How 50,000 stolen Silk Road bitcoin ended up in a popcorn tin

For almost a decade, about 50,000 bitcoin stolen from the Silk Road marketplace sat hidden, and when federal agents finally found the key to them, it was on a tiny computer tucked inside a popcorn tin in a bathroom closet.^[1] This case file covers how one man drained the site's wallet by asking for the same money over and over, how the coins were recovered, and the one control that would have stopped it in the first second.

What happened

How it worked

The weakness was in how Silk Road handled withdrawals. When a user asked to take money out, the system checked the account balance, sent the coins and then updated the balance. If several requests arrived at almost the same moment, each one could pass the balance check before any of them reduced it. Programmers call this a race condition: the result depends on which step wins a race.^[1]

Zhong used that gap. By sending many withdrawals at once, he got paid several times against a single deposit.^[1] Spreading the activity across 9 accounts made it look less unusual.

Afterward, prosecutors say, he moved the coins through a service that mixes transactions to hide their trail, and through an overseas exchange, before consolidating them into 2 large holdings. When a 2017 split in the bitcoin network created a spin-off currency, he received a matching amount of it and traded it for about 3,500 more bitcoin.^[1]

How it was caught

The investigation was run by IRS Criminal Investigation, the tax agency's law enforcement arm, with help from local police in Athens-Clarke County, Georgia.^[1] After the November 2021 search, Zhong also handed over another 1,004 bitcoin in 2022, bringing the total forfeited to about 51,680 bitcoin.^[1] Agents also took $661,900 in cash, 25 physical collector bitcoins, gold and silver, and a stake in a real estate company.^[1]

In November 2022 the Justice Department announced the seizure of more than $3.3 billion in bitcoin and said Zhong had pleaded guilty to wire fraud.^[2][3] On April 14, 2023, he was sentenced to 1 year and 1 day in prison.^[1] The U.S. Attorney in Manhattan said the case showed investigators will follow the money no matter how clever the scheme.^[1]

The missing control

The missing control: balance checks on every withdrawal that cannot be bypassed by speed. Each payout needed to lock the account, confirm the money was there, reduce the balance and only then release the coins, one request at a time.

With that in place, the second, third, fourth and fifth withdrawals in that 1-second burst would have been refused, because the balance would already have been zero. A simple daily check that total withdrawals never exceed total deposits for each account would have exposed the problem on day 1 rather than after more than 140 transactions and 50,000 coins.^[1]

What to do in your business

• Reconcile money out against money in. Each day or week, confirm that refunds, payouts and withdrawals for any customer or account never exceed what was paid in.
• Stop duplicate payouts. Ask your payment or accounting provider how it blocks the same refund, invoice or transfer from being processed twice, and turn on duplicate-payment alerts.
• Set limits and alerts. Put caps on how many refunds or withdrawals can happen in a short time, and get an alert when a single account hits several in a row.
• Ask your developers about simultaneous requests. If you run your own store or app, have whoever built it test what happens when the same purchase, coupon or payout is submitted many times at once.
• Review odd accounts. Look for several accounts that share addresses, devices or payment details and behave the same way.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.