Greenberg shows how criminal investigators brought down dark web drug, carder, and child sexual abuse portals tracing crypto currency transactions. It’s an informative and at times gripping account as we meet dedicated investigators, investigators turned criminal, and the criminal masterminds behind the illicit sites. The book introduced me to a new world of crime and policing that operates internationally as each side uses technology to counter the other in a battle that continually escalates. For readers interested in understanding this quickly expanding area of cybercrime and the critical role cryptocurrencies play this is a very worthwhile read. My notes follow.
Greenberg explains that cryptocurrencies are not completely anonymous. He describes how the blockchain can be used to track transactions and identify users. Greenberg tells how researchers developed methods to identify transactions with common ownership and trace bitcoins through a series of transactions. This alone doesn’t identify the owner. But when combined with other information such as bitcoin keys, IP addresses, account info from subpoenaed exchanges and possible suspects the blockchain tracing methods can identify crypto owners and people running dark web portals.
Greenberg goes on to show us how these techniques have been used to help catch criminals who were using Bitcoin to hide their dealings. He begins with a brief summary of the Silk Road website and its proprietor, Ross Ulbricht, aka the Dread Pirate Roberts aka DPR. DPR ran his dark web drug emporium with impunity operating from his laptop in cafes and libraries in San Francisco. The FBI arrested DPR in 2013 having identified one of the site’s servers but not revealing all their methods. They also used an undercover agent to infiltrate DPR’s team. In a dramatic well planned move the FBI was able to snatch DPR’s laptop while he was using it giving them access to his records. Using tracing and tracking techniques Tigran Gambaryan, an IRS criminal investigator in Fresno was able to show that a DEA agent, Carl Force, had in fact been a double agent. While working the case with the FBI, Force had extorted and stolen bitcoins from DPR worth millions.
Next Greenberg recounts investigations into the hacking of the Mt. Gox exchange which subsequently failed in 2014. It had been an early leader among Bitcoin exchanges. Michael Gronager, eager to launch a startup blockchain track and trace analytics company, offered his services free to the owners of the defunct Mt Gox. Through a friend he met Gambaryan who was still investigating the Silk Road thefts. With Gronager’s help Gambaryan found there was a second double agent who had stolen Bitcoins from Silk Road, Shaun Bridges a Secret Service agent. He had cashed out his 20000 Bitcoins through Mt. Gox. Gronager’s analytical software showed that Mt Gox had been pilfered steadily for two years from an external source probably in Russia. Meanwhile Gambaryan’s analysis showed that Carl Force had cashed out his Bitcoins stolen from Silk Road at the exchange BTC-e in Russia. Then Gronager identified BTc-e as the exchange where Mt Gox’s Bitcoins were cashed out.
In 2015 Gambaryan joined the new National Cyber Investigative Joint Taskforce in Washington. NCIJT would operate with Defense, Secret Service and Homeland Security agents. BTC-e looked very suspicious cashing out Bitcoins from mysterious sources. Gambaryan with Gronager’s help and cyber analytical tools began investigating. In a lucky stroke he found the servers amazingly were not in Russia but just a few miles across the Potomac in Virginia. With more work they identified the transactions cashing out Mt. Gox’s Bitcoins and BTC-e’s owner, Alexander Vinnik as the culprit. Vinnik had stolen the Mt. Gox Bitcoins and set up his own exchange to cash them in. Vinnik was safe in Russia, until he ventured outside years later. Other investigative agencies learning of NCIJT’s success and Gronager’s role began buying his software making them much more efficient. Gronager’s company, Chainalysis took off becoming the standard used by law enforcement.
In 2015 a judge imposed a double life sentence on Silk Road’s Ross Ulbricht thinking this would discourage others. But instead, all the attention alerted people to the availability of drugs on the dark web. A new site, AlphaBay, hosted sellers and users of credit card info and drugs. Its drug business doubled. In Fresno, US Assistant District Attorney Grant Rabenn had been focused on the drug trade and turned his attention to dark web sites forming a dedicated group including IRS and Homeland Security agents. After some small-scale success, a tip came in that would identify AlphaBay’s administrator, Alexander Cazes. Rabenn reached out to the FBI and other groups that might be investigating AlphaBay forming a cross-agency team.
Cazes was a Canadian living in Bangkok working in his home from his laptop. He had accumulated tens of millions of dollars from his carder and drug portal, AlphaBay. Local DEA agents surveilled him. He lived an ostentatious lifestyle sporting around town in his Lamborghini and spending his nights womanizing. A variety of Blockchain analyzing techniques helped pinpoint his transactions and locate his servers. AlphaBay’s servers were in the Netherlands and Lithuania. The investigation became international. The Dutch were also on the heels of Hansa, the second largest online drug emporium. They planned to take it over after arresting the administrators and run it secretly for a while to collect information on sellers and users. They wanted to wait to arrest Cazes until they shut down Hanza and then do the same with AlphaBay which would now also have dealers and customers who had migrated from Hansa. Greenberg does an excellent job describing how all this coordinates and plays out in dramatic fashion.
Next Greenberg discusses Welcome to Video, a dark web portal devoted solely to child sexual abuse. The site did not accept adult porn. When the investigation started in 2017, the site had been active for two years. Unlike AlphaBay and Silk Road, Welcome to Video only did a small share of its business in Bitcoin, but Bitcoin tracing was key to pinpointing the administrator’s identity. Gambaryan, after providing some critical help in the AlphaBay investigation, was deeply involved in this one. His experience, improvements in Chainalysis and Welcome to Video’s weaker defenses allowed his team to hone in on the administrators identity faster. They would find over 250,000 videos on the server. While Greenberg does not describe them graphically, he tells us enough to understand how completely vile and disgusting these videos were. The investigators who had to watch them were totally revolted. The site had over a million members from dozens of countries downloading and uploading child videos. The investigation involved many different agencies and countries. As before the investigators wanted to run the site after arresting the administrator to catch users and providers and again Greenberg does an excellent job giving us the blow by blow.
Greenberg goes on to discuss more cases following Welcome to Video up through 2021. As Bitcoin rose dramatically in value so too did the value of laundered and illegal money. The government would confiscate Bitcoin worth over two billion dollars in a case that found a huge stash of crypto that a hacker had stolen years earlier from Silk Road. It was the largest criminal seizure of any currency ever in the US. While many illicit sites were being taken down it became a game of whack-a-mole. Increasingly administrators, servers and exchanges were in countries like Russia and North Korea where subpoenas were useless, records could not be gotten nor assets seized or administrators arrested. Ransomware greatly increased usually operating from countries where the criminals were protected. In 2020 Chainalysis tracked over $350 million in ransomware payments. BTC-e was a primary exchange used by ransomware gangs to cash in their Bitcoins. These operations were more difficult to trace. Still in the 2021 Colonial Pipeline case that shut down gas delivery in the eastern US, the FBI was able to track and recover most of the ransom paid in Bitcoins. New “privacy coins” have now appeared like Zcash and Monero that were developed to be untraceable eliminating vulnerabilities found in other crypto. However, Gronager at Chainalysis is confident they will find new vulnerabilities in these new currencies and whatever currencies come next in an ongoing cat and mouse game in a new era of cybercrime.