These agencies are sometimes able to retrieve stolen funds. In the case of the Colonial Pipeline ransomware attack in 2021, the Department of Justice (DOJ) was eventually able to recover almost 85% of the bitcoin (BTC) ransom paid to Russian cybercriminal group Darkside. It’s unclear how investigators obtained the hacking group’s private keys.

Probably the old-fashioned way

the XKCD with the pipe wrench