Czech Court Approves Extradition Of LinkedIn Hacker: But To The US Or Russia?

A judge in the Czech Republic approved the extradition of Russian hacker Yevgeny Nikulin, a.k.a. “Peace” or “peace_of_mind”, who is accused of serious crimes in both the US and Russia. The cybercriminal can be extradited based on the current charges. However, the court did not specify which country.

The Russian hacker was arrested in a joint operation between the Federal Bureau of Investigation and Czech law enforcement authorities in October 2016 while the suspect was on a vacation in Prague. The joint action was based on an international arrest warrant issued in the United States. The FBI accused Nikulin of hacking Dropbox, LinkedIn, and Formspring in the period of five months in 2012.

According to the US Department of Justice (DOJ), a federal grand jury in Oakland, California indicted the Russian hacker “for obtaining information from computers, causing damage to computers, trafficking in access devices, aggravated identity theft, and conspiracy”. The indictment referred to the platforms Nikulin allegedly breached in and stolen data from, as seen in the document:

The indictment “…alleges that Nikulin accessed computers belonging to LinkedIn, Dropbox, and Formspring, each of which has its headquarters in the San Francisco Bay Area.”

The data the Russian stole in the hacks was for sale on both clearnet (the normal part of the internet everyone knows of), such as LeakedSource, and on darknet sites. Peace advertised most of the stolen information on the Real Deal Market, selling the database consisting 167 million users for 5 bitcoins. BTC had a much lower price back then, on May 2, 2016, the value of the cryptocurrency was $447.64 (the whole database was selling for about $2,200).

Soon after the United States filed an extradition request to the Czech Republic, Russia accused the US of harassing their citizens. Russian Foreign Ministry spokeswoman Maria Zakharova called the arrest of Nikulin “yet more proof that US law enforcement is hunting Russian citizens around the world.” In addition, a few weeks later, Russia filed its own extradition request based on a legal complaint in 2009, in which the hacker was accused of stealing funds from a Russian citizen’s WebMoney account.

Through Russian officials and his lawyers, the hacker continuously stated that he has no computer skills at all. After an FBI agent interrogated Nikulin in October 2016 and February 2017, the defendant claimed that the federal agent tried to convince him to plead guilty of the hacking of the Democratic National Committee (DNC) in 2016. US law enforcement believes that the DNC hack was conducted by hackers who have been financed by the Russian government. Regarding Nikulin’s case, Russian officials stated that the FBI is trying to pin the suspect as one of Russia’s state-sponsored hackers.

Multiple Czech media outlets reported that there’s a lot of political pressure from both sides. In addition, the case is being handled differently from other instances of extradition. For example, Nikulin has been held in solitary confinement, and the hacker’s final extradition hearing was heard inside a small room at the prison itself, rather than a courtroom.

Soon after the decision of the court, Nikulin filed an appeal. The hacker’s case will go to the Czech High Court for another set of hearings.

Besides the cyber attacks the US and Russia accused Nikulin of, there is also evidence pointing out that the 29-year-old Russian national was the person behind the hack of BitMarket.eu, a large bitcoin exchange, from where he allegedly stole 619 bitcoins ($1.4 million) in March 2013.

According to US officials, Nikulin’s luxurious lifestyle was financed from the hacks he allegedly committed globally. Russian media has documented Nikulin’s lifestyle in editorials, showcasing his cars and friendship with various children of the Russian political elite. However, regarding his lifestyle, Nikulin claimed that he made his money as a mechanic, by buying and selling cars, and not from hacking.