On May 7, 2021, DarkSide ransomware encrypted the billing and IT systems of Colonial Pipeline, the operator of a 5,500-mile fuel pipeline that supplies approximately 45% of East Coast fuel. Colonial's operators, unable to verify the integrity of their operational technology systems, shut down the pipeline preemptively. Fuel prices spiked across the Southeast. Gas stations ran dry. The Biden administration declared a regional emergency. Colonial paid $4.4 million in Bitcoin within 24 hours. On June 7, the Department of Justice announced it had seized $2.3 million of that payment - having tracked the Bitcoin to a specific wallet and obtained the private key.
The Colonial Pipeline incident was the moment ransomware became a matter of national security policy rather than a cybercrime enforcement problem. It produced the first public cryptocurrency seizure from a ransomware payment, an infrastructure security executive order, the disruption of DarkSide's infrastructure (under circumstances that remain murky), and a sustained US government push to treat ransomware as equivalent to terrorism for investigative priority purposes. It also illustrated, in painful public detail, how completely the United States' critical energy infrastructure had been left unprotected against a threat that had been present and growing for years.
DarkSide: The RaaS Operator
DarkSide had launched in August 2020 as a ransomware-as-a-service operation, presenting itself with a distinctive professional, almost corporate identity. The group published a "press release" at launch, maintained a public blog for victim announcements, operated a customer service portal for victims to negotiate, and made a notable public commitment to donate a portion of proceeds to charity (an offer that the cryptocurrency receiving addresses' operators declined). DarkSide published a list of target categories it claimed affiliates were not permitted to attack: hospitals, funeral services, schools, non-profits, government entities.
This brand positioning was deliberate. DarkSide was competing for affiliates in a market where the Babuk and REvil groups were also recruiting, and professionalism was a selling point. The group's technical quality was high: the ransomware used Salsa20 encryption with RSA-1024 key protection and was built differently for each campaign (customizable at the builder level). Their negotiation support and decryption reliability were reported as consistent by victim incident response teams, which was a feature affiliates could pitch to victims as a reason to pay rather than restore.
The Attack and the Shutdown Decision
DarkSide affiliates accessed Colonial Pipeline's network through a compromised VPN account that lacked multi-factor authentication. The credentials had previously appeared in a leaked password dataset - they had been exposed in a prior breach of an unrelated service and reused on the VPN. The initial access method was credential stuffing against an internet-facing VPN endpoint.
Colonial's IT systems - billing, business systems, corporate infrastructure - were encrypted. The operational technology (OT) systems controlling the physical pipeline were a separate network and appear to have not been directly encrypted. This distinction became the subject of significant debate: Colonial's shutdown of the pipeline was, by most accounts, a precautionary decision driven by uncertainty about whether the OT systems had been compromised, and by the inability to invoice customers for fuel deliveries without functional billing systems. The operators could not safely run the pipeline when they did not know the integrity state of their own systems.
The six-day shutdown of the pipeline produced visible fuel shortages in southeastern states. Panic buying accelerated the shortage: gas stations ran dry not just because of reduced supply but because demand spiked. The Colonial Pipeline serves Atlanta, Charlotte, and numerous other major markets. The images of empty gas stations and the declaration of a regional emergency by the Biden administration elevated ransomware from a cybersecurity industry concern to a national political issue within days.
The Ransom Payment
Colonial CEO Joseph Blount authorized the $4.4 million Bitcoin payment within approximately 24 hours of the attack, without notifying the FBI. He later testified to Congress that the decision was made because of uncertainty about the extent of the damage and how long restoration would take. Colonial subsequently worked with their own incident response team and, separately, with investigators - but the ransom was paid before law enforcement was brought in.
The $4.4 million was a fraction of what DarkSide had originally demanded. The public figure reported by Blount was the negotiated payment, not the initial demand. The negotiation - conducted through DarkSide's victim portal - was typical of professional ransomware operations: the initial demand was high, DarkSide's "customer service" team negotiated toward a payment both parties would accept, and a decryptor was provided after payment.
The decryptor worked, but was reported by Colonial's incident response team to be too slow to be the primary recovery method. Colonial ended up restoring from backups for most systems rather than using the decryptor, which was a common finding with large-scale ransomware incidents - even when decryptors functioned, restoration from backup was faster at scale.
The Bitcoin Seizure
On June 7, 2021, 25 days after the attack, the Department of Justice announced that it had seized 63.7 Bitcoin - approximately $2.3 million at then-current prices - from a specific wallet address linked to the DarkSide payment. The DOJ had tracked the ransom payment through the blockchain from Colonial's payment wallet through a series of transfers, ultimately identifying a wallet holding the funds.
The DOJ obtained a seizure warrant from a federal magistrate in the Northern District of California (where the cloud hosting provider for the wallet was located). The warrant authorized seizing the wallet contents, which required access to the wallet's private key. The DOJ's press release described obtaining "the private key" for the wallet, but did not explain how.
The most widely reported explanation - from subsequent reporting by Bloomberg - was that the FBI had been given the private key by a confidential human source with access to DarkSide's financial infrastructure. An alternative explanation was that the wallet key was stored by a hosted cryptocurrency wallet provider in the Northern District of California, and that the provider turned it over under the warrant. The distinction matters: if a human source provided the key, that is an intelligence operation. If a custodial provider turned it over, that is standard legal process. The FBI never confirmed which explanation was accurate.
The seizure recovered approximately 63.7 of the 75 Bitcoin paid (the remainder had moved to other wallets before the FBI could seize it). The Bitcoin price had dropped between the payment date in May and the seizure date in June, so the dollar value of the seizure was less than the dollar value of the original payment.
DarkSide's Collapse
Within days of the Colonial attack generating international headlines, DarkSide announced it was shutting down. On May 13, a DarkSide statement posted to cybercriminal forums claimed that the group had lost access to its infrastructure (servers seized) and that its cryptocurrency reserves had been drained by an unknown party. The statement also claimed that the DarkSide payment processing portal was inaccessible, leaving affiliates unable to receive their share of ransom payments that had been collected.
Whether this represented a law enforcement operation, a government offensive cyber action, or an exit scam by DarkSide's operators against their own affiliates was disputed in the criminal underground at the time and has never been definitively confirmed. The US government did not claim credit for a DarkSide infrastructure seizure. Some researchers believed the infrastructure loss was genuine and followed law enforcement action; others believed DarkSide's operators had taken the $4.4 million Colonial payment and other outstanding payments and deliberately burned the infrastructure to disappear with the money while pinning the blame on law enforcement.
DarkSide's operators reappeared months later as BlackMatter, a new ransomware operation that operated from July to November 2021 before shutting down again. BlackMatter's code sharing with DarkSide was sufficient that researchers attributed the operations to the same team. BlackMatter subsequently gave rise to ALPHV (also known as BlackCat), which operated until 2024 and became responsible for the Change Healthcare attack.
Aftermath: Policy and Infrastructure Security
The Colonial Pipeline attack produced immediate policy responses. Biden's executive order on cybersecurity, issued May 12, required federal contractors to meet minimum security standards and established a Cyber Safety Review Board modeled on the NTSB. The Transportation Security Administration issued emergency security directives for pipeline operators - the first such directives for the pipeline industry - requiring reporting of cybersecurity incidents and implementation of specific security controls.
The attack also contributed to the US government's framing of ransomware as a national security threat equivalent to terrorism. The Ransomware and Digital Extortion Task Force was elevated to treat ransomware with the same investigative priority as terrorism. The FBI's Cyber Division received increased resources. The government's engagement with cryptocurrency exchanges about transaction monitoring expanded significantly.
What did not change substantially was the security posture of critical infrastructure operators themselves. The TSA directives faced pushback from the pipeline industry as burdensome; subsequent reviews found compliance patchy. The basic vulnerability that enabled the Colonial attack - a VPN account with no MFA and credentials available in leaked data - was not unique to Colonial. Similar vulnerabilities existed and continue to exist across the industrial control system operators that manage water, electricity, gas distribution, and other critical infrastructure.