The U.S. Department of Justice has recovered the majority of the ransom payment Colonial Pipeline paid after a cyberattack that caused the company to temporarily shut down its pipeline operations, officials reported Monday.

The U.S. Attorney’s Office for the Northern District of California is leading the seizure of 63.7 bitcoins, or more than $2.3 million, from hacker group DarkSide, after securing a warrant from U.S. Magistrate Judge Laurel Beeler.