Darknet Diaries - 58: OxyMonster

Episode Date: February 4, 2020

OxyMonster sold drugs on the darknet at Dream Market. Something happened though, and it all came crashing down.SponsorsThis episode was sponsored by Detectify. Try their web vulnerability scanner free. Go to https://detectify.com/?utm_source=podcast&utm_medium=referral&utm_campaign=DARKNETThis episode was sponsored by Molekule, a new air purifier that completely destroys air pollutants to help you breath easier. https://molekule.com to use check out code “DARKNET10” to get a discount.See complete list of sources at https://darknetdiaries.com/episode/58.

I better do a warning here. This episode is going to talk about drugs and dark markets, like the whole episode. So if you'd rather not listen to me go on and on about drugs for an hour, you might want to consider skipping this one. Also, it might help to listen to episode 24 first. That one's called Operation Bayonet, which goes into detail about drugs being sold on these dark markets. You don't need to listen to Operation Bayonet first, but it does explain a lot of stuff and leads you up to the events before this one. So it's a good idea to pause this one, go to Operation Bayonet first, and then come back to this one. You know, the internet has really brought to life a whole new user base that traditionally was very different. For instance, stock market trading. Traditionally, this was a very slow system. You first needed to get extra money to invest with,

which was easier to get decades ago. Then you call your broker to buy some stocks. Then you wait for a while and sell it maybe years later. And during that time, you might check the paper like every day, once a day, once a week to see how things are going. Because that's all you really had access to. But the internet has made stock market trading so different. You now have up-to-the-second data on stock prices,

incredible tools to help you spot potential buys, and endless YouTube videos of people teaching you how to do it. Stock market trading has attracted a much younger tech-savvy audience now, too. People are in and out of the market in just a few minutes or seconds instead of years. And you can set up trading bots or scripts and get alerts when prices hit a certain amount. And it's all done without talking to a single person. And the traditional drug dealer has changed, too. It used to be all done on the streets through in-person meetings,

which means to be a drug dealer, you probably want to be a mean-looking person that nobody wants to mess with. You've got to be able to hold your own if the deal goes bad and not just let someone punch you in the face and steal all your stuff. But now you can buy and sell drugs online, and the online drug dealers are a completely different group of people. The street smarts have changed. Instead of being able to defend yourself in a bad deal, that's been replaced with knowledge of shipping and packaging. And instead of knowing how to hide from the local police patrolling the neighborhood and how to make deals in public casually without attracting any attention, all that's been replaced with the knowledge of being anonymous online. Because the most important thing for an online drug dealer

is that they have to know how to stay hidden from the feds. Because it's not your average cop looking for you. You've got a huge task force of federal law enforcements around the world all trying to figure out who the top sellers are of these sites. So every move you do online is being watched by them. And you've got to be 100% that you're maintaining your anonymity, because one wrong slip-up of revealing just a tad too much information can have severe consequences. These are true stories from the dark side of the internet. I'm Jack Recider.

This is Dark by Delete Me. I know a bit too much about how scam callers work. They'll use anything they can find about you online to try to get at your money. And our personal information is all over the place online. Phone numbers, addresses, family members, where you work, what kind of car you drive. It's endless. And it's not a fair fight. But I realize I don't need to be fighting this alone anymore.

Now I use the help of Delete.me. Delete.me is a subscription service that finds and removes personal information from hundreds of data brokers' websites. And continuously works to keep it off. Data brokers hate them. Because Delete.me makes sure your personal profile is no longer theirs to sell. I tried it and they immediately got busy scouring the internet for my name and gave me reports on what they found. And then they got busy deleting things.

It was great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for Darknet Diaries listeners. Today, get 20% off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries and use promo code darknet at checkout. The only way to get 20% off is to go to joindeleteme.com slash darknetdiaries and enter code darknet at checkout. That's joindeleteme.com slash darknetdiaries. Use code darknet at checkout. That's join, delete me.com slash Darknet Diaries. Use code Darknet. Support for this show comes from Black Hills Information Security. This is a company that does penetration testing, incident response, and active monitoring to help keep businesses secure.

I know a few people who work over there and I can vouch they do very good work. If you want to improve the security of your organization, give them a call. I'm sure they can help. But the founder of the company, John Strand, is a teacher, and he's made it a mission to make Black Hills Information Security world-class in security training. You can learn things like penetration testing,

securing the cloud, breaching the cloud, digital forensics, and so much more. But get this, the whole thing is pay what you can. Black Hills believes that great intro security classes do not need to be expensive. And they are trying to break down barriers to get more people into the security field. And if you decide to pay over $195, you get six months access to the MetaCTF Cyber Range, which is great for practicing your skills and showing them off to potential employers. Head on over to BlackHillsInfosec.com to learn more about

what services they offer and find links to their webcasts to get some world-class training. That's BlackHillsInfosec.com. BlackHills InfoSec dot com. Us humans are addicted to opioids. We love this stuff. Doctors have been prescribing it to us for decades in the forms of oxycodone, hydrocodone, codeine, fentanyl, and morphine. I might even go so far as to say

there have been wars fought over this stuff. I mean, Afghanistan exports more opium than all other countries in the world. And in 2001, the US invaded it. I'm sure opium played some part of that war. But here's the thing with opium. If you have some serious pain, these drugs can make you feel a lot better. But even if you take it for just five days, you have like a 10% chance of becoming addicted to it. And the longer you take it, the bigger chance you have of being addicted. American doctors have a problem with over

prescribing medication. So doctor's prescriptions are a huge contributing factor to the opioid addiction. When the patient is no longer in pain and goes home from the hospital, they might start feeling sick. Like they might start feeling nauseous and sweating and chills and vomiting and anxiety. And they crave their medication again. But of course, the doctor won't give them anymore. So to help with their sickness, they turn to the streets to look for more of the same medicine. But of course, the streets have a bigger variety of opioids. And for pretty low prices too.

And of course, one of the easiest ways to buy street drugs now is online, on darknet markets. It's just much easier and convenient to buy drugs online. But online darknet marketplaces are shady and secretive. They're an online dealer's playpen, where real identities are hidden and illegal substances are everywhere, like LSD, hydrocodone, meth, cocaine, heroin, fentanyl. It's all there.

And these markets have both sellers and buyers. And one such dark market drug dealer is named Kyle Enos. He got arrested in the UK for selling drugs on a darknet market. Here's an interview he had with UK's National Crime Agency. So you've been arrested on suspicion of production and possession of a controlled drug of class A. had with UK's National Crime Agency. So you've been arrested on suspicion of production position of controlled drug of class A. Are you responsible for the production and position of that drug? Production? I've never produced anything. I order it from online and it comes and then I basically

just distribute it and that's it. What do you offer on your profile? What is offered? Buy one, get one free. I don't produce anything. I'm not an organic chemist or anything like that. With the Fenton, to concern the drug there then, do you put any gloves on or any protective clothing when you do it? Yeah, gloves, because I don't want to... What's the word? I don't want to contaminate it or anything like that.

What do you see are the dangers with that drug? Well, I know it's a strong opioid, which, you know, I know it's quite a strong opioid. But like I said, I've got a warning on my page. It's a very strong, do not take it unless you know what it is. And like I said, it's all measured correctly and everything. I don't mix it with anything else. It's exactly as it's advertised.

And I don't say, hey, if you're a newbie, try it. Kyle Enos lived in Wales, in the UK. He was 25 years old and he was selling fentanyl on AlphaBay, Hansa and the Dream dark marketplaces. Fentanyl is seriously toxic stuff. 100 times stronger than morphine and 50 times stronger than heroin. Going by the name Soviet Bear, he sold fentanyl to 168 people across the UK, the US, and Europe in 2016 and 17. And four of his customers actually died after taking it. Because that's the danger of fentanyl. It's more lethal than any other illegal street drug.

Kyle was caught and arrested. On February 5th, 2018, he got sentenced to eight years in prison. For law enforcement, busting people on the darknet is a patient game of cat and mouse. The vendors, buyers, and admins of the websites are trying to keep out of the way of the feds. On the darknet, no one's real identity is used. Everyone is known by their chosen username, and these names are the only way to recognize anyone. But not knowing anyone is what makes this a game of chance. Undercover agents lie in wait. They pay attention.

They follow all the leads. If the users of the dark markets practice good operations security or OPSEC, it'll make it extremely hard, if not impossible, for feds to catch them. Usually the feds have to wait for a lucky break or for someone to mess up so they can then track that user to a real person in the real world. Ross Olbrecht was the founder of Silk Road, one of the first big dark marketplaces. He was caught because he made a mistake and didn't cover his tracks well enough. By the time he realized his mistake, it was too late. He'd been spotted by the FBI and they were on to him. Alexander Kazas, he created another dark marketplace called AlphaBay. He too made a mistake and used his personal email in the headers of a welcome email to his website. He used the same email address

that was linked to his PayPal account, which led the feds right to him. To get into the darknet, you have to use Tor. Tor is a hidden network that sits on top of the internet, but only people who are on this hidden network can see what's on Tor. And on top of that, there's a level of privacy that makes things a little more attractive. It basically hides your real IP address, so you can't be tracked. The website doesn't know which IP address any visitor actually came from, and neither does anyone monitoring the traffic onto the site. Of course, just hiding your IP is not enough to keep you hidden. You need to set up a burner phone, a burner email, and do things like use a secure OS, like Tails or Cubes, and don't give any clues as to who you are. Like, don't use the same browser to log into Facebook, because that pretty much

identifies you. When you want to buy from a darknet market, there's another security layer you have to consider. To buy drugs, you need to tell the seller your address and then pay for it. There's no payment screens or PayPal or debit card on the darknet. And to be extra safe, you don't want the site admins to see the address you want things shipped to. So you set up a secure encrypted chat between buyer and seller. PGP, pretty good privacy, is the usual one used. It takes an extra step to set up, but it's worth it. A buyer wants to talk to a seller. The seller posts their PGP encryption key on their profile. Then the buyer uses that key to send encrypted messages to the seller, and only the seller has the decryption key to see what was

said. This makes the message really hard to read, if not impossible to read, by prying eyes. Then, to pay for the goods, you need to send money. While historically there used to be things like e-gold and Liberty Reserve, something is far better than that now. Cryptocurrencies. Cryptocurrencies, like Bitcoin, are the perfect way to pay for things on the dark marketplaces. It's easy to get, it's legal to own, transactions are pretty quick, low fees, and it's completely anonymous. Bitcoin

is not tied to any person's name or address or social security number. Whoever owns the private key to unlock the Bitcoin wallet is who owns that Bitcoin. So these dark markets all accept Bitcoin. Sometimes other coins are accepted too, like Monero. These are virtual currencies that can be exchanged for local money. It's perfect for this. And cryptocurrencies are untraceable. Actually, wait a minute. It turns out they're not completely that untraceable after all. Silk Road was one of the biggest dark markets ever, but it was brought down by the feds in 2013. Shortly after that, new dark markets were entering the ring. The dream market was stood up pretty quickly, and it was modeled to look and act just like Silk Road,

which all the other dark markets were doing the same too. The structure followed the same trend. There were administrators and moderators to keep the site running smoothly, vendors that sold illegal goods, and buyersators to keep the site running smoothly, vendors that sold illegal goods, and buyers looking to make purchases on the quiet. But of course, this kind of website will attract the FBI in a major way. Here's a clip from the FBI's website explaining what darknet marketplaces are. On darknet marketplaces, they offer illicit goods such as drugs, guns, a hacked bank account, and credit card information.

A darknet drug vendor is a little bit different than an actual street corner dealer because of the reach that they have. They have access to hundreds of thousands of buyers at a time from across the country as well as internationally. So just by taking down one darknet drug vendor, you can have the same effect as taking down a traditional mid-level size drug trafficking organization. So you can see, as darknet markets started rising in popularity,

it also attracted the attention of the feds. Dream Market had a dual rating system for its vendors. It was sort of like Amazon with star ratings from buyers. The average score from vendors was shown on the profile, along with the number of positive and negative reviews they had. Build up a good sales history with satisfied customers, and they'd get a trusted vendor label. A sure sign to buyers that this is a vendor that they are safe to buy from. Dream Market also had a bug bounty system going, so if anyone spotted a bug or security issue on the site, they could report it to the admins and get $75. At one point, AlphaBay became the most profitable dark market on Tor, and Dream Market was the second biggest. But when AlphaBay went

down, Dream Market stepped in as the new king of the scene. And it was one of the longest running markets in the time. So sure, why not go to a long running one which has a good reputation? And this is where Kyle Enos sold drugs. You remember him at the beginning? He got arrested for selling fentanyl. The National Crime Agency in England was very unhappy about that. So the NCA set up a whole operation to try to catch Kyle because they ferociously fight to get fentanyl off the drug marketplaces because of how dangerous it is. It's just really lethal. And the worst part about fentanyl is that people mix it into heroin and cocaine and sell it to people who are completely unaware they're taking fentanyl

at all. It's like 50 times more potent than anything you think you're taking. And the reason why fentanyl gets laced into other drugs is because it's cheaper to make. So some suppliers will get some fentanyl and try to sell it off as heroin to make more money. Kyle said he sold fentanyl but simply passed it from the supplier to the buyer and didn't try to hide what it was. Kyle was caught and arrested and is serving eight years in prison. In May 2015, a new person registered an account on the Dream Market. The username was Oxymonster. And just six months after that, Oxymonster got promoted to administrator

of the Dream Market. Now, admins are the top tiers in these markets. They have access to everything and have to be the most trusted of all. To be given such a role in just six months tells me Oxymonster was not new to the scene. No sensible site admin is going to give access to someone they knew nothing about six months ago. Because they could be anyone.

And that's the thing about these dark markets. Anyone could really be anyone, including undercover police agents. The DEA, FBI, and NCA are known to have their agents on undercover missions posing as buyers and vendors because they can use the anonymity of the dark markets to their advantage, hiding in with everyone else, watching and collecting data. In fact, in early 2016, the DEA started creeping around inside the dream market. They were posing as buyers and identified three vendors they were interested in. The DEA bought drugs from Digital Posse 2014, Reximus Maximus, and Meth for Dummies.

They ordered these drugs and had them shipped to Miami, where the DEA could inspect them for any clues. When they got them, they had the contents forensically tested to confirm they were narcotics. OxyMonster wasn't one of these targeted vendors, but his presence on the Dream Market was about to be noticed by law enforcement agents. In January 2017, DEA agents visited the Dream Market homepage and looked around. They saw there was a link to a forum called Dread. They clicked it and found themselves inside a message board for dark marketplaces. They saw this was somewhere people could go to for help and advice, and it was a place where admins and moderators would help out buyers and vendors to give them tips on how to do things better or stay safe and secure on the dark web.

It also seemed to be an area where any disputes between users of the site could be dealt with and sorted out. This is where the DEA agents first became aware of OxyMonster. The DEA is the drug enforcement agency of the US. They combat drug trafficking both on the streets and online. They noticed OxyMonster was helping users on this forum and they also connected him to be an admin on the Dream Market. So they looked back at all of OxyMonster's posts on the forum, which led back all the way to May 2015. Whoever OxyMonster was, they certainly knew a lot about drugs and how to stay hidden on the darknet, and they were familiar with a lot of

darknet marketplaces. One of the things that caught the agent's eye was a post from March 2016 written by OxyMonster. It warned users any message claiming to be from mods not listing in the post. So the DEA agents started watching OxyMonster on Dream Market and on the forums. What does he do on this site? How involved is he exactly? By June of 2017, it was clear that OxyMonster was selling drugs on these dark marketplaces. He was selling things like OxyContin and Ritalin, which are prescription drugs. Well, I guess that explains his choice of username. He had 60 sales and got good ratings too.

Positive reviews from satisfied customers. And now that he's selling drugs on Dream Market, this has caught the attention even more of the DEA. OxyMonster is an admin to Dream Market, a senior moderator on the forum, and he's actively selling drugs to site users. That would be enough to catch the attention of the feds. Now, when you buy drugs on Dream Market, you send your Bitcoin to an escrow account. It goes to Dream Market's wallet and then gets handed to the vendor. This is an extra layer of security so that the vendor doesn't know what the buyer's Bitcoin address was

and the buyer doesn't know what the vendor's Bitcoin address was. Because you don't want the Feds to know your Bitcoin address because they might have ways to track it. So the Feds wanted more info on OxyMonster. So they watched his posts on these forums. And there was something OxyMonster would write in the footer of each post. It said basically that if this post was helpful, please consider tipping, and here's a link to a Bitcoin address. Hmm.

The footer also encouraged people to check out Oxymonster's account on TradeRoute, which is another dark market. And that profile confirmed he was selling drugs there too and listed the same tip jar address. It also told Feds that OxyMonster was a mod on the now defunct Evolution dark market. This is like a flashing light for law enforcement. Two profiles with links to three different markets

with the same Bitcoin wallet? This is a person who's been very active in the dark marketplace forums for two years as an active seller on multiple sites. An admin on another is just asking to be followed up on. And that's the problem with these sites. You want a good reputation as a seller. So buyers like you. But as soon as you get one, the feds start looking for you, too. While the feds were trying to find out who OxyMonster was on DreamMarket, the FBI was working with the Dutch police to take out two of Dream's biggest competitors.

In 2017, Alphabet was one of the biggest dark markets selling everything from drugs to weapons to malicious software. And the FBI was watching this market for months. And in July of 2017, they arrested Alphabet's founder, Alexander Kazas, in Thailand and took the market offline. Again, this is something I covered in episode 24. It's a really fascinating listen, so check out the episode Operation Bayonet

if you want to know more, because it was a pretty impressive operation the feds pulled off there. And at the same time, multiple law enforcement agencies came together, including Europol and the Dutch police, to take down Hansa, the other darknet market. So when AlphaBay and Hansa got taken down, the darknet community went into a tailspin. Vendors needed a platform to keep selling, and buyers still wanted to buy drugs online.

And despite all the paranoia and suspicion, users headed straight on over to Dream Market as their next dark market. OxyMonster was already registered on Dream when all this went down with AlphaBay and Hansa. It seemed it didn't spook them at all. One month after the takedowns, OxyMonster became an official vendor on Dream Market and started shipping drugs to the US. With Hansa gone, he easily leveled up on Dream. But what he didn't know was that the DEA were watching what he was doing and trying to figure out who he really was.

So by August 2017, the DEA were following up on this tip jar Bitcoin wallet that OxyMonster was so keen to advertise. The idea that the feds had was to follow the money. While Bitcoin is supposed to be anonymous, if you follow it closely enough, you can sometimes figure out who owns a wallet. At least if you're the DEA, you might be able to. A Bitcoin wallet is just a long string of numbers and letters. It's impossible to link it to anyone. But just as dark markets have evolved, so has the technology checking out Bitcoin. You see, Bitcoin is virtual, but there's a solid system underneath it. A method to make sure that there's a public record of every transaction that passes from one person to another.

And that's what's called a blockchain. And there's an army of Bitcoin miners, people out there voluntarily keeping the blockchain up so that this public database is available for everyone and up to date. But now there's software available that analyzes Bitcoin transactions in the blockchain. You see, the blockchain records every transaction and it's unmutable, so you can't delete any records out of it. So the software can look for links between wallet addresses and activity and how things are moved around and any patterns and that sort of thing. There are two tools that are used to do this. One is called chain analysis and the other is called elliptical.

These are the two front runners and they're being used by the DEA, FBI, IRS, Europool to trace Bitcoin transactions in criminal cases. See, all Bitcoin transactions are public record, visible on the blockchain for anyone to see. By analyzing the blockchain and following transactions and wallets, you can start to build a dossier on who owns what. So for instance, there was an escrow service on DreamMarket. You send your Bitcoin there to buy a drug, and once the money is collected by DreamMarket, the seller is notified to send the drugs. So if the DEA knows the Bitcoin address of DreamMarket's escrow wallet, then they can use tools to see who's interacting with that wallet. Now, when someone goes to withdraw their Bitcoin and turn it into local money, this is another step that law enforcement will monitor closely. See, most Bitcoin exchanges are

regulated and need to comply with local law. And this makes the exchange trustworthy. But at the same time, it also means that law enforcement agents can issue search warrants on the exchanges to see who cashed out of certain Bitcoin wallets. So you see, the DEA had a variety of ways to track some Bitcoin wallets. And they were using these methods to watch what was going out of that tip jar address on OxyMonster's posts. Now, Darknet drug dealers know this and have come up with a pretty clever way to keep their cash outs more hidden. Bitcoin tumblers.

Basically, it's the same thing as taking a deck of cards and mixing them all up on the table, spreading them all over so that you can't see which card is what. You can send your Bitcoin to a Tumblr, which will then break apart your money into a bunch of various transactions, mix them up a bunch with a bunch of other people's Bitcoins, and then send you your money in a new fresh Bitcoin wallet. And the DEA has a much harder time tracking money that goes through a Bitcoin Tumblr. I'm not sure if there even is a way to track this. Now, DreamMarket had its own basic tumbling services. I mean, sure, why not? It's doing a lot of illegal transactions. Makes sense to provide a tumbling service to help its customers be more safe and secure.

But as the feds watched OxyMonster's Bitcoin tip jar address, they noticed he was sending money directly to an exchange without using a tumbler not even the tumbler that's on dream market that he was an admin of the feds watched and they saw that oxymonster sent his bitcoin to a website called localbitcoins.com he did this 15 times this is an exchange not regulated by the U.S. law. It's based in Finland, but it didn't ask you for any ID to cash out, which was what OxyMonster wanted to be anonymous when he was getting his money. OxyMonster cashed out on his tip jar earnings. When OxyMonster cashed out at LocalBitcoins.com, the DEA was able to work with the authorities in Finland to get anything they could on who owned that Bitcoin address.

Since this exchange didn't have any ID for OxyMonster, the only thing the DEA was able to get was the username that was used to log into this exchange with. And that was it. This was the only evidence they uncovered. And OxyMonster could have used any username in the world, random digits or letters, anything. But OxyMonster made a huge mistake and chose the username Valerius. And once the agents found this account, which was called Valerius, they set about trying to find more information. And they guessed that this might be someone's last name. So they looked at social media and searched around the internet. And it wasn't long before they found a guy online named Gal Valerius. He's a French national with

social profiles on Twitter and Instagram. Gal Valerius was 36 years old and living in the Brittany region of France with his wife and child, and he had French, English, and Israeli citizenship. Feds thought he might be the person behind the OxyMonster account. So agents began to compare the Dream Market posts with the posts on social media, looking for similarities in the writing. They found common words used, like for instance, both OxyMonster on Dream Market and Gal Valerius on Twitter said cheers a lot in their posts. Both sets of posts were sometimes written in French and used exclamation marks in the same way too. The DEA began to strongly suspect that Gal Valerius was OxyMonster, but they still needed solid evidence to secure the case against him.

One thing the DEA did discover when poking around in Gal's social media was a slightly unusual interest. Beards. That is, growing and comparing beard lengths. Gal had a long beard, down to his waist, and he seemed pretty proud of it. And he was a competitor in the World Beard and Mustache Championships, and an active member in an app called Beard Wars. On his social media account, he was posting that the next beard competition

was in Austin, Texas on September 1st, 2017. And guess who was going? Gal was going to Austin to compete in a beard competition. When agents realized Gal was flying into the U.S. to attend, they knew this was their chance. The DEA contacted Homeland Security Investigations and asked for their help. The plan was to detain Gal at the airport

while he was going through customs. They were going to tell him this is a routine check on all digital devices that he had with him. Remember, they'd been watching Gao for months, slowly building a case that he was the guy behind OxyMonster profile on Dream Market. This airport play was a big deal, and the feds had to act quick. September was fast approaching, and they needed more evidence if they were going to link Gao with OxyMonster if they're going to get this into court. This was a bit of a gamble for the Fed's part.

They knew he was flying into the U.S. for this three-day beard competition, and they just assumed he was going to bring his laptop into the country with him. I mean, if he was going to be coming for a few days, maybe he'd want to tend to his dark markets and do some trading while he was away, right? I guess that's a fair assumption. If they could get past whatever encryption and password protection he had on there, they might be able to get the evidence to prove that Gal is OxyMonster. So that's what the cops were betting on. Getting into his computer would be crucial for convicting him, and it posed a real challenge to authorities. So they had to come up with a plan to arrest Gao at the airport with his laptop unlocked. And when we come back from the break, we'll hear what the authorities did.

This episode is sponsored by SpyCloud. With major breaches and cyber attacks making the news daily, taking action on your company's exposure is more important than ever. I recently visited spycloud.com to check my darknet exposure and was surprised by just how much stolen identity data criminals have at their disposal, from credentials to cookies to PII. Knowing what's putting you and your organization at risk and what to remediate is critical for protecting you and your users from account takeover, session hijacking, and ransomware. SpyCloud exists to disrupt cybercrime with a mission to end criminals' ability to profit from stolen data. With SpyCloud, a leader in identity threat protection, you're never in the dark about your company's exposure from third-party breaches, successful phishes, or info-stealer infections. Get your free Darknet exposure report at spycloud.com slash darknetdiaries. The website is spycloud.com slash darknetdiaries.

On August 31st, the day before the competition, Gal and his wife Yasmin flew from Paris into Atlanta International Airport in Georgia. When they came off the plane, it was just after 1 p.m. in the afternoon. At this point, Gal had no idea the feds were on to him. They were stopped at customs and taken into a side room. The agents told them this is a routine check for U.S. passengers flying into the country, and they have to check all electronic devices for child pornography. A Homeland Security agent then searched their bags. He found Gal's Samsung laptop, an Apple iPhone, Yasmin's iPhone, and iPad tablet. The custom agents asked Gal for his pins and passwords to access these devices.

Now you'd think anyone involved in darknet trading would be guarding those passwords with their life. But Gal, still thinking this is just a routine check, handed them over. He logged into his devices and unlocked his computers for the agents. The agents left the room with his devices and didn't come back for two hours. Gal must have started to get nervous at some point waiting for them to return. I mean, jeez, two hours is a long time to wait for U.S. Customs to check your devices.

I bet he regretted logging in. I mean, gosh, what is he thinking? Now he's stuck in a country he's not familiar with in a side room with some customs agents. And typically it's hard to argue with these guys or else you might have to go back home. He getting more worried the longer they took the more nervous he got and the agents told him that they were searching his computer for child porn and he knew he didn't have any so he thought he was probably safe and he's probably thinking that the custom agents

wouldn't be able to recognize what dark markets were or tour Tor, or anything like that. And a typical custom agent might not know what those are. But little did he know, these weren't normal customs agents. In the other room, agents logged into Gal's laptop using his passwords and started to look around. They pretty quickly found an application on his desktop called Wallet. Inside was $500,000 worth of Bitcoin. Next, they found the Tor browser and what looked like login details for Dream Market. They were getting pretty excited now. This was looking good. Then they found the private PGP key labeled OxyMonster. A quick check and they confirmed this is the key that matched the key on OxyMonster. A quick check and they confirmed this is the key

that matched the key on OxyMonster's Dream Market account and this proved that Gal Valerius was OxyMonster. And with that, the feds had enough evidence to arrest and convict him. When the agents finally returned to that little room where they were holding Gal in, they arrested him for conspiracy to distribute narcotics, operating a darknet marketplace, and money laundering. He was also given his Miranda rights. When asked about the Bitcoin they found, Gal told them he had taken money out of his bank account and just bought the Bitcoin. After all, it's perfectly legal to hold Bitcoin. And after that, Gal asked for a Hebrew-speaking lawyer. The next day, a search warrant was granted for a full forensic search on Gal's laptop and phone.

The search confirmed the evidence that the agents found at the airport. Gal was in trouble. The World Beard Championships in Austin took place that day, but without Gal. While his competitors were doing whatever it is you do at a beard competition, Gal and his award-winning beard were in police custody and had just been indicted for conspiracy to distribute drugs. Five months after that, in January of 2018, an announcement was made from the U.S. Attorney General Jeff Sessions. J-CODE, I kind of like it. By bringing together the DEA, our Safe Streets Task Forces, our drug trafficking task forces,

health care fraud special agents and other assets, and the FBI, it will more than double its investment in the fight against online drug trafficking. JCODE stands for Joint Criminal Opioid Darknet Enforcement and was going into full effect. This was going to be the FBI's flagship task force to take down dark marketplaces selling opioids and bring prosecutions against the administrators and vendors. While Gall sat in his prison cell awaiting trial, the FBI and Department of Justice were gearing up to investigate and identify more vendors and more markets across the dark net. With more funding, more agents, more investigations, and intelligence analysts, the dark drug marketplaces were firmly in the crosshairs of the feds. Gall was not granted bail

and stayed in custody in the U.S. His lawyers wanted to get rid of the evidence found on his laptop at the airport. That was the stuff that would seal his fate. If they could get that thrown out, Gall would have a fighting chance. In March of 2018, seven months after his arrest, they submitted a motion to have this evidence ruled inadmissible. It said that Gall had voluntarily handed over his device passwords, but he did that before being given his Miranda rights. And it said he did it under false information that the agents were hunting for child porn. And he didn't give them consent to root through his files and folders looking for Bitcoin, dark web connections, and login details. While the legal process for Gao was slow moving, the new FBI JCO team was not hanging about.

On April 3rd, they announced the result of JCO's first mission, and they called it Operation Disarray. Operation Disarray's goal was to coordinate takedown of multiple dark market vendors who were in the U.S. the team had made a total of eight arrests, conducted 160 interviews, seized numerous weapons, computer equipment, counterfeit currency, and drugs all related to darknet markets and vendors. If you go to the FBI's website and look for Operation Disarray, you'll see this video of them making arrests. So this week around the country, we're executing Operation Disarray. The FBI headquarters has sent out information and is working in coordination with field offices all over the country. We're working with all our federal partners who are involved as well to go out and both encounter customers of dark web marketplaces, dark web narcotics traffickers, as well as sort of get the word out on the dangers of potentially what they're purchasing.

You'll see from the picture at the back of the Ops plan, it is on the corner. So there's two doors. So this morning we've come out to do, execute two federal search warrants and arrest warrant on an individual that's a dark web narcotics trafficker. In particular, this trafficker is specializing in the opioid derivative of fentanyl. And we meet up here to do a pre-op briefing, talk up everybody's last minute changes, what their assigned duties are, make sure they're all on the same page to make sure it all goes smoothly and it's done safely. FBI, show your hands!

Right there. Come out. Come out! So we had successfully executed the search warrant and the search system cells resulted in the seizure of both narcotics, a firearm, and numerous digital devices which may have been used to set up and facilitate this activity online. The individual was transported, of course, to the U.S. Marshals and to the federal courthouse

to appear before a judge. The end goal is to, of course, remind the end the end user the end purchaser both of the dangers of the dark web marketplace and the fact that law enforcement is very cognizant of this activity and we're going to be continuing to stay on top of it j code law enforcement's newest operation against the dark markets was in full swing for gal his situation just got worse on april 24th another charge was added to his indictment, conspiracy to commit money laundering. So now he had more charges. Gao was looking at a potential life sentence behind bars if he was found guilty.

His wife desperately pleaded for him to be shown mercy, but the feds weren't budging. Along with Oxycontin and Ritalin, they believed Gao Valerius as OxyMonster was involved in the sale of methamphetamine, fentanyl, heroin, cocaine, and LSD through his involved in the sale of methamphetamine fentanyl heroin cocaine and lsd through his roles in the dream market on may 10 2018 the prosecution dropped their final playing card against gal a motion to have his past criminal history included in his trial at this point it all became clear gal was not new to the darknet or selling drugs using Bitcoin. He was a pretty

seasoned player. They found connections of him being on Silk Road, Silk Road 2, Alpha Bay, Hansa, and a long list of other dark markets under the username Gehinim, which means hell in Hebrew. They also said Gal had been a member of an online criminal forum since October 2016, but I couldn't find any details about that. Now, remember Hansa Market, right? Gal was a vendor there too. Now, the details are not clear here because it seems it was a different username, but OxyMonster was an active seller on Hansa.

In fact, there were even chat logs where he was talking to the Dutch police through Hansa's site. I don't know how the DEA made the connection that he was the same person, but they did. Perhaps because of a matching email address or bitcoin wallet or something. I'm not sure, but it seems like the Dutch police had quite a lot of information about him when they took down Hansa. And all this adding up was a huge hit to Gal. And just after that, his motion to have his laptop evidence thrown out was rejected. If Gal went to trial now, he'd be facing some very strong cases against him at this point. The evidence of illegal darknet activities was mountainous and dating back years.

I guess he realized the game was up. So Gal changed his plea to guilty. A month later, on June 12th, he accepted a plea deal. He agreed to plea guilty to both of the charges against him in relation to selling and distributing Oxycontin and Ritalin. He would also forfeit all of the Bitcoin proceeds he had amassed through his darknet activities. At the time this was agreed on in October 2018, this would have been over $700,000 worth of Bitcoin and Bitcoin Cash. As Gal waited to be sentenced, the feds had to do something with all the Bitcoin that they seized from him. See, the problem with Bitcoin is, well, it's virtual. It's not widely accepted and really isn't that much use to the Justice Department at all. And this first

came up after the arrest of Ross Ulbrecht of Silk Road. The amount of Bitcoin they seized from Ross was colossal, like 170,000 Bitcoin. Under forfeiture of assets, the Feds are used to getting houses or cars or boats or jewelry, physical things that they can sell for cash. But Bitcoin is entirely a different thing. It was decided that Bitcoin would be treated as an asset rather than money. So it would be handed over to the U.S. Marshals, who have responsibility for disposing of the seized assets of criminals. So the U.S. Marshals decided to auction the Bitcoin off. Yeah, to turn it into cash.

They'd sell it off to the highest bidder. To do this, they have to be real careful they're not selling Yeah, to turn it into cash. They'd sell it off to the highest bidder. And to do this, they have to be real careful they're not selling criminally obtained Bitcoin back to criminals. So a $200,000 deposit is required and registration into the auction is required. Government issued IDs and documents must be presented before you can bid in the auction. This worked and four auctions later, between June 2014 and November 2015, the U.S. Marshals had made $66 million from the Silk Road Bitcoin. But then where does the money go? Well, it seems if victims of crimes were involved, then some of the money goes back to compensate them. And the law enforcement agencies who worked on the case can apply to get some of

the money back into their agency. So sometimes they get some, but the rest goes straight to the Department of Justice, where then they apparently hand out bits to different law enforcement agencies wherever they see fit. In other words, we don't really know where the money goes. And so far, they haven't done anything with Gal's $700,000 in Bitcoin. Will they auction it off? Probably. But the government isn't too keen on telling people how much Bitcoin they own. And there can be huge gaps between seizing Bitcoin like they did from Gal and actually putting it to auction. Which is weird to me, but also makes it very hard to track. We might not ever know when Gal's Bitcoins go up for bid.

Gal, of course, is never going to see his Bitcoins again. On October 9, 2018, in the Southern District of Florida, Gal stood in front of the judge to be sentenced. He gave short answers in Hebrew. And then the judge sentenced Gal Valerius to 20 years in prison. Gal's arrest and conviction took out a big player in the darknet drug markets. It was a win for the feds, who believed they proved that the dark market vendors could be tracked and identified, and that undercover operations could be very effective. But even though Gao was behind bars, Dream Market was still open for business and thriving. By January 2019, the feds were on a roll, though. The FBI's

JCO team, riding on the back of their Operation Disarray success, were on to their next mission. This time, they called it Operation Saboteur. On January 11th, agents across the U.S. and international law enforcement agencies worked together to identify and disrupt the big players selling drugs in the dark markets. Pooling their resources and manpower, they were using everything available to them to make a serious impact. Operation Saboteur was not mucking around. A month later, in mid-February, the Dream Market started to have problems. The platform became intermittently unstable. Vendors couldn't log in. Buyers couldn't access the website. It would work, and then it wouldn't work,

and then it would work again. were posting to dread a dark market forum and they said the dream market was under a ddos attack by hackers demanding 400 000 us dollars but the dream market admin was refusing to pay and trying to find a workaround to stabilize the market and it turned out it wasn't just dream that was getting hit two other leading marketplaces empire and nightmare were also getting DDoS, too. On March 26th, the U.S. Department of Justice publicly announced Operation Saboteur and its results. FBI, search one! During Operation Saboteur, our law enforcement partners spoke with over 100 darknet drug buyers. Approximately 61 darknet drug traffickers were arrested. 51 firearms were seized. Almost 300 kilograms of drugs and over $7 million in cash and cryptocurrency were seized.

Let's put two and two together here for a second. The Feds, the FBI, is doubling down on their fight against the sale of opioids and are actively trying to find vendors and stop them. And at the same time, they just got access to OxyMonster's computer. Now, keep in mind, OxyMonster was an admin to Dream Market. So I'm just assuming here, but it seems like a fair assumption that this means that the FBI was probably now admins of the Dream Market. Because if I was an FBI agent on this task force, I would certainly be posing as Oxymonster, who was the admin, and not show my hand. I would save all the chat logs with other admins and dealers, and I would try to get more information from other admins. And I would certainly look to see if I could find out who owned Dream Market, because

the FBI has a keen interest in taking down this marketplace. So I'm willing to bet they used their unique position here to try to take down Dream Market and the people who run the site. And on that very same day that the FBI announced Operation Saboteur, a notice appeared on the front page of Dream. It told users the market would be shutting down on April 30th. But it would be moving to a partner platform, and it would get a new Onion address. This was unusual.

If the feds got control of Dream, I don't think they would move it to a whole new website with a new URL and everything. Maybe the owners figured out the feds had admin access and were just like, jump and ship, I don't know. But this was a voluntary shutdown of a really successful dark market. It's not unheard of that this happens,

but it's definitely unusual. And what's also strange is the message wasn't signed with the usual PGP key, which was expected from the market's admin. But as soon as that notice went up, the DDoS attacks on Dream appeared to have stopped. Users turned once again to the dark forums to try to get some answers. But there was a new problem. The Reddit dark market forum, which was available on the SurfaceNet, had been banned from the site. A new Reddit They said Dream was rebuilding and would be opening again soon as a new dark market, and it would be better built and more resilient from DDoS attacks. While everyone was waiting for this new Dream market to appear after Operation Saboteur, the feds got another win, this time involving big-time vendors on Dream.

Just nine days after Operation Saboteur was announced, on April 4th, three men were arrested in New Jersey. Chester, Jarrett, and Ronald had been operating two storefronts on the Dream market under the name SinMed. Under a fake company called Nix Level Research and Development, these guys had allegedly bought a powder mixer, pill press, a tablet-making machine. They had a DIY pill-making factory and were selling deadly fentanyl-laced heroin, along with Xanax and methamphetamines. In fact, they were up there as one of the top three dream vendors with the most amount of sales. Taking payments in Bitcoin, they were loading prepaid debit card accounts so they could use the crypto cash at ATMs to withdraw the Bitcoin as cash. The feds believed SinMed laundered $2.3 million in cryptocurrency, selling them through DreamMarket and using the laundering method over a two-year period.

Their use of ATMs is what eventually got them caught. Chester was charged with selling controlled substances and identity theft, and Jarrett and Ronald were faced with conspiracy and money laundering charges. And right at the same time, Dream users began to report that Dream's support staff were scamming vendors. They were locking down people's accounts and asking for vendors' passwords and recently used Bitcoin addresses to verify their identity. And if the vendor sent their password over, the password was then changed and their PGP key removed so the vendor couldn't access their account at all.

With echoes of what the feds did when they took over Hansa, this was not good news for Dream. For two months, nothing happened. Dream planned on switching to a new URL, but just hadn't. Then in July, a new market popped up, and it was an almost exact replica of Dream.

It was called the Samsara Market. Was this the new market that Dream Mods promised? Maybe. I guess it seems so. But it was slow going. Dream users were suspicious, with many fearing that this is just a honeypot set up by the feds to capture more vendors and buyers. But the site looks good, it works good, and began getting some traction. However, in November 2019, it went offline. The site admin said they're experiencing a massive DDoS attack and have gone offline. And it's been down for months now. It's still down during the time of this recording.

I'm not sure if it's coming back or what. Perhaps this is another move executed by feds through J-code since they don't seem to be letting up on the persistent attack on all these sites. Ross Ulbricht, the founder of Silk Road, the first big dark market, he got prisoned for life. Alphabay's founder, Alexander C prisoned for life. AlphaBay's founder, Alexander Cazes, could possibly have the same charges, but he's dead now. OxyMonster was administrator, senior mod, and active vendor on DreamMarket, who's now in prison for 20 years.

His darknet career is over, and Dream has gone down. His Bitcoin fortune has been handed over to the feds and he'll now spend decades behind bars, which makes me wonder if he's going to come out with the most epic beard of all time. Some prisons allow prisoners to grow beards, especially for religious reasons, but others force people to trim it back to a quarter inch in length for security reasons. What got Gal identified and caught was because of a mistake on his part, not using a tumbler for the Bitcoin tip jar, using the same tip address in multiple places and sending his tips to an exchange with his last name as his login. Gal was not new to dark markets.

He had been around the block a long time, yet he still left a trail. It's easy to see the mistakes Gal made now, but it's not so easy to stay safe when you're juggling dozens of accounts, hundreds of thousands of Bitcoin, and doing it for years and years and years. One or two little slip-ups is all it takes. Gal had no idea the feds were on to him and just how much they had traced back to him. The good news of this story is that some fentanyl vendors have been rooted out and stopped. This is a seriously messed up drug that has no business in any drug dealer's hands. I know I've mentioned fentanyl a few times in this episode, but I'm not sure you fully understand the dangers of it. Fentanyl was first prescribed by doctors. Specifically, if you're suffering from some extreme pain due to like

cancer and there's no other opioids that are actually working on you, the doctor might prescribe you a fentanyl patch or a lollipop. But this is a potent drug. The smallest pinch of fentanyl is lethal. To give you a better idea, a typical single pill of ibuprofen is 200 milligrams. A lethal dose of fentanyl is one milligram. So that one tablet is 200 times the lethal dose if it was fentanyl. And yes, people are dying from overdosing on prescription opioid-based drugs. And if they can't find those, they'll find heroin and possibly overdose on that. But fentanyl is in a whole

nother league because it's so potent. It's so easy to die from, which is why fentanyl has killed over 95,000 people in the last five years, which is about 60% of all opioid deaths. I mean, just listen to what happened in this small town in West Virginia. Huntington, once a thriving industrial hub, had been crippled by years of job loss, rising crime, and 1,600 overdoses the previous year. The calls started coming in at 321 on a warm August afternoon. In just four hours, 26 people had overdosed on a batch of fentanyl-laced heroin. Why is fentanyl all of a sudden the leading cause of opioid deaths? One big reason is because it's synthetically made. Anyone can just order a bunch of it from China and get it shipped to you. And from there, you can try your hand at making

heroin-laced fentanyl for much, much cheaper, which results in a lot of money for drug dealers. But can I switch gears here and just rant for a second? Yeah. People are making huge bank off the sale of fentanyl. And I'm mad about it. Because they're doing it recklessly. The U.S. government has tried to make policies to make sure doctors only prescribe fentanyl to patients who really need it. To patients who have pain so severe that no other opioids work anymore. But the group that controls this regulation is McKesson, one of the largest drug distributors. And they didn't control the distribution of fentanyl very well. They made it easy for doctors to prescribe. And this mismanaged program resulted in major fentanyl manufacturers like Johnson & Johnson and Cefalon to go nuts, encouraging doctors to prescribe fentanyl. These companies made hundreds of millions of dollars from that single drug, which resulted in many deaths and addictions and deaths from addictions. And things got so bad that both Cephalon and Johnson & Johnson

were investigated by the U.S. government and fined massive amounts. Johnson & Johnson faced a multi-billion dollar lawsuit for misrepresenting the dangers of opioids to doctors. Encephalon was hit with a $250 million lawsuit for trying to turn fentanyl into a routine pain management drug. These are the legal fentanyl makers and pushers, making huge amounts of money from these drugs in reckless ways and illegal ways. But in my opinion, the worst of these drug makers was Insys. Listen to this clip from NBC News that explains the trouble they got into. Five top drug company executives have been found guilty in a bribery case involving the opioid fentanyl. The multi-billionaire founder

of Insys Therapeutics and four other top execs convicted of racketeering. Prosecutors say their scheme involved bribes, kickbacks, even lap dances for physicians who prescribed large amounts of the company's fentanyl spray to patients who did not need it. You see this? This is bad. The legal drug dealers have gotten scores of people addicted to fentanyl who had no business taking fentanyl. Sarah Fuller didn't have cancer. She was plagued with chronic neck

and back pain from two car accidents. But her doctor, Vivian Madelon, actually brought an incest sales rep to an appointment. 14 months after she started taking subsys, Sarah was found dead on her bedroom floor. What killed your daughter? Well, technically, fentanyl. But a drug company who couldn't care less about a human life. A court case against Incis went on for a while and ultimately resulted in a fine of $225 million, which actually bankrupted Incis. But with the company fined, prosecutors then went after top executives. John Kapoor, being the CEO and founder of incest, was the main target. He was found guilty for getting doctors to over-prescribe fentanyl to patients who had no business taking it,

all so incest and John Kapoor could make more money. One of the pieces of evidence that came up in John Kapoor's court case was this music video. And I'll just let you listen to the first verse. choice a bean cereal back again 2015 let me begin it's just therapeutics that is our name we're raising the bar and we're changing the game to be great it takes a decision to be better than the competition's vip service like they never seen going deeper than dan in a submarine build relationships that are healthy got more docs than janelle's got selfies all we built here can't be debated shout out to kapoor for what you've created while the competition just

making noise we're making history because we're great by choice vip service like you've never seen shout out to kapoor i got new patients and i got a lot of them. And it goes on to say how well they treat their reps. And they even have a wrapping fentanyl spray bottle. Who goes on to say that other fentanyl drugs are like prescribing xylitol, which is just a sweetener. Strangely enough, the guy inside the fentanyl spray bottle in the music video was an executive at Insys also. And he got in trouble for this too and was found guilty. So, John Kapoor was found guilty for racketeering.

And just last week in January 2020, we heard what his sentencing was. The highest ranking drug company executive convicted in the opioid crisis is headed to prison. But the sentence is not harsh enough for some who say he got away with murder. A judge sentenced Insys Therapeutics founder John Kapoor to five and a half years for his role in bribing doctors to prescribe the powerful painkiller subsys. OxyMonster is serving 20 years in prison for selling opioids on the dream market. Kyle Enos is serving eight years for selling fentanyl to 168 people, four of which died from his drugs. Billionaire John Kapoor, founder of Incest, who was found guilty for influencing doctors to over-prescribe fentanyl to patients who didn't need it. Oh, and the court records show the FDA estimates that 8,000 people died

from taking the fentanyl spray that Incest produced. That guy got five and a half years in prison. Wouldn't it be weird if OxyMonster and John Kapoor ended up as cellmates? It's just interesting to see these two drug dealers, both guilty for unethically selling the same drug, but they're both locked up for two totally different reasons. Oh, and I should add here that it's been a week since John Kapoor has been sentenced to five and a half years in prison. And guess what? He hasn't gone to prison yet. He's still home because he's trying to get a suspension of the sentence until his appeal is completed, which might be months or a year away. Hmm. But you know

what? John Kapoor is 76 years old right now, so if he serves five and a half years in prison, he's going to get out when he's 82 years old. And what bothers me still is that these huge pharmaceutical companies who manufacture and distribute fentanyl recklessly are some of the biggest makers for naloxone and suboxone, which are the drugs used to treat opioid addiction. These companies are making billions and billions and billions now by selling drugs to treat this opioid crisis that they had a hand in creating. To me, this is the worst part of the opioid epidemic, is that these major drug manufacturers let the genie loose, they recklessly got us addicted,

and are now making big money off the aftermath of it all. You probably know somebody who's died from fentanyl. Prince, Tom Petty, Mac Miller. They all died from an overdose of fentanyl. They didn't know they were taking too much. They weren't trying to die. It wasn't their fault. Fuck fentanyl and everything about it.

Hey, Darknet Diaries is now on the Darknet. What do you think of that? You can visit us there at uka5ybpmh3u54dkv.onion. This show is created by me, the original mini-mind, Jack Recider. This episode was written by the Dark Mouse, Fiona Guy. Audio editing by the font-conscious, Damien. Sound design by the Mary, Andrew Merriweather. Theme music is by the bubbling Breakmaster Cylinder. And even though I get downvoted every time I say it, this is Darknet Diaries. Thank you.