Why wouldn't they? To me it seems unthinkable they wouldn't invest significant resources into such an investigation, and I could think of plenty of ways they could narrow down suspects. There's a trade-off between potential reward and decreased exposure risk, there. Also, as stated by others, they'd already need to have significant (fiat) capital, and ideally a history of trading (else they'll automatically be near or at the top of the suspects list), which seems unlikely to me.

People with enough money to be investing regularly also probably don't need to orchestrate elaborate smash-and-grab cybercons to make money. People in such a position would already be doing fine and would have the added bonus of never fearing going to jail. I suspect whoever did this likely doesn't have much fiat money, or if they do, it's probably mostly dirty money which wouldn't be feasible to invest with.

Here, there's no risk/reward trade-off like there would be from shorting. It's a much more scalable attack: every additional hijacking results in additional expected value, but no additional risk. With some form of stock betting, the more you scale it up (in terms of reward potential), the more the activity would stand out.

I think the attackers made the smartest possible decision, given what they had/could do, if their goal was purely total profit (plus not getting caught). If their primary goal wasn't money, then it's certainly a squandered opportunity, but most criminals are just in it for the money.

Yes, absolutely. I mean, if you put in years of preparation and are an active trader with a big portfolio, 500k$ is probably getting through the net. But if you're a newer trader, not much invested or not many positions? You're sure as hell getting some questions.

I mean, yeah, there might be a ten or hundred people who match this criteria, but market manipulation is a very serious crime and when people lost many millions, the SEC is going to pour a lot of resources into checking everyone.

EDIT: This is also assuming the hacker is American. I bet you a lot that this matches very few people in, for example, India.

I don't think it's a stretch to assume this hacker group has some member with an active account, or to charitably take "you" to mean someone with (at least) a sporadic day trading history.

You might be surprised.

I have heard of drug busts that began with detectives going to a university in a town where the drugs (think synthesized drugs) seem to be originating from. Cross-reference all students on financial aid with all students that had taken Organic Chemistry 300. You could count the number on one hand.

Each were watched, one was seen making the handoff....

Sure, that's because America's law enforcement are extremely interested interested in the "war on drugs".

Will they go to those same lengths to find people who profit a few hundred grand or a mil on the stock market, when the consequences of what we're talking about could result in tens or hundreds of millions of dollars of profit/loss?

> They're going to heavily investigate everyone that made a half million on a super high volume, widely shorted stock in a time of extreme volatility?

These arguments all seem to be operating on the assumption that there would be a large number of day/swing traders who would exit their positions with perfect timing, but this is unlikely because they wouldn't have the knowledge that the price move was ephemeral and driven by a false rumor. The number of people who made a half million off it would be a lot smaller than you think.

Anyone with out-of-the-money options which suddenly became in-the-money would tend to sell.

You don't need perfect timing, and there will generally be a lot of traders who think "lol this is insane, I'll just cash out".

Well, don't ever assume lack of sloppiness. ;) But to the large question: markets are built on trust, and the SEC has the job of ensuring the trust bedrock of the US markets via enforcement. A high-profile move like the one we're describing here, manipulating the US markets so brazenly, is worth spending more money than exchanged hands in the fraud to find the perpetrators, just so they can put heads on pikes and make everyone feel better that the system works (because the net loss of value if market trust breaks down is much, much higher).

Well you can quite easily filter to the people that hadn’t had significant trading activity before suddenly making massive moves.

There aren’t that many individual investors with short positions that large.