The Hunt for the King of the Dark Web

On the morning of July 5th, 2017, a man sits in front of his laptop in his villa in Bangkok. Online, he is known only by the pseudonym "Alpha02." He is a multi-millionaire, living a luxurious life and driving expensive cars. He feels secure in Thailand.

Suddenly, he hears a loud crash in front of his house. A woman has driven her Toyota Camry into his front gate. He leaves everything behind and rushes out to the scene of the accident. This is a mistake with serious consequences. The driver is an agent of the Royal Thai Police force. FBI and DEA investigators have been waiting for this moment for months. Authorities from seven countries have worked tirelessly towards this day. Will the hunt for the king of the dark web finally come to an end?

The Wired journalist Andy Greenberg has published a series on the hunt for the Darknet kingpin. Additionally, there's an excellent Darknet Diaries episode on Operation Bayonet, which is covered in Chapter 3 of this video. You can find both links in the description.

It's the early 2010s. The dark web is gaining momentum. The promises of anonymity and privacy are attracting more and more people. With Bitcoin, there is a new form of payment that isn't controlled by authorities. It has become easier than ever for criminals to sell their products online at a massive scale. With the advent of the dark web, the gigantic global game of cat and mouse began and continues to this day.

The Silk Road is perhaps the most legendary dark web marketplace to date. The platform went live in February 2011 and quickly became popular. More than 100,000 customers bought drugs there, but just 2.5 years later, the operator of the site was caught and the Silk Road was shut down. The authorities wanted to set an example in the fight against drugs. The Silk Road founder received a life sentence. However, the business was too lucrative to deter other operators. After the closure of the Silk Road, the number of darknet markets exploded. They all vied for the top spot. Silk Road 2.0 was launched just 35 days after its predecessor was closed. The site lasted less than a year. Evolution was another popular marketplace comparable in size to the two Silk Roads. To buy things on Evolution, users had to deposit Bitcoin into an account on the platform, a kind of dark web escrow account. Once the items arrived, the sellers were paid. The platform operators always held a significant amount of money. At some point, these operators decided to steal the money in a so-called exit scam. Agora was also named a worthy successor to the original Silk Road. But the founders voluntarily took the site offline in August 2015, fearing things were getting too dangerous. Exit scams, arrests, voluntary withdrawals, and hacks—all these factors benefited a new emerging dark web market: AlphaBay.

In July 2014, a man using the pseudonym "Alpha02" began developing AlphaBay. Just five months later, the platform went live. Initially, only stolen credit card data was offered and sold, but AlphaBay quickly began offering more lucrative products. In addition to data and logins, there were drugs, weapons, and malware. Services such as money laundering were also available. Few things were forbidden, but items or data related to child abuse, hit-and-runs, and stolen bank account information from Russia were strictly prohibited. Alpha02 probably wanted to avoid trouble with Russian law enforcement or perhaps wanted to mislead investigators by pretending to be Russian. The website itself worked similarly to Amazon. It was user-friendly, with search functions, filters, and categories. Users could pay with Bitcoin, Monero, or Ethereum to ensure anonymity. AlphaBay even offered a tumbler to blur purchases by bundling multiple transactions from different people. The platform worked well and dominated the dark web. While other marketplaces came and went, AlphaBay remained strong. The number of users grew rapidly. Barely a year after its founding, the site had more than 200,000 registered users and 40,000 sellers. By 2017, AlphaBay had over 300,000 items listed and over half a million dollars in sales every day. Alpha02 was making money from every single transaction, receiving a share between 2% to 4%. He became a multimillionaire. An entire team was working on AlphaBay. Alpha02 had a representative named "DeSnake," several moderators handling disputes between buyers and sellers, and a PR manager. With the site's explosive success, the founder decided to retire from day-to-day operations. He renamed himself "Admin." From then on, communication only went through “DeSnake.” As Alpha02 retreated, American investigators paid more attention to uncovering his true identity. Who was the powerful mastermind behind the platform ruling the dark side of the internet? A global hunt lasting several years began.

You don't have to surf the dark web to find malware. The regular internet is full of malicious ads and pop-ups. This brings us to NordVPN. NordVPN has many features, such as built-in threat protection that can detect and block malicious ads and pop-ups on websites. With a VPN, you can also change your location virtually, which is super easy. You select a country, click on it, and you’re surfing from there. VPNs can also help you bypass many geoblocks. Streaming services have different catalogs in different countries. With NordVPN, you can access all of those catalogs. This also works with news portals like the New York Daily, which can't be accessed from most of Europe. Just select a server in the US, and you can read their articles. At nordvpn.com/ferntv, you can get an additional 4 months on a two-year plan and there's also a 30-day money-back guarantee. By doing so, you also support our channel, so thank you.

American investigators wanted to locate AlphaBay's servers. With access to the servers, they could shut down the platform or infiltrate it to locate the operators. IP addresses can provide information about the locations of users and servers, but in closed networks like TOR, website requests are routed through multiple random servers worldwide, making it difficult to trace them back. Because of this, the American investigators had to try a different approach. They started browsing the platform and buying drugs anonymously, hoping for any mistakes by the sellers. Perhaps the product’s packaging or postage stamps could provide clues to the identity of the respective drug dealer, allowing them to arrest him. But these were just small fish. Dealers come and go. Investigators wanted Alpha02. However, the mastermind behind AlphaBay seemed to take every precaution and knew every rule of the game. Investigators became desperate until December 2016. Robert Miller, working for the DEA in Fresno, California, received an anonymous email. It seemed like Alpha02 had made a fatal mistake in the early days of AlphaBay. Every user who registered on the website at that time received a welcome email. The sender's email address was visible in the metadata of this email. Although the error was immediately corrected, the anonymous tipster saved one of those first welcome emails. Perhaps the tipster was one of Alpha02's first customers or an operator of a competing site. Regardless, he silently watched AlphaBay grow on the dark web, only to then hand the email address over to the DEA. The email address was [email protected]. This email was the breakthrough for Millar and his colleagues. Via the email address, the investigators found photos from 2008 and 2009 of an "Alex" on Skyrock.com, a French-language social media platform. He also linked an old dating profile, listing Trois-Rivières as his hometown in southern Quebec, Canada. According to the profile, he was 17 years old at the time. So the 91 in his email address could be the year he was born. He would have been 23 years old when AlphaBay was founded. The username "Alpha02" also appeared on a French-language technology forum. In 2008, he explained how to remove a virus from an image. His email address and full name, Alexandre Cazes, were at the bottom of the post. The investigators had his name, but where was he? They found Caze's PayPal account, which provided his private email address. Through his LinkedIn profile, they discovered he worked as a freelance software designer and ran his own tech company called EBX Technologies. On Facebook, the investigators found the profile of his fiancée, a Thai woman, indicating the Canadian lived in Thailand. The clues led investigators to Bangkok.

With the help of Thai authorities, the investigative team identified three properties owned by Cazes in the city. One house was in a gated community where Alpha02 lived with his wife. There was a second house and a $3 million mansion in the outskirts of Bangkok. He also had a holiday home in Phuket and was buying another villa in Cyprus. Investigators began tailing him. Cazes enjoyed driving around Bangkok in his Lamborghini. Agents watched him, followed his routes, and tracked his iPhone. While Cazes lived in a beautiful house with his wife, he invited his many affairs to one of his other houses in Bangkok, dubbed the "Bachelor Pad" by investigators. Cazes was an active member of a pickup artist forum, where men shared advice on how to be successful with women. Under the name Rawmeo, Cazes published conservative family values and maintained a quasi-sexist live blog about his "successful" sex life. Other than that, his everyday life was quite normal and unspectacular for the King of the dark web. He got up early, checked his social media accounts, worked, and was home a lot. Occasionally, he attended language courses or dined out with his wife. Around these routines, the authorities meticulously planned his arrest.

In June 2017, a few weeks before the operation, a few American agents arrived in Bangkok to organize the operation with the local police. Among them was Robert Millar. The arrest had to be perfectly coordinated. It wasn't enough to simply arrest Cazes. They also needed his devices. If they could arrest him while he was logged in, they could access AlphaBay's servers via his laptop. Alpha02 had already stepped back from day-to-day operations. The American authorities knew that. DeSnake was a potential target, but he could escape. They wanted to shut down the entire platform and arrest the mastermind behind AlphaBay. They were going to take their time.

The date of the operation was set for July 5, 2017. Thai police blocked the area around the gated community in the early morning. The agents watched Cazes' house and waited for the right moment. When Cazes heard the crash, he left his laptop and went out to see what happened. The investigators stormed the house. Cazes' laptop was unlocked, and the DEA quickly gained access to the administration tools of AlphaBay. Simultaneously, other agents searched his "Bachelor Pad." Cazes was arrested without putting up a fight.

The investigators handed the suspect over to the Thai police. He was initially held at the police station and then transferred to Bangkok's Narcotics Suppression Bureau for questioning. He signed the arrest report at around 9:00 pm. Before the end of the day, the Royal Thai Police announced the arrest of a Canadian national linked to AlphaBay. The news spread quickly. But what was even more surprising was the morning of July 12, when Thai police found the body of Alexandre Cazes. The 25-year-old had taken his own life in his cell. This led to numerous conspiracy theories. Did the US authorities put so much pressure on him that he took his own life, or did he fake his death to escape punishment? No matter how Cazes met his end, the investigators had what they wanted. They found incriminating evidence on his devices. They even found the password to his accounts in a text file. Using Cazes' laptop, they accessed AlphaBay's server and took control of the platform. Two days after the arrest, AlphaBay went offline. An unprecedentedly successful dark web market was over.