The Hunt for the Dark Web’s Biggest Kingpin, Part 4: Face to Face

The Royal Thai Police arrived at the Courtyard Marriott in June of last year. A veteran Drug Enforcement Administration agent had been assigned to bring the delegation on a flight from Thailand to California to coordinate with the US team in order to iron out any intercontinental differences between the two countries.

There were more than two dozen people in the room when the Thai cops met the American agents, analysts, and prosecutors. The two countries presented their presentations. FBI analysts from Washington, DC, walked the Thais through a presentation about tracking Cazes' hidden cash flows. The Thais had learned a lot from following Cazes. If all went well, the police laid hands on Cazes, explaining the particulars of the Thai legal system.

The Thai group was taken on field trips between meetings, including a golfing range, a shopping mall, and an outing to San Francisco. The Thais were so tired from their sightseeing that they slept on the Golden Gate Bridge in both directions. On another day, the FBI gave the Thais a tour of the explosives lab, showing off the agency's bomb-defusing robot. The prosecutor, Paul Hemesath, brought out his virtual reality headset, and the two countries' agents swung virtual swords at zombies.

The agents were grappling with the practicalities of raiding a dark-web kingpin when they weren't busy with tourism and team-building exercises The FBI agent presented the problem of Cazes' laptop encryption. According to the Thais, Cazes almost never opened his machine outside of his house. They would have to catch him in his house, log in to AlphaBay, and then off guard so that he wouldn't shut his laptop before his arrest.

The computer was more important than the phone. The FBI told the Thais they needed to grab it unlocked. It's possible that that phone holds keys to Cazes' wallet. There is no answer to the question of how to thread the needle of capturing these two devices.

The lead FBI agent was asked if it would be helpful to know more about how Cazes worked. Cazes livedblogged his daily life and sexual escapades under the handle Rawmeo on Roosh V, an online forum for "Alpha males". She was invited to proceed by the FBI agent.

He walked the group through Cazes daily schedule, which included waking up at dawn and checking his email and social media. You can work at home until the morning. He should have sex with his spouse. Take care of business until the evening and only have a short break in the afternoon. He quit his job at seven and went out for dinner and a cruise in his car. He would return home and sleep by 11.

She said she could see on the forum when Cazes was online. The green light next to Rawmeo wasn't just a reminder that they were watching Cazes' thoughts. It could be an indication of when his laptop was open.

Half a dozen Dutch police officers were waiting in a conference room in the small central Netherlands city of Driebergen on the morning of June 20th. The investigators received a call from the German federal police. The administrators of Hansa were arrested in their homes by the Germans. The men were in handcuffs. An unprecedented attempt to take down one market while secretly taking over another could soon begin.

The Dutch National High-Tech Crime Unit had been preparing for a long time. They used the source code for Hansa that they had pulled from the German server to build their own version of the market. To experiment with how the site handled its monetary transactions, they went so far as to create their own play-money version ofBitcoin, with its very own blockchain.

They had to take over and run the live version of Hansa with millions of dollars moving between tens of thousands of users. They had to do it without giving the site's users or staff any idea that the two administrators had been replaced by undercover Dutch police.

The Dutch team immediately called a pair of agents they had sent to the data center where Hansa was hosted. The agents were able to get a backup copy of the data on the hard drive by pulling it out of the machine. The teams in Driebergen and Lithuania began duplicating the entire market on their own computers and then on a server in a Netherlands data center, reconstructing an exact copy of the site that was now under their control.

The Dutch investigators sat at their keyboards for two days, eating pizza and drinking Red Bull. At one point early on, someone spilled a soda on the table, almost soaking the laptop that held the Hansa data, only for one of the investigators to save it. The site went down for several minutes because of a mistake in a single command.

Marinus Boekelo, a Dutch investigator, was working on a bug that caused error messages to cascade across the screen when someone used the search bar at the top of the page. 'Fuck, fuck, fuck!' Boekelo's hands were on either side of his face as he tried to fix his laptop.

He leaned back with a smile. There were no error messages left. There was a bug that had been fixed.

The reconstructed site ran smoothly after 72 hours. The skeleton crew exploded in joy. The site's migration to a Dutch data center was almost completely invisible to its users.

There had been complete radio silence from the Hansa administrators for almost three days. The site's staff looked to the admins for orders and to resolve disputes between buyers and dealers that they couldn't handle themselves. The admins of Hansa didn't have a password to log in to their chat accounts, despite the fact that the server they seized contained some limited logs of their previous communications.

They asked the real admins for assistance. Two German men agreed to help each other in hopes of getting a lighter sentence. The German police gave the passwords to the Dutch. Day-to-day chatter between the bosses and staff of the black market resumed in Driebergen. The business of the site was picked up without a hitch thanks to the cooperation of the admins and their Tox chat logs. The mistake they made was paying the wrong amount for the moderator's salary. All was forgiven after the police paid the staffer the difference.

The admins were offline for three days and the Dutch team came up with a cover story for them. Nobody asked. The cops in admin clothing were spared any questions about their absence due to the fact that no one on staff knew their coworkers beyond a usernames and chat history.

Did there seem to be any inside jokes or watercooler gossip to catch up on? One investigator said that they did not talk about anything personal with each other. It was not a political thing.

There was a cover story about an upgrade. The Dutch police reworked parts of its code in order to be more efficient. The site's customers considered the day-to-day operations of the market to be much improved because they had a team of half a dozen rotating agents acting as the administrators.

An IT help-desk admin was a young Dutch agent. He found his new job to be very similar to his previous one. A collection of answers the administrators had helpfully prepared in an online control panel helped him resolve disputes over the site's drug deals. The sight-impaired drug dealer was helped by the undercover agent to figure out how to integrate his screen reader with his browser.

The team couldn't help but be proud of their work. The head of the Dutch National High-Tech Crime Unit said that the quality had gone up. Everyone was very happy with the service they received.

For their first day as Hansa's bosses, the team cautiously watched the site's internal clockwork, barely believing that they'd gotten away with their takeover. They settled in after it became clear that they could control Hansa indefinitely.

They put up a 65-inch screen on one wall to measure how long they'd been in control of the market. They began to spring the trap.

Hansa had been designed to learn as little as possible about its users in order to facilitate drug transactions. The site didn't have to worry about protecting a collection of sensitive login credentials because the passwords were stored incipherable strings. The mailing addresses buyers would share with sellers when they made an order were included in Hansa's offer. It was thought that the site would never have full access to its users accounts or know the location of their homes because of this.

Police sabotaged those safeguards. All of Hansa's usernames and passwords were recorded. The full text of every message that was sent on the site was secretly archives. The business of the entire market was turned into a glass aquarium after they collected hundreds, then thousands, of addresses from buyers.

Dutch law requires the police to record and attempt to intercept every drug order made on the market while they control it. The half-dozen undercover agents in their small conference room were soon joined by dozens of other people who were tasked with manually cataloging every single purchase. Dutch police were able to seize the packages of heroin, cocaine, and meth shipped through domestic mail. Europol was charged with distributing the ever-growing pile of drug deal data to their respective nations.

The Dutch police had accomplished something law enforcement had never done before: hunting, capturing, and vivisecting a dark web drug market in real time. The operation was just beginning. The Dutch had more than one big game in their sights.

Two days after the Hansa takeover and less than two weeks before AlphaBay was to be taken down, the co-chairs of Chainalysis were in the Netherlands. Tigran Gambaryan was a criminal investigations agent for the IRS. The Europol conference was held halfway across the small country from the Driebergen office where the Dutch were pulling Hansa's puppets.

All of the interlocking pieces of Bayonet were falling into place by this time as contractors with no security clearances. The Dutch Hansa was about to be taken over. A group of Americans planned to take a snapshot of AlphaBay's contents while Cazes was on the server. They pulled it offline only after the Thais arrested Cazes, as touching it any sooner might scare him and cause him to flee. Cazes would be extradited to the US quickly. Cazes' mother's home in Quebec was searched by the Royal Canadian Mounted Police, along with other agencies.

Gambaryan was not part of the international investigation. He was a former forensic accountant who had gained a reputation as a highly capable dark-web investigator. Two federal agents assigned to investigate the Silk Road dark-web market were accused of pocketing hundreds of thousands of dollars' worth of the market's bitcoins through theft, extortion, and other crimes.

Gambaryan knew about the AlphaBay case from a friendly IRS agent in California, where he often went to visit his parents. He was following the investigation but never assigned to the case.

He took an occasional poke at the dark-web market. Gambaryan had been following AlphaBay's tracks for months, pestering Chainalysis' Jonathan Levin with new ideas about how to circumscribe the edges of the AlphaBay "cluster" He was absolutely relentless.

The two men came up with a new method to examine AlphaBay's use of cryptocurrencies. The prosecutors referred to it as advanced analysis. They wanted to use it to find the server that hosted AlphaBay's wallet. They should be able to locate the server and seize it, as well as gaining key evidence in their case against Cazes and assuring that no one else on AlphaBay's staff would be able to take control after Cazes' arrest.

It shouldn't have been possible to discover that address through the use of the internet. There is a ledger of transactions between the addresses of the digital currency. The strings of numbers that identify individual computers on the internet aren't recorded. The method of Levin and Gambaryan was able to get those identities. Neither has any idea of how this works. They didn't treat any piece of tradecraft with more secrecy.

The team of Operation Bayonet thought they knew the AlphaBay address, which had been leaked in the welcome email for the site, in the Netherlands. Gambaryan thought it would be beneficial to independently verify this piece of evidence. He was eager to try out a new investigative technique that Chainalysis could potentially sell to other customers, and he had been doing his own research into AlphaBay for a long time.

A few blocks from the beach and a fishing harbor that fed into the wind-churned North Sea, Levin sat at a desk in his apartment. They were sharing the apartment with one of them staying in the bedroom and the other in the couch because of Chainalysis' recent multimillion-dollar funding rounds.

They were both up before the conference started. This spare moment allowed him to check the results of his and Gambaryan's experiment.

The AlphaBay address appeared on the screen. Some of the addresses were likely to belong to the site's walletserver. The likeliest of them was in a data center inLithuania.

He remembers his reaction as less of an event than a fleeting glimpse of recognition. He thought to himself that it was strange. According to the digits on his screen, the raid was targeting a server in the wrong country and he didn't know it. The next time he saw Gambaryan, he made a mental note to tell him about theLithuanian Intellectual Property.

The opportunity came that night. After a day spent at the Europol conference, the two sat side by side at dinner with a dozen other agents, analysts, prosecutors, and contractors around a long table at Flavor's. When they ordered drinks, they were told that their idea had worked. He pointed out the most likely address to Gambaryan on his phone.

The agent didn't say anything. He used his phone to take a picture of the screen. He stood up and walked out of the restaurant.

He was dumbfounded by the way he went. Gambaryan didn't pay for his beer.

He and most of the other international agents at the conference were staying at the Marriott next to Europol headquarters. He was able to see the forest of Park Sorghvliet from the top floor of the building. At a table in an empty conference room, he opened his laptop and confirmed that the address he had found was in a data center in a country calledLithuania.

Hemesath and Rabenn were on the phone with Gambaryan in the hotel conference room. The two men were pulled into the meeting on a need-to-know basis. The group had intended to seize AlphaBay's infrastructure from the Netherlands, but they had to find a new location by July 5th. A hotel worker tried to tell the group that the room was closed. Gambaryan, who technically wasn't even part of the AlphaBay operation, flashed his badges at the man and he retreated, leaving them to their work.

Rabenn was in a state of blank panic when he realized their plan had failed. "This thing is over"

Gambaryan and Chainalysis did an advanced analysis trick that saved Bayonet at the last moment. The investigators found out that the data center that held the older server for the site was not the one they were looking for. AlphaBay had moved from a Dutch provider to the Baltics. The investigators wouldn't have been able to raid AlphaBay's actual criminal headquarters if it weren't for the Lithuanian internet address.

In the years that followed, the investigators in Bayonet never explained the mechanics of that advanced-analysis technique publicly. The anonymity of the technique allowed it to be used in a number of major cases. The method was exposed to dark-web administrators who might be able to fix the vulnerabilities it exploited.

It would be difficult for anyone who followed the early days of Chainalysis to not guess how the tool worked. In 2015, just months after it was founded, the startup caused a very public blowup in the community with a technique that could identify users. The company set up a secret collection of computers that are used in the communication of the network. Chainalysis' nodes were designed to silently record the addresses of the users who broadcasted their transactions. Chainalysis wanted to create a global map of Bitcoin users' physical locations by stealth.

The young startup wanted to demonstrate its capabilities. Chainalysis was excoriated as a purveyor of mass-surveillance tools when it was discovered, as a result of a long thread on the forum. The company's CEO apologized and closed the experiment.

It's possible that the technique could have been adapted to target specific users of the currency. The transactions were sent from a computer.

The only thing that mattered was that the IRS's Gambaryan and Chainalysis' Levin had corrected the course of a massive, coordinated, international investigation at a critical moment. Secret weapons are not always hidden forever.

The Americans came to Thailand in the last days of June.

Nearly 20 agents, analysts, computer forensic experts, and prosecutors from the FBI, IRS, Department of Justice, Department of Homeland Security, and Canada's Royal Canadian Mounted Police made up the group. More than a dozen members of the group checked in at the Athenee, a five-star hotel a few blocks from the US embassy, which advertised that it was built on grounds once owned by a 19th century Siamese princess. Grant Rabenn noted that it was the prettiest hotel he had ever booked on the per diem.

With just days to go before their planned bust, Rabenn, Hemesath, and the DC prosecutor LouisaMarion were swamped by the bureaucracy of coordinating law enforcement agencies in five countries. The team gathered in a conference room on the eighth floor of the NsB headquarters to discuss the details of Cazes' arrest.

How to lure Cazes out of his house with his phone unlocked and his laptop open remained a mystery. Is it possible to set fire to a dumpster? They decided that it was too risky. Is a woman screaming and crying outside his house? Cazes could either ignore her or close the laptop.

Cazes would be asked to sign for a package if they dressed an undercover agent as a postal worker. They thought that it might work.

A core group of people still managed to cap off each day at the Athenee's lounge for its all-you-can- eat sushi happy hours. The group chat that the Thai police had set up on the messaging app Line was unexpected during one of the evening gatherings. The Thais used the group chat to keep in touch with each other and with the Drug Enforcement Administration. The Thai team assigned to Operation Bayonet had been following their target on an early evening outing and had tracked him in his car as he made his way to central Bangkok. A photo of a Thai officer taking a picture popped up on Jen's computer screen after she returned home. There was a car at the entrance of the hotel.

She had a sudden rush of excitement. The Athenee was where a lot of the US team stayed.

Rabenn was in the Athenee lounge when he saw the same car out of the corner of his eye. He pointed it out to Hemesath and the other people at the table in the lobby. The FBI agent should check it out.

A person walked through the front door of the Athenee as the agent walked across the lounge. Rabenn felt a sharp pain in his mind.

He was the one who said it was him. Cazes is the son of Alexander Cazes. He walked towards Rabenn, Miller, and Hemesath.

Rabenn didn't warm up. He says it was like seeing a ghost. He looked over at Hemesath, who was completely immobile.

Rabenn still remembers the first time he saw Cazes, nine months later. Rabenn remembers that Cazes was dressed in a blue suit with a white shirt that was unbuttoned. Cazes looked more like a pudgy programmer pretending to be a rock star than an actual rock star, according to Rabenn.

The FBI agent walked past Cazes to the door. Rabenn thought about how Cazes knew who they were as he walked across the room. They were on his trail, right? Which hotel was they at in Thailand? There had been a leak. They had been blowing their opsec too much. Did the criminal mastermind outsmart them?

Rabenn expected Cazes to sit next to them at their table, smirk and say, "Fuck you guys, I know you're here, and you're not going to get anything."

Rabenn didn't know how he'd respond. Cazes could be arrested on the spot, but they wouldn't be able to get access to his laptop or any evidence of his control of AlphaBay. It looked like their plan had failed as they were on the verge of victory.

Rabenn was in a state of panic. "This thing is over"

Cazes sat at the table next to them next to a pair of Israeli businessmen wearing suits and yarmulkes.

The Americans were confused by each other. The FBI agent came back and sat down. He and Miller quietly told the rest of the table to leave.

Rabenn allowed the thought to cross his mind that maybe all was not lost and that this was the most stunning coincidence of his life.

The FBI agent and Miller hung back to eavesdrop on Cazes as the prosecutors walked up the curved staircase to the hotel's second floor. Rabenn and Hemesath looked at each other with relief. Cazes was talking with the Israelis about one of his real estate investment deals in the Caribbean when the text messages came in from the FBI and the Drug Enforcement Agency.

They saw that a group of Thai undercover police, including the team leader, Colonel Pisal Erb-Arb, in plain clothes, had positioned themselves around another table across the hotel lounge from Cazes and were taking photos of each of them. The founder of AlphaBay didn't give a clue as to who they were.

The FBI agent pulled out his phone as Rabenn and Hemesath quietly celebrated. He was searching for the odds of what had just happened. The number of hotels in Thailand was not known. He showed them the number of people.

The two prosecutors were in a daze and thought of their near-collision. They knew their team would be facing Cazes face-to-face again in the most elaborate arrest they had ever attempted.

Next week, the day of the take down arrives. Bayonet comes to a close. The case ends in tragedy.

Doubleday has an excerpt from the book "Tronts in the Dark: The Global Hunt for the Crime Lords of Cryptocurrencies".

We might earn a commission if you buy something using links. Our journalism is supported by this. You can learn more.

The chapter illustrations are by Reymundo Perez III.

The photo was obtained from the same source as the one pictured.

There is an article in the December/January issue. Don't forget to subscribe now.

We want to know what you think about this article. Send a letter to the editor towired.com