Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
JACK: This episode is dark and contains references to illegal drugs so listener discretion is advised. Federal law in the US says marijuana is illegal for any purpose in all states yet twenty percent of the states have flat-out legalized marijuana. This means the US government finds it offensive but state government finds it okay which makes it weird. Some states have determined it’s better to legalize marijuana for numerous reasons. It’s used to treat some medical conditions and helps some people relax after a hard day and it reduces some crime rates when it’s legalized. In these states where it’s legal there are nice clean shops where you can walk into, get greeted by a nice clerk, and browse what you want, buy your weed and go; much like buying candy in a Quick Mart.
But what if you’re in a state where it’s not legal for any reason and you need it to help with some medical condition but acquiring weed in these states is illegal which makes it very frustrating to get. You might have to go to some shady corners and some shady parts of town to find the guy selling not just weed but tons of other hard drugs. It’s sometimes high-pressure where you feel guilty by checking the weight or scared to go into certain houses. These situations are stressful and sometimes scary but there’s a better alternative; buy your weed online. Here’s how you do it. Fire up a VPN, connect to Tor, get some Bitcoin and buy your drugs on the dark market. These are websites that sort of resemble eBay but for illegal goods.
You can search for weed by looking for good prices, fast shipping speeds, and sellers with high ratings. There’s no high-pressure situation, no violence, and it seems safe. It’s the perfect solution right? This story is about AlphaBay, the most popular dark market to ever exist and I would love to interview the guy who created AlphaBay but I can’t because he’s dead.
JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: It’s about time I do an episode on the actual darknet, isn’t it? I choose the name Darknet Diaries because I really like the word darknet. I just imagine it to be all the shady parts of the internet where rogue stuff is going on. Not necessarily any part of the internet in particular, but anything that someone doesn’t want a light shining on it. But actually there is a thing called the darknet. It’s kind of debatable but the way I understand it, is that it’s a hidden anonymized network on the internet. [MUSIC] Picture going into a club and upon entering everyone has to wear a mask and the same exact suit so you can’t tell anyone apart. When you connect onto the darknet you become anonymous. At least that’s the theory.
There are a few darknets out there; Freenet, I2P, but the most popular one out there is Tor, T-O-R, which stands for The Onion Router. By using a special kind of software you connect your computer to the Tor network and you become anonymous. Normally when you visit a website it knows your IP address which can be associated with where you are in the world. But when you connect to Tor you get an IP of that computer that you’re connected to which might be hundreds or thousands of miles away. This masks where you actually are. If you want to be extra-safe it’s wise to use a VPN also before connecting to Tor so that if Tor or the VPN servers were to be compromised neither one of them would know exactly where you came from and where you went. They’d only be able to see one or the other. People use Tor for lots of great things.
I use Tor whenever I research episodes for this show because I stick my nose in a lot of places that I don’t really want my connections to be tracked back to me. As you can imagine, I research some dark and shady stuff. Countries with government oppression end up with a lot of people using Tor to get around censorship and to get their voices heard. Whistleblowers will often use Tor to [00:05:00] hide their identity and people who are concerned with mass surveillance may use Tor to escape being tracked. It’s an invaluable tool for people who want to share a message but are concerned with facing punishment for speaking up. When you get on Tor you can visit any website, both the darknet and the regular internet, and your location is masked. But there’s something else Tor has too, and that’s the deep web which are all the websites that are only available to those people who are on Tor.
So if you’re not on Tor you can’t reach these deep websites. These sites that are only on Tor network always end in .onion instead of .com or .net. Since this is theoretically an anonymous network it’s often used for illegal activity. If you browse around to see what websites are available on Tor you’ll find sites offering you illegal services, sites wanting to trade software or music illegally, blogs about how to create counterfeit money or do criminal hacking. The most popular type of site on the Tor network are drug marketplaces. [MUSIC] These are sites just like eBay where you can buy and sell items and see sellers rankings to help you decide if you should trust them or not. This peer review method works pretty well. Buyers will find someone with a high rating and buy a little to see if it’s legit.
If it works out they’ve just found their new favorite dealer to buy drugs from. Once all set up, the process is rather quite simple and convenient but setting yourself up to properly be safe takes a long time to do it right. You need to buy some Bitcoin, get a VPN service, connect to Tor, set up PGP, create separate e-mail addresses and aliases and a different persona just so nothing could ever be linked back to you. You never want to use your work e-mail address or something stupid and yes, there are many people who register on these dark market sites with their actual work e-mail address. It’s insane. Probably the most notable of all these dark markets is Silk Road. The story of Silk Road is incredibly interesting but that story has been covered in detail multiple times. If you’re interested in it, check out the book American Kingpin by Nick Bilton or the podcast Case File Episode 76.
I don’t think it ruins this story for you but the reason why it’s so famous is because the feds tracked and captured the guy who ran it, Ross Ulbricht. When he was captured he got life in prison without the possibility of parole. The guy is never getting out of prison all because he created a website that lets people buy and sell illegal items. He got life in prison because he was running the biggest illegal marketplace on the planet. No street gang could ever come close to moving the amount of stuff that was being bought and sold on Silk Road. Because of this, US government came down hard on him, putting him in prison for life and shutting down Silk Road in October 2013. But Silk Road had a few programmers and moderators that didn’t get caught and they got together and created a new dark market called Silk Road 2.0. Within a year the feds caught up with them too and shut that site down as well.
See, the US federal authorities have declared a war on drugs and these dark markets really attract their attention. The feds spend a lot of time and energy going after anyone who makes these sites but that doesn’t stop people from making dark markets. The same month Silk Road 2.0 was shut down, a new site sprang up on Tor called AlphaBay. [MUSIC] In November 2014 AlphaBay opened its doors and people started using it to buy and sell drugs. But the biggest dark market at that time was called Evolution. When Silk Road went down a lot of buyers and sellers needed a new place to go and they switched over to Evolution to do their trading. This made Evolution super popular as users began migrating over to it. Evolution was a place where you could buy all kinds of illegal items but people primarily went there to buy drugs.
It used an escrow service to do these transactions. The Bitcoin was sent to the Evolution server until the transaction was complete and then it was released. It was a dominant player in this space and it was growing in size. People really liked it and the site was highly rated. The site was looking strong and holding steady as the leader but in March 2015 Evolution went offline. [POWER DOWN] This time it wasn’t because of feds. It was because that whoever was running Evolution shut the doors and took everyone’s Bitcoin that was held on the site. This was around $12,000,000. This is equivalent to you giving money to a drug dealer and them not giving you the drugs in return, just taking off. People were furious that the site owner would do something like this and were claiming they lost over $20,000 that was being held on the Evolution servers.
When Evolution went down AlphaBay’s numbers soared. [MUSIC] In the next three days AlphaBay saw 18,000 new users and 7,000 new forum posts. It was seeing $300,000 in trading value a day. Once people started using AlphaBay they loved it. The site’s popularity rose quickly. Within a year they had 200,000 registered members. But they weren’t they only dark market around; the biggest dark market at that time was Agora but then Agora announced they would be pausing operations and asked everyone to withdraw their Bitcoin and stop using the site. This again gave AlphaBay another serious bump in new users, more listings, [00:10:00] and more trades. Because of all this, within two years AlphaBay had over 400,000 users and was the biggest dark market in the world.
In fact it was the biggest dark market the world has ever seen, having more listings than anyone before that. AlphaBay became the go-to place to buy or sell drugs online. The site’s moderators were friendly and helpful to users who wanted to learn how to use Bitcoin or PGP to encrypt their chats and the user interface was easy to navigate and friendly. The quality of stuff for sale was great. On any day of the week you could buy marijuana, LSD, mushrooms, meth, cocaine, Fentanyl, or heroin. But besides drugs people sold other illegal things; counterfeit driver’s licenses, passports, weapons, stolen credit card numbers, tools used for skimming credit cards, and counterfeit money-making machines.
But despite all these options the drugs are what sold the most on this site. To buy on this site you couldn’t use your credit card or PayPal. Only Bitcoin, Monero, and Ethereum were accepted. These are crypto-currencies that are also theoretically anonymous where you don’t know who you’re sending the money to. You simply need a wallet ID to send money to and a key to access your own wallet. AlphaBay would charge 2 - 4% commission for every transaction that went on there. With hundreds of thousands of transactions happening, AlphaBay was making some serious Bitcoin. The site owner was able to hire some staff to keep the place operational and continued to add new features and fix bugs. But a site like this is going to attract a lot of enemies. [MUSIC] Law enforcement agencies around the world have notoriously gone after sites like AlphaBay to try to shut them down so by being the top dark marketplace in the world, it attracts a lot of eyes and ears from many government agencies.
Investigations and cases started opening up in the US, Canada, UK, Netherlands, and Germany. They tried looking to see if any clues could be found as to who’s running the site. But everywhere they looked they found nothing. Whoever was administering the site was very good at keeping the server’s location secret and the owner’s identity hidden. All chats were encrypted and the site’s owner used an alias, Alpha02, which wasn’t used anywhere else and they encrypted and anonymized all connections to the servers. For years federal law enforcements couldn’t find any clues which would lead them to shutting down the site. The US has a war on drugs and dedicates a lot of time and money towards stopping drug dealers. They like to go after big operations which will make the most impact on the drug scene and AlphaBay was by far the biggest. Whoever was running AlphaBay knew this was highly illegal and had to hide.
They had to be extremely careful because not only would the police be looking for them but other drug dealers would be, too. AlphaBay had many competing drug marketplaces, marketplaces that also had services available like hit men and hackers. It may be entirely possible that an owner from another dark market wanted AlphaBay gone and had all the resources to track them down and put an end to AlphaBay. But besides the dark markets, regular street gangs were sometimes hit economically because of the rise of online drug markets. Some of them were also angry with the popularity of AlphaBay which meant they were having a harder time finding buyers and weren’t able to figure out how to sell their stash online. The admins to AlphaBay had to make sure their identity, location, and the server’s identity were kept very secret from all these enemies. To top it all off, the darknet is where some black hat hackers like to dwell, and they know this is a very lucrative business.
A lot of Bitcoins are coming in and out. AlphaBay probably got a fair share of hacking attempts waged against it at all times. There’s always someone digging around the site, looking for anything that may give away any information to figure out who was running it. At one point someone interviewed the administrator for AlphaBay asking if they were afraid of getting caught. Their response, I am not. I am absolutely certain that my OPSEC is secure and I live in an off-shore country where I’m safe. The United States FBI really wanted to catch him though, and put an end to this market so they began digging deeper. [MUSIC] The FBI was having trouble finding any clues at all so they went onto AlphaBay and started buying drugs. An undercover agent with the FBI created a user account and used some Bitcoins to buy marijuana.
A few days later they got the weed in the mail, no clues found. Not even information on who was selling it to them, just that it was shipped from California. Then the FBI bought another drug, this time heroin, and again offered no clues as to who was running the site. The FBI continued buying item after item on AlphaBay in hopes to eventually spot something and get more evidence as to what this place was doing. The FBI bought more heroin and Fentanyl and more marijuana and some meth, actually fifty grams of it. Then the FBI went on to purchase other things; they bought four fake driver’s licenses and they bought a credit card skimmer that fits onto an ATM, and more. The FBI was gathering more and more evidence for this case and also working with other law enforcements around the world to share information that they found. Eventually the FBI spotted something. When an undercover agent created a [00:15:00] new account at AlphaBay they received a welcome e-mail and examined it closely.
They looked at the headers of the e-mail and there was a Reply To e-mail address that was unusual. The Reply To e-mail in the header was pimpalex91@hotmail.com. The FBI took this e-mail address and went to Microsoft, the owners of Hotmail, to request information on who owns that address. That e-mail address was found to be associated to a LinkedIn account for a guy named Alexandre Cazès who was born in 1991. This matched the 91 in the e-mail address. His LinkedIn profile explained that he’s from Montreal, Canada and runs a computer tech support company called EBX Technologies. Now that the FBI had a name they began digging deeper into Alexandre Cazès, uncovering everything they possibly could about him. AlphaBay wasn’t the only dark market going around. There were many others but one that was gaining in popularity was called Hansa and it had a great user interface and great admins with great customer support and was actually very popular in Europe.
Same thing was being sold on Hansa; guns, IDs, counterfeit devices, and of course drugs. Even though Hansa was much smaller than AlphaBay it too attracted the attention of law enforcement. Countries around the world wanted to stop Hansa from being a trading place for illegal items. All of the Hansa servers were on the anonymized Tor network. This made it impossible to track where it was located in the world but there was one development server that was located on the regular internet. A security researcher found this one Hansa server that wasn’t on Tor. It was just on the regular internet and it turned out to be a development server that the admins could test new features on. They reported this information to the Netherlands National High Tech Crime Unit. This is the department that investigates high profile cyber-crime cases such as this.
They took this tip and tracked down the IP and it was in a data center that was actually located in the Netherlands. They contacted the data center that was hosting the server and the Dutch government was able to put a sort of wire-tap on the server to watch all packets that were coming in and out of it. From there they found the server was talking a lot with the live Hansa server which was on Tor. This production server was in the same data center as the development one so from there the Dutch government was able to make hard drive copies of a few of those Hansa servers, both the development and production one. They did this without causing any outage on the site, working directly with the data center. The Dutch High Tech Crimes Unit combed through the contents of those hard drives. The goal was to find who the admins were to the site.
They saw the admins were connected to the site but the connections were anonymized through Tor so they weren’t able to determine where these people were from and all the logins for the admins were aliases. Of course the site owners wouldn’t use their real names to log in with, but at some point the authorities found chat logs on the server and as they looked into it they found these logs dated back years and years. Inside the logs were conversations between the admins of the site but the Dutch couldn’t read the conversations; not because it was encrypted but because the conversations were in German. The Dutch authorities had to get a German translator to come help them decipher the chats and read through the logs. A lot of it was talking about the site such as resolving disputes doing maintenance and adding new features but as they read deeper into the chat logs they found the real names of both the admins of the site.
Further in the logs they found the home address of one of the admins. The Dutch government had the names and possible location of the two men that were running the Hansa dark market but a new problem was encountered. The home address of the admin was in Germany. When the Dutch government contacted Germany to request their arrest and extradition, the German government explained they are already tracking those two guys. The same two guys who were running the Hansa dark market had previously created an online site to buy and sell pirated e-books and audiobooks. The German police were trying to find the location of these two guys to arrest them. The Dutch and German authorities began hatching a new plan. They joined forces to capture these two guys under the existing German case but the Dutch government would take over Hansa.
This way Germany gets their suspects and the Netherlands gets control of Hansa to potentially catch more drug dealers. The plan was to gather enough evidence to arrest the two men at the same time they were logged in as admins to the site so they could take it over. But just as they were collecting more evidence against the two German admins, the Dutch server went offline. The Hansa admin saw a copy was made of the hard drives and it freaked them out so they moved the server to another location. Once again the location of the server became anonymized over Tor and the authorities had no idea where it went and therefore couldn’t take it over. They went back to looking over what they had, trying to figure out where they moved the server to. [MUSIC] Months and months go by without any clues as to where the servers had gone. Hansa continued to operate, becoming the go-to place in Europe to buy and sell drugs online.
In the chat logs on those old hard drives were a few Bitcoin addresses and the Dutch authorities were watching these addresses to see if anything was being sent in or out of those wallets. While Bitcoin is in fact anonymous, at some point you may want to exchange your Bitcoin for cash [00:20:00] and you need to do that at a Bitcoin exchange which is usually audited and licensed. The authorities saw one of the Bitcoin addresses sent money to an exchange in an attempt to move some money. This was a lucky break because the exchange they sent the money to was in Netherlands. The Dutch High Tech Crime Unit went down to the exchange to request the digital information on where the money was sent to. The Bitcoin exchange released the information and the Dutch authorities discovered the Bitcoin was sent to a server in Lithuania.
With the help of the Lithuanian government they were able to track down the exact location of where the new Hansa server was located. The Dutch, German, and Lithuanian government agencies had everything they needed to arrest the admins and take over Hansa. But at this point the FBI notified the Dutch authorities that they had discovered who was behind AlphaBay and the location of the server. The FBI was informing the Dutch that they’d be conducting a raid on the data center and arresting the owner. But the Dutch government said whoa, hold on. [MUSIC] The authorities for Germany, Dutch, and the FBI collaborated on a plan. Because the Dutch and German authorities were ready to take over Hansa they wanted to get control of Hansa before AlphaBay was to be taken down. The theory was that as soon as AlphaBay went down the users would flock to Hansa to continue to buy and sell illegal items.
If the Dutch government was already controlling Hansa they could collect a lot of information of the users of the site and potentially arrest a lot of dealers in the process. The FBI agreed to this plan and decided to call it Operation Bayonet. Bayonet was a play on a few words; Bay comes from AlphaBay, net comes from darknet, or internet, and it would also signify piercing the dark marketplace. Authorities believe that with the takedown of AlphaBay and the government controlling Hansa, after all this was over it would destroy trust in the dark marketplace for a long time, potentially crippling the whole online trade of illegal items. Operation Bayonet was a go. The next steps were for the takeover of Hansa. The Dutch authorities worked with Lithuania and Germany to conduct the raid on the data center and arrest the two men simultaneously. Lithuania agreed to the plan and two Dutch authorities went to the data center to prepare for the takeover. On June 20th, 2017, the plan sprang into action.
[MUSIC] The Dutch police raided the data center in Lithuania and the German police, with a very precise and careful method, raided the homes of both of the admins of the Hansa dark market. It’s not clear how this was done but the German police probably watched what the admins were doing and verified they were on their computers and then created a disturbance to get the men away from their computers while it was on. This had to be a very careful operation to successfully take over Hansa but the German police succeeded on both raids. They arrested both admins to the site while their laptops were open and unlocked. The German police gave the signal to the Dutch authorities who then quickly migrated the entire Hansa server to the Netherlands and under their control. The German police simply filed the reports as two guys being caught pirating e-books and audiobooks which meant all the users on the Hansa site were oblivious to the takedown and the moving of the servers.
While in jail the two men gave up all the passwords and credentials needed to access all parts of the site. The site had four moderators on it and even they didn’t know a takeover had occurred. This was a huge success for the Dutch and German authorities. Now that Europe’s most popular dark market was under Dutch government control they began turning the site into a mass surveillance station. [MUSIC] See, these dark markets have a lot of dealers, dealers who are selling massive amounts of meth, cocaine, heroin, weapons, and other illegal items. The authorities wanted to collect as much evidence as they could on those dealers so they could potentially stop them from selling any more. They first rewrote the code to log all user passwords in clear text. This way they could attempt to reuse those logins on other dark markets and websites. They found a way to read and log all communication between buyers and sellers while keeping it encrypted. This would reveal the home address of many of the buyers.
The site had previously stripped out all metadata from every picture uploaded. These would be pictures of illegal items for sale but the authorities were able to strip the metadata off these photos and save it before it was posted. This would reveal the date, time, camera that was used to take the photo, and sometimes geo-location of where the photo was taken. Once this was in place the Dutch police staged a fake server glitch which accidentally removed all photos on the site, forcing sellers to re-upload their photos which provided authorities with numerous seller locations. By this time Hansa had over 70,000 listings on its site at any given time so this was a lot of information for the authorities to process. Amazingly enough, the police also tricked users on the site to download a homing beacon. They claimed this file was a backup encryption key to access their Bitcoins if the site were to ever go down.
People downloaded it and opened it which would run a script that would try to connect to a URL and reveal that person’s real IP address. This gave authorities many more locations on where dealers were located and during this whole time the Dutch police continued to impersonate the two admins that were previously running the site, responding to other moderators, handling any site complaints from users, and actually doing a really good job with customer support. The users seemed very [00:25:00] happy with the level of customer support they were getting from the site, completely unaware it was being ran by the Dutch government and the Dutch authorities continued to let all items be bought and sold except for one; they banned the sale of Fentanyl on the site. This is similar to heroin but is more dangerous and contributed to numerous overdoses according to authorities.
At this point the trap was set. The Dutch police had set up a honeypot by using a very popular drug marketplace to attract criminals to conduct crimes under their watchful eye. Now that they were collecting tons of information they were ready for the FBI to conduct the next step in Operation Bayonet. The FBI was ready for action. They tracked down the owner of AlphaBay to Alexandre Cazès who was living in Thailand. They tracked down the location of the server to be in Montreal, Canada. The FBI coordinated with Canada and Thailand to do a simultaneous raid on the data center and Alexandre’s house. Again the goal was to arrest Alexandre while he was logged into his computer so the authorities could have proof as to who the admin was for the site. On July 5th, 2017 the authorities of Canada, Thailand, and the FBI sprang into action.
[MUSIC] The Canadian police raided the data center and started taking the servers offline. The Thai police went to Alexandre’s fancy and expensive villa and they used an unmarked police car to stage a fake accident in front of the house. While a plain-clothes cop was attempting to turn his car around he smashed into the front gate of Alexandre’s house on purpose but made it look like an accident. [SHOUTING] This created a disturbance. Other plain-clothes cops acting like neighbors started yelling but no sign of Alexandre. They knew he was home. He just wasn’t coming outside so they continued yelling and trying to turn the car around and making more of a ruckus in his driveway. After what seemed like an eternity for the police he came outside to see what was going on. He came out with his cell phone in his hand, wearing a pair of blue shorts and sneakers. He had no shirt on. He came out to the front of his driveway to inspect the smashed gate while the plain-clothes cops posing as neighbors surrounded him.
He was confused and mad about the gate but the signal was given and the cops came after him. Alexandre ran but not far. Cops immediately grabbed him and wrestled him into a pair of handcuffs. [SIRENS] Alexandre’s phone was quickly taken from him and kept open so it wouldn’t become locked. The Thai police ran inside and found his computer open and logged into the AlphaBay server as admin. He had been trying to figure out why the servers in Montreal were going down. When the Royal Thai Police and the FBI examined his computer they found a text file with all the passwords for the AlphaBay site. This would be enough evidence to convict him of being the owner of the largest dark market in the world. The raid on the Montreal data center was also a success and the FBI was able to seize his servers and take them offline immediately.
The capture of Alexandre Cazès remained quiet. The FBI did not announce they have taken AlphaBay offline. This caused a flurry of angry AlphaBay users who immediately thought there was an exit strategy, just like how the admins to Evolution had simply closed up and took everyone’s Bitcoins. After days of AlphaBay being offline people suspected the site owner had stolen all their Bitcoins too. Alexandre Cazès was taken to a Thai jail where he would wait to be extradited to the US. They found that Alexandre was married to a Thai woman in her early twenties and he had been living in Thailand for the last eight years. AlphaBay was only two years old. Before that he was a software developer. Alexandre, in my opinion, looks like an average computer techie. He’s 26 years old, white guy, grew up in Montreal, Canada. He looks like a young Elon Musk. His hair is always a little out of place and he seems to slightly underdress. Not muscular, not extra-fit, not overweight either.
He had a traditional Thai wedding and all his groomsmen all look Thai, too. I’m not sure if that means he only had Thai friends or if he simply lived a very private life. His wife looks kind and generous and happy in the photos. From just her appearances she looks like someone who’s simple and a good caretaker. She doesn’t dress flashy or extra-sexy or seem to be high maintenance. She just looks like a caring and sweet girl. When the police questioned her she said her job was a researcher at an academic institution which kind of fits her appearance. She’s likely very close to her parents and down to earth. Neither Alexandre or his wife look like kingpins to the world’s biggest drug marketplace. The US filed a civil forfeiture complaint against Alexandre and his wife which allowed the FBI to seize everything they owned.
[MUSIC] While conducting their seizures they found Alexandre had kept a meticulous journal of all his assets. This made it easy for the FBI to go and collect it all. Here’s what the FBI seized; ten vehicles including a Lamborghini purchased at $900,000, a Mini Cooper that his wife drove, a BMW motorcycle, and a Porsche Panamera. Numerous pieces of real estate including his primary luxurious villa in Thailand, and he owned the house next door which was for his wife’s parents to live in. He also was building a new luxury villa in Bangkok and he had vacation homes in Phuket, Antigua, and Cyprus. [00:30:00] His home in Cyprus cost 2.3 million dollars because you can become a resident of Cyprus if you own two million dollars in real estate which is what he was trying to become a resident of. He also paid Antigua $400,000 to become a resident there. He had three Thai bank accounts, one Swiss bank account, and one bank account in St. Vincent in The Grenadines.
He was also holding large amounts of crypto-currencies including Bitcoin, Ethereum, Monero, and Zcash. Between his bank accounts and crypto-currencies the FBI seized 8.8 million dollars. On top of all that the FBI seized all the Bitcoin, Monero, and Ethereum that were on the AlphaBay servers that were seized in Montreal. When AlphaBay was seized it had 250,000 active listings. To put this into perspective, Silk Road had only 13,000 listings when it was shut down. You can see AlphaBay was almost twenty times bigger than Silk Road in terms of active listings. Alexandre was charging 2 - 4% commission on every transaction and the logs showed that about 840,000 Bitcoins were transferred through AlphaBay totaling around $450,000,000 in transactions. The feds estimated his commissions for all this was somewhere between 9 and 18 million dollars. According to Alexandre’s notes, he claimed he had a self net-worth of $23,000,000.
[MUSIC] This kind of cash is what I expect a kingpin like this to have because he knew full well what he was getting himself into when he started this. It’s a risky, extremely risky business. He knew his life would be in danger and he had to be absolutely perfect at not being caught every step of the way. To take this ride with the devil, it better be worth it. Millions of dollars seemed to make it worth it for Alexandre. Again, looking at his photos of his wife he simply doesn’t seem like your stereotypical millionaire drug lord. She looks like the girl next door. He looks a little dorky and even when he wears a suit and poses in front of his Lamborghini he seems to be out of place in the suit. I don’t know, maybe I should start changing how I perceive big-time drug dealers.
A Montreal-Canadian news outlet would later interview Alexandre’s father who said Alexandre was so kind and caring. He wouldn’t hurt a fly. He never had a criminal record, never smoked, never did any drugs. He was very smart and even skipped a whole year in school because he did so well. According to his father, his wife was eight months pregnant. While in jail, Alexandre knew everything was being seized and taken away from him and his wife was being questioned and he was concerned about her parent’s house being seized away from them and he also knew full well that Ross Ulbricht, the guy who got caught running Silk Road, received life in prison without the possibility of parole. Alexandre was scared, really scared and felt like he had no options. The world was closing in on him all around and he didn’t want to face any of it.
On July 12th after sitting in a Thai jail for seven days Alexandre wrapped a towel around his neck, twisted it tight, tied it into a knot, and committed suicide. The next morning the Thai police found him dead in his jail cell and this hit the news in Thailand. At that point the Wall Street Journal broke the story for the rest of the world that AlphaBay was seized by the feds and the owner of the site was dead. This sent the users of the dark markets into a panic. [MUSIC] People were freaked out that the feds had taken over AlphaBay. Numerous conspiracy theories started springing up about his death; was he murdered by another dark market owner? Was he murdered by the real AlphaBay owner? Was he murdered by the feds? Why did he commit suicide? Darknet forums were abuzz with the chatter about this event.
Once AlphaBay shut down, just like according to plan, a ton of new users started registering at the Dutch government-controlled Hansa dark market. Over 5,000 new users a day were registering at the site which is a massive jump from the normal 600 new users a day. In fact the number of new users were so high it broke the registration system and the Dutch police had to spend a few days getting it back online. Under Dutch law they were required to track and report every sale on the site, about 1,000 transactions a day were being conducted on Hansa and this was becoming too much paperwork for the Dutch authorities to handle. After the Dutch government had ran Hansa for 27 days and collected information on about 27,000 transactions they pulled the plug on the server, shutting the whole operation down.
Immediately the Dutch authorities placed a banner on the site. It said the Hansa hidden site had been seized by the Dutch National Police. At the same time AlphaBay’s site started displaying it had been seized by the FBI. News of both sites being controlled by government agencies shattered trust in many dark market buyers and sellers and it sent the whole community into chaos. Two days after Hansa was shut down, US Attorney General Jeff Sessions made a press statement.
JEFF: Today the Department of Justice announced the takedown of the dark web market AlphaBay. This is the largest dark market web place takedown [00:35:00] in world history. This is likely one of the most important criminal investigations of this entire year. I have no doubt of that. Make no mistake, the forces of law and justice face a challenge from criminals and transnational criminal organizations who think they can commit their crimes with impunity by going dark. This case, pursued by dedicated agents and prosecutors says you are not safe. You cannot hide. We will find you, dismantle your organization and network, and we will prosecute you. The darknet is not a place to hide.
JACK: For the FBI they were able to gather more evidence and go after moderators of AlphaBay and capture and arrest them. For the Dutch police, they collected information on over 420,000 users and collected 10,000 home addresses. They turned this information over to Europol to further take action. They seized about $12,000,000 worth of Bitcoin that was on the Hansa server at the time of shutdown and they arrested over a dozen dealers that were located in the Netherlands. They also claimed to have conducted over fifty knock and talks where the police would come visit someone and talk to them if they were a known big buyer or seller. The FBI and Dutch police continue to this day to go through the data they collected to track down anyone they got information on.
When both AlphaBay and Hansa went down and the people discovered it was taken over by the feds, this really rattled the dark market communities. After Hansa there wasn’t a mass migration to another site. Users scattered. They went back to the streets or simply gave up on it altogether. The feds not only infiltrated the darknet but they infiltrated the minds of the people on the darknet. Immediately after these takedowns, people were much more cautious. Some were panicking. They weren’t using good operation security and they reused passwords and put in their home address and they were sloppy with privacy. It certainly made a dramatic short-term impact on the dark market trading scene. After all, this was the most elaborate and coordinated sting ever conducted on the darknet.
But the long-term impact is yet to be seen. Today new dark markets are gaining in size such as Dream Market and Wall Street. But users of those sites should be aware of the history of dark markets. You never know if the feds are selling or buying drugs on there or controlling the site outright. You can never guess as to when the owner just might decide to shut down the site and steal everyone’s Bitcoins. But here’s what I take away from this story; the only way the feds were able to catch anyone was because of that person’s poor personal security. Alexandre was only discovered because he accidentally put his personal e-mail address in the Reply To of the welcome e-mail which directly connected him to his LinkedIn profile.
The German Hansa guys were only caught because they put their real names and addresses in the chat logs on their server. The big-time sellers that the Dutch government caught were only discovered because they didn’t scrub out the metadata from the photos and didn’t cover their tracks properly. The feds caught all these people because these people slacked off just a tiny bit on their own security. Not because there’s some super-secret way to track who owns a Bitcoin wallet or who is on Tor. Jeff Sessions says the darknet is not a place to hide but clearly it is if the right precautions are made. With all the time and money and effort they put into taking down AlphaBay, the feds would have used a more scary method to track down these guys if they had scary ways to do it. But they had to wait and watch for years to spot a mess up in operational security.
It’s probably true that you’ll never shake the feds from trying to track you if you run the largest dark market in the world. They’ll probably catch you eventually but maybe you make enough money and give the site to someone else and then disappear completely. Alexandre had $20,000,000 in assets and I wonder how much more he thought he needed for him to just disconnect from it all and change his name and live a nice happy life with his wife in Antigua. If you do want to be anonymous and conduct massive illegal activities online, you still can but it takes a lot of time and effort for it to become that safe. You need to exercise all the options you can to stay anonymous.
Here’s a starter pack; use Tor, use a VPN, take advantage of Bitcoin tumblers, use PGP in encrypted chats, use fake personas. Don’t ship anything to your actual house. Strip out all metadata from photos and use a separate computer to do all this on. Because if you take all these steps to be anonymous then you just log into Facebook, if someone was tracking your anonymous persona they now know you own that Facebook account and can link it back to you. When you set all this up keep it separate from everything that’s connected to your real persona and don’t tell anyone about it. Another thing this story proves to me is that there’s a massive world-wide demand for illegal items. When there’s a demand this large there will always be someone willing to risk their life and take that forbidden ride Fand build a dark market and cash in on that demand.
JACK (OUTRO): [OUTRO MUSIC] You’ve been listening to Darknet Diaries. Please consider donating to help support this show [00:40:00] by visiting darknetdiaries.com/donate. It really helps a lot. This show is created by me, Alpha03, Jack Rhysider. Mixing is done by Sono Sanctus and the theme music is created by the hooded Breakmaster Cylinder.
[OUTRO MUSIC ENDS]
[END OF RECORDING]