Skip to content

After Defcon, the FBI arrested the UK national who stopped Wannacry


Update: Here is the indictment. Hutchins is accused of making and selling a keylogger called the “Kronos banking trojan.”

Marcus Hutchins is the 23 year old security researcher behind the @MalwareTechBlog Twitter account; he’s the guy who figured out that the Wannacry worm had an accidental killswitch built in and then triggered it, stopping the ransomware epidemic in its tracks.

According to a US Marshals spokesman, Hutchins was arrested by the FBI shortly after the Defcon/Blackhat conference in Las Vegas, though no one has disclosed the charge. His friends cannot locate him.

I’ve just run a series of searches on the Defcon and Blackhat schedules and couldn’t find any presentations that Hutchins was on the program for, but that doesn’t mean he didn’t present there — many of the presenters are on side-tracks whose schedules aren’t easy to search.

The friend told Motherboard they “tried to visit him as soon as the detention centre opened but he had already been transferred out.” Motherboard granted the source anonymity due to privacy concerns.

“I’ve spoken to the US Marshals again and they say they have no record of Marcus being in the system. At this point we’ve been trying to get in contact with Marcus for 18 hours and nobody knows where he’s been taken,” the person added. “We still don’t know why Marcus has been arrested and now we have no idea where in the US he’s been taken to and we’re extremely concerned for his welfare.”

marcus arrested



  1. The indictment appears to be dated from 12 July 2017.
  2. He was not arrested until 2 August 2017, after DEFCON when he was on his way home to the UK.  Why not arrest him upon entry to the US?  Or during DEFCON? What was the motive for the delay in arrest?
  3. Why prevent him having lawyers to represent him.  Why deny letting his family and friends know of his whereabouts, or is this to prevent them organising his legal representation.

Something does not feel right about the procedures behind this arrest.  Procedurally, this is a hotch potch of organisation, denial of rights, denial of legal representation. This arrest sends chills down the spine – basically to a European it says “don’t go to the US, even for a conference, or sinister people will arrest you and hide you in secret”.

Wherever he is, Marcus deserves a lawyer, and the right to a fair trial, and his mother needs to be respectfully told where her son has been hidden.


Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: