Authorities Track Bitcoin Transactions of Dark Web Drug Dealer, Arrested

A 36-year-old French national plead guilty this week in U.S. courts for selling narcotics for Bitcoin on the dark web. Guy Vallerius, who operated under the monkier ‘OxyMonster,’ was arrested by authorities at the Atalanta airport last September as he was making his way to Austin, Texas to take part in the World Beard and Mustache Championships.

As the criminal complaint filed last year shows, U.S. authorities were able to identify Vallerius as OxyMonster — as well as keep him under surveillance — after they discovered one of his Bitcoin accounts. They got to his Bitcoin account through Vallerius’ ‘tip jar’ on the Dream Market dark web marketplace.

The purpose of the tip jar was to allow buyers on Dream Market to tip Vallerius for his services — selling the opiate painkiller Oxycodone and the ADHD drug Ritalin. The problem for Vallerius was, unlike most vendors on the Dream Market, he did not configure his tips to go through the marketplace’s internal payment systems, which passed transactions through a tumbler/mixer. Instead, he set the tip jar to receive funds at a Bitcoin address he set up.

The complaint reads:

“After observing the bitcoin ‘tip jar’ advertised by OxyMonsyter, agents conducted [an] analysis of the incoming and outgoing transactions from that bitcoin address and learned that 15 out of 17 outgoing transactions from the OxyMonster tip jar went to multiple wallets controlled by French national Gal VALLERIUS on localbitcoins.com.”

This slip-up allowed law enforcement to get a clue of who may be behind the OxyMonster monicker. Their suspicions were later confirmed when an analysis of OxyMonster and Vallerius’ writing styles suggested they were the same person:

“Open source data revealed that VALLERIUS has Instagram and Twitter accounts. Agents compared the writing style of OxyMonster on Dream Market forum while in Senior Moderator role to the writing style of VALLERIUS on his public Instagram and Twitter accounts. Agents discovered many similarities in the use of words and punctuation to including: the word ‘cheers;’ double exclamation marks; frequent use of quotation marks; and intermittent French posts.”

Vallerius’ identity was confirmed when border agents subjected him to a search at the Atlanta airport, following a search of his laptop, which was later seized.

Following the search and seizure, agents found incriminating evidence on the laptop, including the PGP encryption key that OxyMonster used to sign messages online, OxyMonster’s login credentials for the Dream Market, and Bitcoin addresses associated with OxyMonster’s vendor accounts. According to authorities, the wallets contained a combined $500,000 worth of the cryptocurrency.

Fast forward to this week. After fighting his charges for nearly a year in attempts to avoid a lifetime prison sentence, Vallerius has plead guilty in a plea deal, admitting to selling Oxycodone and Ritalin on the Dream Market under the name of OxyMonster.

Officially, Vallerius pleaded guilty for conspiracy to possess with the intent to distribute controlled substances and conspiracy to launder money. This is because not only was he a vendor, but also an administrator and moderator on the Dream Market. Thanks to his plea deal, Vallerius now faces a sentence of 20 years in prison, not life.

Over the past year, U.S. authorities have brought charges against many users of dark web marketplaces. In February, two dozen midshipmen based at the U.S. navel academy in Annapolis, Maryland, were charged with being part of an elaborate scheme to sell drugs purchased with Bitcoin on the dark web.

But despite high-profile cases like these, reports earlier this year from the Foundation for Defense of Democracies found that, in reality, less than one percent of Bitcoin is used for illegal or nefarious purposes. Moving forward, it’s important to remember that criminals have existed since the beginning of time — long before Bitcoin — and they will continue to leverage new technologies to their own benefit.

Source link