down the money, it will be a huge clue as to who is behind the group. Chances are, however, quite slim. Until then, the group has switched to Zcash for its next endeavor and rumor has it more and more security companies are thinking of paying the $21,000 to get access to the exploits.