The Hunt for the Dark Web’s Biggest Kingpin, Part 1: The Shadow

On the morning of July 5, a gray Toyota Camry slowly turned into a quiet neighborhood on the western edge of the city, where the capital's high-rises began to flatten out into highways and canals.

The woman sitting behind the wheel was called Nueng. A slight, 46-year-old agent of the Royal Thai Police with a short haircut wore a white polo shirt and black pants instead of her usual military style uniform. Two people were working undercover in the passenger seat of the car.

Nueng had his heart pounding. For more than two years, law enforcement agents from around the world had been hunting the dark web mastermind known as Alpha02, a shadowy figure who oversaw millions of dollars a day in narcotics sales and had built the largest digital drug and crime bazaar in history, known as AlphaBay. Six countries' agencies collaborated to track Alpha02 to Thailand. The quiet block in Bangkok that was the result of the operation was finally taken to the home of a Canadian. The success of the plot to arrest Cazes was dependent on what Nueng did in the next few moments.

Nueng rolled the car toward a model home and real estate office in order to give the impression that he was an experienced driver. She told the security guard that she had taken a wrong turn and needed to pull aTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkiaTrademarkia He yelled at her to back directly out because the street was too narrow.

Nueng made a high-speed plea to the Holy Trinity of the Buddha, his teachings, and all the monks and nuns in his service. She whispered in Thai that she wanted to be blessed with success. I need your blessings with success. Please bless me with good fortune.

She put the car in reverse, turned the wheel to the left, and then slammed the Toyota's fender into the gate.

Robert Miller sat in the US Drug Enforcement Administration's wiretap room in California's Central Valley, listening in on the life of one of the agency's endless supply of narcotics targets.

Miller wanted to be a member of the police force. In training raids on the mock-ups of drug dens, he always meticulously cleared his corners and covered his blind spots. He had high hopes that being assigned to the agency's field office in Fresno would put him where he wanted to be, making arrests and carrying out search warrants. Miller requested that his name and personal details be changed.

As traffickers from the southern border made their way to buyers in the Northwest and on the East Coast, the city in the middle of California became a corridor for cocaine, heroin, weed, and methamphetamine. The agents spent their days following trucks with drugs and arresting people.

Miller injured his foot and shoulder while rock climbing after moving to a new place. Both injuries needed to be operated on. It would take at least two years for it to recover.

Miller was assigned to watch people. He'd stake out targets from his car or sit in the office's wiretap room and listen to suspects' phone calls and read their texts. The work was dull and boring. He remembers that it was 99% boredom and 1% excitement.

One of Miller's partners suggested they try to work on a new case. She had heard about Silk Road, a site on the dark web where anyone could use anonymity software to buy and sell drugs. When Miller inquired about the site, he was told that teams in New York and Baltimore were already on it. Miller's phone buzzed with an alert that the notorious market had been busted as he was on a stakeout in his car. The Dread Pirate Roberts was a Texan with no criminal record. He was in the science fiction section of the Glen Park Public Library when he was arrested.

Miller's boss came into the wiretap room and asked if Miller wanted to join another team. The person in the office remembered Miller's inquiry. A local assistant US attorney had assembled a group to focus on dark-web crime and he was looking for volunteers from all the federal agencies clustered around Courthouse Park. Miller was aware that the assignment was very different from the team that worked on it. It would be a new thing. He agreed. "I will do it."

Grant Rabenn, the young prosecutor at the helm of the dark-web strike force, laid out a set of modest initial goals for the group. The Southern District of New York does not include us. Rabenn said we are in a dusty town in California. We're going to try to go for a home run.

Miller had no idea how the dark web drug trade worked. Miller couldn't figure out how to buy drugs himself when Rabenn asked him to make undercover heroin buys. He had to drive two and a half hours to San Jose to find a physical ATM for the virtual currency. After transaction fees, he was able to purchase half a gram of heroin instead of the 2 grams he was planning on.

Miller got a feel for the post-Silk Road online drug economy as he looked around the dark web. It was dominated by one entity, AlphaBay.

AlphaBay was one of a number of markets vying for a share of the growing dark web criminal trade. Alpha02 seemed to be cannier than those behind many of the competing markets. Alpha02 was a well-known hacker who focused on credit card theft and fraud. He became a major player on the dark-web site where hackers traded in stolen data. The University of Carding Guide was designed to teach beginners the tricks of the trade, like how to social engineer customer service representatives at banks, by calling from spoofed telephone numbers.

AlphaBay appeared to serve the same hacker clientele in its first months online. Most of the time it was devoted to cybercriminal wares, such as stolen account logins. The dark web's more lucrative narcotics, such as ecstasy, marijuana, meth, cocaine, and heroin, are all shipped through the mail. Alpha02's grand vision was to unite two spheres of the dark web, one devoted to cybercrime and the other to drugs, to create a single mega- market. He said that AlphaBay's goal was to become the largest eBay-style Underworld marketplace.

Silk Road's Dread Pirate Roberts had advocated a kind of anarcho-capitalist ideal, describing his site as a "movement" or a "revolution" bent on freeing mankind from oppressive government control of commerce and limiting sellers. Alpha02 seemed to be more focused on the bottom line than it was on the top line. Aside from a ban on child abuse materials and murder for hire, AlphaBay's vendors were not allowed to sell data or accounts stolen from Russia or other former Soviet states. A kind of "don't shit where you sleep" principle was used to prevent trouble from Russian law enforcement. For Miller and other federal agents and prosecutors sniffing around the site, it suggested that AlphaBay and its founder were likely based in Russia.

In an interview with the news site and dark-web directory DeepDotWeb, Alpha02 assured his users that he and his site were beyond the reach of any Silk Road-style seizure. He wrote, using the shorthand for "operational security," that he lived in an offshore country where he was safe.

Alpha02 wrote in the style of a corporate press release, "We have created a stable and fast marketplace web application which has been built with security in mind right from the start."

He was able to make up for political inspiration with technological aspiration and coding competency. He boasted about features that included auction-style bidding, search tools that helped fraudsters comb through stolen data to carefully choose their victims, and a multi-signature transaction scheme designed to assure users that it would be far harder for law enforcement or rogue staff to steal funds.

Alpha02 was like that of Osama bin Laden. He and AlphaBay were used frequently at law enforcement conferences.

He told DeepDotWeb that he wanted to have every imaginable feature to be the #1 market. He signed each page of AlphaBay with his name on it.

She told the court that the double life sentence imposed on Ross Ulbricht was meant to scare off future dark-web drug buyers. At the time of AlphaBay's rise, the punishment seemed to have had a different effect. In the days after the news of Ulbricht's sentencing, sales on Agora, the top dark-web site, more than doubled. The author of the study thought that the judge's shocking prison term had only made people more aware of the dark web drug trade. The judge seemed to have created a huge advertisement for the black markets of cryptocurrencies.

Alpha02 didn't pay much attention to the news. He picked up the Dread Pirate Roberts' torch after Ulbricht's sentencing in an interview with Vice. He wrote that courts can stop a man, but not an ideology. The war on drugs won't stop until it ends.

In reply to other questions, AlphaBay's boss spoke more clearly. He wrote that they have to keep going with business. Everyone needs money to eat.

AlphaBay was the largest market on the dark web. Agora's administrators took their site offline in August because they were worried that a vulnerability in the online anonymity system would be used to locate their server. AlphaBay did not appear to have a flaw. As it absorbed Agora's tens of thousands of buyers and vendors, the growing crowd of law enforcement agents around the world could not find any clues as to where they might find its server.

Before AlphaBay took over the dark web's top spot, Alpha02 changed his name to admin and stopped accepting private messages from anyone other than AlphaBay's staff. He left most of the site's communications work to his second-in-command and head of security, a person who goes by the name DeSnake.

The site's credibility was lent by the Alpha02 name. The person behind it wanted to slip into the shadows and rake in his fortune as quietly as possible.

By October 2015, AlphaBay had more than 200,000 users and more than 21,000 listings for drugs, compared to just 12,000 listings on Silk Road. AlphaBay surpassed Agora's peak sales rate of 350,000 a day in the middle of 2016 according to researchers. The biggest black market on the dark web had become the biggest black market of all time. It was growing very fast.

Rabenn compared Alpha02 to Osama bin Laden because he was the most wanted man on the dark web. Rabenn says that AlphaBay and Alpha03 were used at every law enforcement conference. As the target on Alpha02's back grew larger, so did the fear that this mastermind would stay ahead of them indefinitely.

Is this person just a genius who knows how to make mistakes? Rabenn asked himself. Has this individual found the perfect country with the right IT infrastructure to run a marketplace, and he's able to bribe the officials there so we won't bother him?

Rabenn says there was a sense that this could be the special one. You start to wonder if it's the Michael Jordan of the dark web.

Rabenn followed these discussions from afar. The idea of his team taking on Michael Jordan in a game had never crossed his mind. He says that going after a site like that is not expected of people like them.

Grant Rabenn's second job out of law school was at a boutique firm that defended white- collar criminals. A lawyer with dark hair and a Hollywood smile was hired to represent Russian businessmen accused of paying bribes. James Bond characters who are jet-setting around the world with suitcases full of cash are very interesting, as he described them.

Rabenn was taken by the glimpse into a world of billions of dollars. He found that he admired and envied the prosecutors on the other side of the table, as they were able to choose which cases they wanted to pursue. He applied for Justice Department jobs and found one in California.

Rabenn was born and raised in Southern California, but he couldn't place the city on a map. He found a place with almost no hierarchy or bureaucracy when he arrived at the DOJ in 2011. Fraud and extortion, child exploitation, corrupt cops, and, of course, drug trafficking, were all tackled by him and the local agents. Rabenn says that they were just running and shooting.

The stream of suspicious activity reports that banks were required to file under the Bank Secrecy Act started the money-laundering cases. Rabenn found that more and more of the reports were being triggered by financial transfers out of digital currency exchanges. Currency swaps were thought to be cash outs of dirty digital profits. Rabenn immersed himself in dozens of hours of videos on the internet to learn about this new currency and how it was being used.

Criminals were attracted to the dark markets because of the anonymity of the coin. Every transaction was recorded on the public ledger. The ledger only recorded the addresses of the bitcoins at which they were located. In theory, at least, that meant buyers and sellers of illegal goods on opposite sides of the globe could send one another cash payments from behind a mask.

Rabenn realized that cryptocurrencies opened up huge new opportunities for law enforcement, just as they did for criminals. As long as a dark-web drug dealer could be persuaded to send a package to the Eastern District of California, the crime actually occurred in his jurisdiction.

Rabenn didn't have a clue how to break the anonymity of the ledger. He thought that even dark-web dealers could make mistakes that could be caught. The chance was exciting for a young prosecutor. He was not happy with prosecuting drug mules who drove meth up the 99 freeway. He could arrest dealers all over the country if he arranged an undercover buy online. The only thing I have to do is order the drugs from them. We did that.

Rabenn invited investigators from the Homeland Security Investigations and IRS Criminal Investigations offices to join his dark web strike force. He describes them as a small team of odd ducks with agents on the cerebral side and content to work cases mostly on a computer screen.

Rabenn's team achieved some success with their undercover approach when they recruited Robert Miller. They cracked down on a few so-called peer-to-Peer exchangers, individuals who bought and sold bitcoins in the real world and were often used by dark-web dealers to cash out their dirtycryptocurrencies. They mined the exchangers' Rolodexes for leads on dealers who had done business with them, tracked them down, and arrested them.

Rabenn suspected that many of the dealers they targeted were sloppy enough that agents could simply purchase drugs and look for clues in their online profiles.

Miller assembled the usernames of AlphaBay's top dealers of heroin and fentanyl, and he began to buy from them one by one. Miller and the team looked at the shipments and their online presence as they arrived. They found that a vendor had made a mistake by linking his email address with his PGP key, which was used to send and receive messages.

Miller and Rabenn linked the email to the dealer's social media accounts. He was located in New York. Miller found fingerprints on a package of heroin that was sent from one of his accounts. Miller was able to get photos taken by the self-service kiosk. The second New Yorker put a package in the mail. Miller and a team of agents arrested the two men after searching their homes.

Miller was able to find the real name of another dark-web opiate dealer by using a post office kiosk camera, and he was also able to catch him shipping drugs using evidence from a post office kiosk camera. Miller says that when agents raided the man's home in San Francisco, they found a lot of drugs.

Rabenn's team had built significant cases and a reputation. Miller was amused when his San Francisco suspect warned him that a group of feds operating out of the Central Valley seemed to be targeting players on the dark web.

Miller and Rabenn weren't kidding when they said that busting a few AlphaBay's sloppier dealers wasn't likely to topple that black market.

Miller was ready to try a new thing. He'd achieved a couple of decent dark-web busts, but he didn't like the paperwork or the time spent in front of a screen. His shoulder and foot were back to normal. Maybe it wasn't too late to join the team?

After picking up his lunch, Miller went back to the office and found an email from a strange person.

The sender was looking for a law enforcement contact on the dark web. They tried the FBI tip line, but didn't hear back. They tried Homeland Security, but couldn't get it to work. Miller's contact information was found in a criminal indictment of an AlphaBay drug dealer.

The stranger tried to get in touch with Miller. They were going to give a tip about who Alpha03 might be.

On the trail of a mastermind, a tip leads detectives to a suspect in Thailand, and to the daunting task of tracing his millions in cryptocurrencies.

This story is an excerpt from the book, "Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrencies".

We might earn a commission if you buy something using links. Our journalism is supported by this. You can learn more.

The chapter illustrations are by Reymundo Perez III.

The photo was obtained from the same source as the one pictured.

The November 2022, issue contains this article. Don't forget to subscribe now.

We want to know what you think about this article. Send a letter to the editor towired.com