The U.S. Department of Justice announced Monday that it seized about $3.36 billion in stolen bitcoin during a previously unannounced 2021 raid on the residence of James Zhong.

Zhong pleaded guilty Friday to one count of wire fraud, which carries a maximum sentence of 20 years in prison.

U.S. authorities seized about 50,676 bitcoin, then valued at over $3.36 billion, from Zhong during a search of his house in Gainesville, Georgia, on Nov. 9, 2021, the DOJ said. It is the DOJ’s second-largest financial seizure to date, following its seizure of $3.6 billion in allegedly stolen cryptocurrency linked to the 2016 hack of the crypto exchange Bitfinex, which the DOJ announced in February.

According to authorities, Zhong stole bitcoin from the illegal Silk Road marketplace, a dark web forum on which drugs and other illicit products were bought and sold with cryptocurrency. Silk Road was launched in 2011, but the Federal Bureau of Investigation shut it down in 2013. Its founder, Ross William Ulbricht, is now serving a life sentence in prison.

“For almost ten years, the whereabouts of this massive chunk of missing Bitcoin had ballooned into an over $3.3 billion mystery,” U.S. Attorney Damian Williams said in a press release.

According to the Southern District of New York, Zhong took advantage of the marketplace’s vulnerabilities to execute the hack.

Special Agent in Charge Tyler Hatcher, of the Internal Revenue Service – Criminal Investigation, said Zhong used a “sophisticated scheme” to steal the bitcoin from Silk Road. According to the press release, in September 2012, Zhong created nine fraudulent accounts on Silk Road, funding each with between 200 and 2,000 bitcoin. He then triggered over 140 transactions in rapid succession, which tricked the marketplace’s withdrawal-processing system to release approximately 50,000 bitcoin into his accounts. Zhong then transferred the bitcoin into a variety of wallet addresses all under his control.

Public records show Zhong was the president and CEO of a self-created company, JZ Capital LLC, which he registered in Georgia in 2014. According to his LinkedIn profile, his work there focused on “investments and venture capital.”

His profile also states he was a “large early bitcoin investor with extensive knowledge of its inner workings” and that he had software development experience in computer programming languages.

Zhong’s social media profiles include pictures of him on yachts, in front of airplanes, and at high-profile football games.

But these types of hacks didn’t end with the Silk Road’s demise. Crypto platforms continue to be vulnerable to criminals.

In October 2022, Binance, the world’s largest crypto exchange by trading volume, suffered a $570 million hack. The company said a bug in a smart contract enabled hackers to exploit a cross-chain bridge, BSC Token Hub. As a result, the hackers withdrew the platform’s native cryptocurrency, called BNB tokens.

In March 2022, a different hacker found vulnerabilities in the decentralized finance platform Ronin Network and made off with more than $600 million — the largest hack to date. The private keys, which serve as passwords to protect cryptocurrency funds in wallets, were compromised.

According to a Chainalysis report, $1.9 billion worth of cryptocurrency had been stolen in hacks of services through July 2022, compared with just under $1.2 billion at the same point in 2021. 

More than three weeks ago, a popular Twitter account named “Anonymous” declared that the shadowy activist group was waging a “cyber war” against Russia.

Since then, the account — which has more than 7.9 million followers, with some 500,000 gained since Russia’s invasion of Ukraine — has claimed responsibility for disabling prominent Russian government, news and corporate websites and leaking data from entities such as Roskomnadzor, the federal agency responsible for censoring Russian media.

But is any of that true?

It appears it is, says Jeremiah Fowler, a co-founder of the cybersecurity company Security Discovery, who worked with researchers at the web company Website Planet to attempt to verify the group’s claims.

“Anonymous has proven to be a very capable group that has penetrated some high value targets, records and databases in the Russian Federation,” he wrote in a report summarizing the findings.  

Of 100 Russian databases that were analyzed, 92 had been compromised, said Fowler.

They belonged to retailers, Russian internet providers and intergovernmental websites, including the Commonwealth of Independent States, or CIS, an organization made up of Russia and other former Soviet nations that was created in 1991 following the fall of the Soviet Union.

Many CIS files were erased, hundreds of folders were renamed to “putin_stop_this_war” and email addresses and administrative credentials were exposed, said Fowler, who likened it to 2020’s malicious “MeowBot” attacks, which “had no purpose except for a malicious script that wiped out data and renamed all the files.”

Another hacked database contained more than 270,000 names and email addresses.

“We know for a fact that hackers found and probably accessed these systems,” said Fowler. “We do not know if data was downloaded or what the hackers plan to do with this information.”

Other databases contained security information, internal passwords and a “very large number” of secret keys, which unlock encrypted data, said Fowler.

As to whether this was the work of Anonymous, Fowler said he followed Anonymous’ claims “and the timeline matches perfect,” he said.

The Twitter account, named @YourAnonNews, has also claimed to have hacked into Russian state TV stations.

“I would mark that as true if I were a factchecker,” said Fowler. “My partner at Security Discovery, Bob Diachenko, actually captured a state news live feed from a website and filmed the screen, so we were able to validate that they had hacked at least one live feed [with] a pro-Ukrainian message in Russian.”

The account has also claimed to have disrupted websites of major Russian organizations and media agencies, such as the energy company Gazprom and state-sponsored news agency RT.

“Many of these agencies have admitted that they were attacked,” said Fowler.

He called denial of service attacks — which aim to disable websites by flooding them with traffic — “super easy.” Those websites, and many others, have been shuttered at various points in recent weeks, but they are also reportedly being targeted by other groups as well, including some 310,000 digital volunteers who have signed up for the “IT Army of Ukraine” Telegram account.   

Fowler said he didn’t find any instances where Anonymous had overstated its claims.

But that is happening with other hacktivist groups, said Lotem Finkelstein, head of threat intelligence and research at the cybersecurity company Check Point Software Technologies.

In recent weeks, a pro-Ukrainian group claimed it breached a Russian nuclear reactor, and a pro-Russian group said it shut down Anonymous’ website. Check Point concluded both claims were false.

“As there is no real official Anonymous website, this attack … appears to be more of a morale booster for the pro-Russian side, and a publicity event,” CPR said, a fact which did not go unnoticed by Anonymous affiliates, who mocked the claim on social media. 

Groups are making fake claims by posting old or publicly available information to gain popularity or glory, said Finkelstein.

Fowler said he feels Anonymous is, however, dedicated more to the “cause” than to notoriety.

“In what I saw in these databases, it was more about the messaging than saying ‘hey, you know, Anonymous troop No. 21, group five, did this,'” he said. “It was more about the end result.”

Hacktivists who conduct offensive cyber warfare-like activities without government authority are engaging in criminal acts, said Paul de Souza, the founder of the non-profit Cyber Security Forum Initiative.

Despite this, many social media users are cheering Anonymous’ efforts on, with many posts receiving thousands of likes and messages of support.

“They’re almost like a cyber Robin Hood, when it comes to causes that people really care about, that no one else can really do anything about,” said Fowler. “You want action now, you want justice now, and I think groups like Anonymous and hacktivists give people that immediate satisfaction.”

Many hacktivist groups have strong values, said Marianne Bailey, a cybersecurity partner at the consulting firm Guidehouse and former cybersecurity executive with the U.S. National Security Agency. Cyber activism is a low-cost way for them to influence governmental and corporate actions, she said.

“It is protesting in the 21st century,” said Bailey.  

Yet cheering them on can be dangerous in the “fog of war,” she said.

“A cyberattack has the potential for such an immediate impact, in most cases well before any accurate attribution can be determined,” she said. “A cyber strike back or even kinetic strike back could be directed to the wrong place. And what if that misattribution is intentional? What if someone makes the attack appear from a specific country when that’s not true?”

She said cyber warfare can be cheaper, easier, more effective and easier to deny than traditional military warfare, and that it will only increase with time.

“With more devices connected to this global digital ecosystem the opportunity for impact continues to expand,” she said. “It will undoubtedly be used more often in future conflicts.”