Colonial Pipeline ransom cash recovered after cyber attack
DarkSide - which US authorities said operates from eastern Europe and possibly Russia - infiltrated the pipeline bringing chaos to supplies across the country.
The pipeline carries 45% of the East Coast's supply of diesel, petrol and jet fuel and the attack disrupted supplies for several days causing fuel shortages.
Deputy Attorney-General Lisa Monaco said investigators had "found and recaptured" 63.7 Bitcoin worth $2.3 million (€2.6 million) - "the majority" of the ransom paid.
Colonial Pipeline took itself offline on 7 May after the cyber attack.
In a statement Joseph Blount, chief executive of the Colonial Pipeline Company, said his firm was grateful for the "swift work and professionalism" of the FBI, which helped to recover the ransom.
"Holding cyber criminals accountable and disrupting the ecosystem that allows them to operate is the best way to deter and defend against future attacks," he added.