Hansa OPERATED_BY Dutch National High Tech Crime Unit
After the takeover, Hansa was operated and monitored under Dutch government control.
Explicit Confidence 95% · Jack Rhysider EP 24 Details
“the site was highly rated. The site was looking strong and holding steady as the leader but in March 2015 Evolution went offline. [POWER DOWN] This time it wasn’t because of feds. It was because that whoever was running Evolution shut the doors and took everyone’s Bitcoin that was held on the site. This was around $12,000,000. This is equivalent to you giving money to a drug dealer and them not giving you the drugs in return, just taking off. People were furious that the site owner would do something like this and were claiming they lost over $20,000 that was being held on the Evolution servers. When Evolution went down AlphaBay’s numbers soared. [MUSIC] In the next three days AlphaBay saw 18,000 new users and 7,000 new forum posts. It was seeing $300,000 in trading value a day. Once people started using AlphaBay they loved it. The site’s popularity rose quickly. Within a year they had 200,000 registered members. But they weren’t they only dark market around; the biggest dark market at that time was Agora but then Agora announced they would be pausing operations and asked everyone to withdraw their Bitcoin and stop using the site. This again gave AlphaBay another serious bump in new users, more listings, [00:10:00] and more trades. Because of all this, within two years AlphaBay had over 400,000 users and was the biggest dark market in the world. In fact it was the biggest dark market the world has ever seen, having more listings than anyone before that. AlphaBay became the go-to place to buy or sell drugs online. The site’s moderators were friendly and helpful to users who wanted to learn how to use Bitcoin or PGP to encrypt their chats and the user interface was easy to navigate and friendly. The quality of stuff for sale was great. On any day of the week you could buy marijuana, LSD, mushrooms, meth, cocaine, Fentanyl, or heroin. But besides drugs people sold other illegal things; counterfeit driver’s licenses, passports, weapons, stolen credit card numbers, tools used for skimming credit cards, and counterfeit money-making machines. But despite all these options the drugs are what sold the most on this site. To buy on this site you couldn’t use your credit card or PayPal. Only Bitcoin, Monero, and Ethereum were accepted. These are crypto-currencies that are also theoretically anonymous where you don’t know who you’re sending the money to. You simply need a wallet ID to send money to and a key to access your own wallet. AlphaBay would charge 2 - 4% commission for every transaction that went on there. With hundreds of thousands of transactions happening, AlphaBay was making some serious Bitcoin. The site owner was able to hire some staff to keep the place operational and continued to add new features and fix bugs. But a site like this is going to attract a lot of enemies. [MUSIC] Law enforcement agencies around the world have notoriously gone after sites like AlphaBay to try to shut them down so by being the top dark marketplace in the world, it attracts a lot of eyes and ears from many government agencies. Investigations and cases started opening up in the US, Canada, UK, Netherlands, and Germany. They tried looking to see if any clues could be found as to who’s running the site. But everywhere they looked they found nothing. Whoever was administering the site was very good at keeping the server’s location secret and the owner’s identity hidden. All chats were encrypted and the site’s owner used an alias, Alpha02, which wasn’t used anywhere else and they encrypted and anonymized all connections to the servers. For years federal law enforcements couldn’t find any clues which would lead them to shutting down the site. The US has a war on drugs and dedicates a lot of time and money towards stopping drug dealers. They like to go after big operations which will make the most impact on the drug scene and AlphaBay was by far the biggest. Whoever was running AlphaBay knew this was highly illegal and had to hide. They had to be extremely careful because not only would the police be looking for them but other drug dealers would be, too. AlphaBay had many competing drug marketplaces, marketplaces that also had services available like hit men and hackers. It may be entirely possible that an owner from another dark market wanted AlphaBay gone and had all the resources to track them down and put an end to AlphaBay. But besides the dark markets, regular street gangs were sometimes hit economically because of the rise of online drug markets. Some of them were also angry with the popularity of AlphaBay which meant they were having a harder time finding buyers and weren’t able to figure out how to sell their stash online. The admins to AlphaBay had to make sure their identity, location, and the server’s identity were kept very secret from all these enemies. To top it all off, the darknet is where some black hat hackers like to dwell, and they know this is a very lucrative business. A lot of Bitcoins are coming in and out. AlphaBay probably got a fair share of hacking attempts waged against it at all times. There’s always someone digging around the site, looking for anything that may give away any information to figure out who was running it. At one point someone interviewed the administrator for AlphaBay asking if they were afraid of getting caught. Their response, I am not. I am absolutely certain that my OPSEC is secure and I live in an off-shore country where I’m safe. The United States FBI really wanted to catch him though, and put an end to this market so they began digging deeper. [MUSIC] The FBI was having trouble finding any clues at all so they went onto AlphaBay and started buying drugs. An undercover agent with the FBI created a user account and used some Bitcoins to buy marijuana. A few days later they got the weed in the mail, no clues found. Not even information on who was selling it to them, just that it was shipped from California. Then the FBI bought another drug, this time heroin, and again offered no clues as to who was running the site. The FBI continued buying item after item on AlphaBay in hopes to eventually spot something and get more evidence as to what this place was doing. The FBI bought more heroin and Fentanyl and more marijuana and some meth, actually fifty grams of it. Then the FBI went on to purchase other things; they bought four fake driver’s licenses and they bought a credit card skimmer that fits onto an ATM, and more. The FBI was gathering more and more evidence for this case and also working with other law enforcements around the world to share information that they found. Eventually the FBI spotted something. When an undercover agent created a [00:15:00] new account at AlphaBay they received a welcome e-mail and examined it closely. They looked at the headers of the e-mail and there was a Reply To e-mail address that was unusual. The Reply To e-mail in the header was [email protected]. The FBI took this e-mail address and went to Microsoft, the owners of Hotmail, to request information on who owns that address. That e-mail address was found to be associated to a LinkedIn account for a guy named Alexandre Cazès who was born in 1991. This matched the 91 in the e-mail address. His LinkedIn profile explained that he’s from Montreal, Canada and runs a computer tech support company called EBX Technologies. Now that the FBI had a name they began digging deeper into Alexandre Cazès, uncovering everything they possibly could about him. AlphaBay wasn’t the only dark market going around. There were many others but one that was gaining in popularity was called Hansa and it had a great user interface and great admins with great customer support and was actually very popular in Europe. Same thing was being sold on Hansa; guns, IDs, counterfeit devices, and of course drugs. Even though Hansa was much smaller than AlphaBay it too attracted the attention of law enforcement. Countries around the world wanted to stop Hansa from being a trading place for illegal items. All of the Hansa servers were on the anonymized Tor network. This made it impossible to track where it was located in the world but there was one development server that was located on the regular internet. A security researcher found this one Hansa server that wasn’t on Tor. It was just on the regular internet and it turned out to be a development server that the admins could test new features on. They reported this information to the Netherlands National High Tech Crime Unit. This is the department that investigates high profile cyber-crime cases such as this. They took this tip and tracked down the IP and it was in a data center that was actually located in the Netherlands. They contacted the data center that was hosting the server and the Dutch government was able to put a sort of wire-tap on the server to watch all packets that were coming in and out of it. From there they found the server was talking a lot with the live Hansa server which was on Tor. This production server was in the same data center as the development one so from there the Dutch government was able to make hard drive copies of a few of those Hansa servers, both the development and production one. They did this without causing any outage on the site, working directly with the data center. The Dutch High Tech Crimes Unit combed through the contents of those hard drives. The goal was to find who the admins were to the site. They saw the admins were connected to the site but the connections were anonymized through Tor so they weren’t able to determine where these people were from and all the logins for the admins were aliases. Of course the site owners wouldn’t use their real names to log in with, but at some point the authorities found chat logs on the server and as they looked into it they found these logs dated back years and years. Inside the logs were conversations between the admins of the site but the Dutch couldn’t read the conversations; not because it was encrypted but because the conversations were in German. The Dutch authorities had to get a German translator to come help them decipher the chats and read through the logs. A lot of it was talking about the site such as resolving disputes doing maintenance and adding new features but as they read deeper into the chat logs they found the real names of both the admins of the site. Further in the logs they found the home address of one of the admins. The Dutch government had the names and possible location of the two men that were running the Hansa dark market but a new problem was encountered. The home address of the admin was in Germany. When the Dutch government contacted Germany to request their arrest and extradition, the German government explained they are already tracking those two guys. The same two guys who were running the Hansa dark market had previously created an online site to buy and sell pirated e-books and audiobooks. The German police were trying to find the location of these two guys to arrest them. The Dutch and German authorities began hatching a new plan. They joined forces to capture these two guys under the existing German case but the Dutch government would take over Hansa. This way Germany gets their suspects and the Netherlands gets control of Hansa to potentially catch more drug dealers. The plan was to gather enough evidence to arrest the two men at the same time they were logged in as admins to the site so they could take it over. But just as they were collecting more evidence against the two German admins, the Dutch server went offline. The Hansa admin saw a copy was made of the hard drives and it freaked them out so they moved the server to another location. Once again the location of the server became anonymized over Tor and the authorities had no idea where it went and therefore couldn’t take it over. They went back to looking over what they had, trying to figure out where they moved the server to. [MUSIC] Months and months go by without any clues as to where the servers had gone. Hansa continued to operate, becoming the go-to place in Europe to buy and sell drugs online. In the chat logs on those old hard drives were a few Bitcoin addresses and the Dutch authorities were watching these addresses to see if anything was being sent in or out of those wallets. While Bitcoin is in fact anonymous, at some point you may want to exchange your Bitcoin for cash [00:20:00] and you need to do that at a Bitcoin exchange which is usually audited and licensed. The authorities saw one of the Bitcoin addresses sent money to an exchange in an attempt to move some money. This was a lucky break because the exchange they sent the money to was in Netherlands. The Dutch High Tech Crime Unit went down to the exchange to request the digital information on where the money was sent to. The Bitcoin exchange released the information and the Dutch authorities discovered the Bitcoin was sent to a server in Lithuania. With the help of the Lithuanian government they were able to track down the exact location of where the new Hansa server was located. The Dutch, German, and Lithuanian government agencies had everything they needed to arrest the admins and take over Hansa. But at this point the FBI notified the Dutch authorities that they had discovered who was behind AlphaBay and the location of the server. The FBI was informing the Dutch that they’d be conducting a raid on the data center and arresting the owner. But the Dutch government said whoa, hold on. [MUSIC] The authorities for Germany, Dutch, and the FBI collaborated on a plan. Because the Dutch and German authorities were ready to take over Hansa they wanted to get control of Hansa before AlphaBay was to be taken down. The theory was that as soon as AlphaBay went down the users would flock to Hansa to continue to buy and sell illegal items. If the Dutch government was already controlling Hansa they could collect a lot of information of the users of the site and potentially arrest a lot of dealers in the process. The FBI agreed to this plan and decided to call it Operation Bayonet. Bayonet was a play on a few words; Bay comes from AlphaBay, net comes from darknet, or internet, and it would also signify piercing the dark marketplace. Authorities believe that with the takedown of AlphaBay and the government controlling Hansa, after all this was over it would destroy trust in the dark marketplace for a long time, potentially crippling the whole online trade of illegal items. Operation Bayonet was a go. The next steps were for the takeover of Hansa. The Dutch authorities worked with Lithuania and Germany to conduct the raid on the data center and arrest the two men simultaneously. Lithuania agreed to the plan and two Dutch authorities went to the data center to prepare for the takeover. On June 20th, 2017, the plan sprang into action. [MUSIC] The Dutch police raided the data center in Lithuania and the German police, with a very precise and careful method, raided the homes of both of the admins of the Hansa dark market. It’s not clear how this was done but the German police probably watched what the admins were doing and verified they were on their computers and then created a disturbance to get the men away from their computers while it was on. This had to be a very careful operation to successfully take over Hansa but the German police succeeded on both raids. They arrested both admins to the site while their laptops were open and unlocked. The German police gave the signal to the Dutch authorities who then quickly migrated the entire Hansa server to the Netherlands and under their control. The German police simply filed the reports as two guys being caught pirating e-books and audiobooks which meant all the users on the Hansa site were oblivious to the takedown and the moving of the servers. While in jail the two men gave up all the passwords and credentials needed to access all parts of the site. The site had four moderators on it and even they didn’t know a takeover had occurred. This was a huge success for the Dutch and German authorities. Now that Europe’s most popular dark market was under Dutch government control they began turning the site into a mass surveillance station. [MUSIC] See, these dark markets have a lot of dealers, dealers who are selling massive amounts of meth, cocaine, heroin, weapons, and other illegal items. The authorities wanted to collect as much evidence as they could on those dealers so they could potentially stop them from selling any more. They first rewrote the code to log all user passwords in clear text. This way they could attempt to reuse those logins on other dark markets and websites. They found a way to read and log all communication between buyers and sellers while keeping it encrypted. This would reveal the home address of many of the buyers. The site had previously stripped out all metadata from every picture uploaded. These would be pictures of illegal items for sale but the authorities were able to strip the metadata off these photos and save it before it was posted. This would reveal the date, time, camera that was used to take the photo, and sometimes geo-location of where the photo was taken. Once this was in place the Dutch police staged a fake server glitch which accidentally removed all photos on the site, forcing sellers to re-upload their photos which provided authorities with numerous seller locations. By this time Hansa had over 70,000 listings on its site at any given time so this was a lot of information for the authorities to process. Amazingly enough, the police also tricked users on the site to download a homing beacon. They claimed this file was a backup encryption key to access their Bitcoins if the site were to ever go down. People downloaded it and opened it which would run a script that would try to connect to a URL and reveal that person’s real IP address. This gave authorities many more locations on where dealers were located and during this whole time the Dutch police continued to impersonate the two admins that were previously running the site, responding to other moderators, handling any site complaints from users, and actually doing a really good job with customer support. The users seemed very [00:25:00] happy with the level of customer support they were getting from the site, completely unaware it was being ran by the Dutch government”