June 26th, 2018 the Department of Defense published a press release announcing one of the largest dark web related sting operations to date. According to the press release the operation resulted in dozens of arrests spanning across the United States, and lead to the seizure of a galaxy of drugs, firearms, and crypto-currency and included several law enforcement agencies.
Law Enforcement has been changing the way they tackle crime related to the darknet, as we saw last year with Hansa Market and AlphaBay Market, and the tactic employed this time around is another first. Between the anonymity provided through Tor, Bitcoin, VPN, tails, and other anonymity tools and services meant to provide a layer of protection to darknet buyers, markets, and vendors, Law Enforcement agents are pressed to find creative new methods to unmask their targets. The release revealed that the primary tactic employed this time around consisted of a cryptocurrency laundering service.
The DOJ Press Release revealed that law enforcement agents apprehended a cryptocurrency exchanger named Nicholas J Powell who operated a bitcoin laundering service back in October 2016. With Powell’s cooperation, Law Enforcement was able to gain control of their account and continued to operate the service undercover. LE even began to advertise the service on numerous Darknet Markets starting as early as January 2017. This allowed the Department of Justice to gain full access to the transactions of darknet vendors and buyers that were processed through the laundering service.
The LE run laundering service was eventually advertised and offered across several major darknet markets. LE mentioned the service had a presence in the AlphaBay forums and held some presence on Wall Street Market, Dream Market, and others.
HSI Special Agent in Charge Angel Melendez mentioned that the primary focus of this operation was not to take down marketplaces, but to take down vendors operating on the darknet markets. “When we take down a dark net marketplace, these criminals will move to other marketplaces,” Melendez said during a press conference. “So the focus of this operation was really the bad actors, the people utilizing the darknet to sell drugs.”
Through the access provided by the cryptocurrency laundering service and other methods, Law Enforcement was able to successfully trace transactions from darknet markets directly to the vendor’s personnel bitcoin wallets. While Melendez declined to provide additional specifics into the methods used to trace the bitcoin transactions, he did mention that they were using other tools to analyze the blockchain. Public records do show that HSI’s patent agency invested over $58,000 into Blockchain analyzing technology months leading up to the initial investigation.
The announcement also showed that Homeland Security operated the service for over a year, providing cash for bitcoin and has so far traced over $20 million dollars linked to drug-related crimes. So far the operation has lead to the arrest of over 40 darknet market vendors, and the seizure of over $3 million in cash, large quantities of pharmaceuticals (over 24 kg of Xanax and 100k tramadol pills), 300 models of synthetic narcotics, 100 grams of fentanyl, 2000 bitcoin, 100 guns (including a grenade launcher), bitcoin mining hardware, 15 pill presses and other drugs and properties. The current total value of seized goods holds an estimated value of over $20 million dollars.
The press release also included the named the following vendors apprehended in the sting operation who have been federally charged.
TrapGod – Antonio Tirado and Jeffrey Morales of Bronx NY (Arrested June 18). Federal Agents claimed they recovered U.S. Postal Service shipping boxes, already addressed to customers around the United States.
Cannabars AKA TheFastPlug – Jose Robert Porras III, 21, and Pasia Vue, 23, both of Sacramento who operated on several darknet markets including Trade Route, Wall Street Market, and Dream Market.
Sawgrass aka Ross4Less aka ChristmasTree – Daniel Boyd McMonegal, 35, of San Luis Obispo and Mariposa, California who mainly operated on Dream Market.
TheSource aka BonnienClyde aka BnC aka BCPHARMA aka Money TS – Nicholas J. Powell, 32, and Michael Gonzalez, 27, former and current residents of Parma, Ohio.
Several Unmentioned Accounts – Sam Bent, 32, of St. Johnsbury, Vermont (and formerly of East Burke, Vermont), and his cousin, Djeneba Bent, 26, also of St. Johnsbury who operated several accounts and shipped orders from several different post offices in Northeastern Vermont and Northwestern New Hampshire.
Over 50 darknet vendor accounts have been identified according to the Press Release.
The operation has spanned across New York, Maryland, and several other states, and has involved the DEA, US Secret Service, HSI, US Postal Service and other Federal Agencies. It is currently unclear if this operation will lead to vendor arrests in other countries, but according to the present information there are still several open investigations and the case is ongoing.