Episode
27 December 2022 Official episode · Official transcript
cybercrime dark web bitcoin
The episode examines the Welcome to Video dark-web market and how cryptocurrency tracing, exchange records, server evidence, and international law enforcement cooperation were used to identify its administrator and users.
Topics: Bitcoin transaction tracing, Blockchain analysis and wallet clustering, Cryptocurrency exchange subpoenas and identity records, Tor hidden services and concealed hosting locations, Exposure of origin IP addresses through non-Tor thumbnail hosting, Web-source inspection using View Source, Cryptocurrency mixing services and tumblers, Privacy-oriented cryptocurrencies and protocols, Phishing and credential theft, Server and database seizure as corroborating evidence, International cybercrime investigations and mutual legal assistance
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Cypherpunks ASSOCIATED_WITH encryption
Andy says the Cypherpunks wanted to use encryption and anonymity tools to shift power from governments and corporations to individuals.
Explicit Confidence 98% · Andy Greenberg EP 131 Details
“the Cypherpunks that wanted to use encryption and anonymity tools enabled by encryption”
Cypherpunks RELATED_TO Tor
Andy says the Cypherpunk movement gave rise to technologies and projects including Tor.
Explicit Confidence 97% · Andy Greenberg EP 131 Details
“that movement gave rise to everything from VPNs to Tor to WikiLeaks”
Welcome to Video USES Tor
Welcome to Video operated on the Tor network, which hid the site and its users.
Explicit Confidence 99% · Jack Rhysider EP 131 Details
“Welcome to Video was on the darknet using the Tor network”
Matthew Falder USES Welcome to Video
The NCA found that Falder was a customer of Welcome to Video.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“on his computer they found that he was a customer of Welcome to Video”
Welcome to Video investigation and takedown INVOLVES Welcome to Video
The investigation and takedown concerned the Welcome to Video dark web market.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“the Welcome to Video investigation”
Welcome to Video investigation and takedown INVOLVES Child Sexual Abuse Material
The incident involved a market distributing child sexual abuse material.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“a financial investigation to find and dismantle a child abuse network”
Welcome to Video investigation and takedown INVOLVES National Crime Agency
The NCA was the first agency Andy knew to have investigated Welcome to Video.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“The first agency that I’m aware of that was looking at Welcome to Video was the NCA”
Chainalysis DEVELOPED_BY Jonathan Levin
Jack says Jonathan Levin started Chainalysis, and Andy identifies him as a co-founder.
Explicit Confidence 98% · Jack Rhysider EP 131 Details
“This guy started a company called Chainalysis”
“Jonathan Levin was a co-founder of the company”
Reactor DEVELOPED_BY Chainalysis
Chainalysis made the Reactor cryptocurrency-tracing tool.
Explicit Confidence 99% · Jack Rhysider EP 131 Details
“they made a tool to make it even easier, called Reactor”
Reactor USES wallet clustering
Reactor clusters wallets into groups based on common interests.
Explicit Confidence 99% · Jack Rhysider EP 131 Details
“It’ll then start to cluster those wallets into groups of common interests”
Reactor USES cryptocurrency tracing
Reactor is used to trace cryptocurrency flows and identify laundering techniques and endpoints.
Explicit Confidence 98% · Jack Rhysider EP 131 Details
“Reactor software will show that a person bought some Bitcoin at Coinbase, then transferred it to another wallet, and then they cashed out at Binance”
Jonathan Levin USES Reactor
Levin suggested entering a Welcome to Video Bitcoin address into Reactor.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“Jonathan Levin suggested that they just put one of those addresses into Reactor”
Internal Revenue Service Criminal Investigation USES Reactor
The IRS investigators used Chainalysis Reactor to investigate Welcome to Video users and payments.
Explicit Confidence 99% · Jack Rhysider EP 131 Details
“So using the Chainalysis Reactor tool, they were trying to get information on the users of the site”
Welcome to Video investigation and takedown INVOLVES Reactor
Reactor was used during the investigation to trace payments and identify users and administrators.
Explicit Confidence 99% · Jack Rhysider EP 131 Details
“using the Chainalysis Reactor tool, they were trying to get information on the users of the site”
IP address exposure AFFECTS Welcome to Video
A coding mistake exposed the IP addresses serving Welcome to Video thumbnails, despite the site being hosted through Tor.
Explicit Confidence 99% · Jack Rhysider EP 131 Details
“the thumbnail images weren’t hidden. They weren’t on Tor. They were just being served on the plain, old internet”
Tigran Gambaryan USES View Source
Tigran reportedly used View Source to inspect the site's code and find exposed thumbnail IP addresses.
Explicit Confidence 98% · Jack Rhysider EP 131 Details
“he just I think right-clicked the website and hit View Source”
Welcome to Video investigation and takedown INVOLVES Homeland Security Investigations
HSI partnered with the IRS because the IRS investigators lacked the manpower for the large investigation.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“IRS had actually partnered with Homeland Security because they didn’t have the manpower to do this massive investigation”
Welcome to Video investigation and takedown INVOLVES Korean National Police Agency
The KNPA cooperated in surveilling and arresting Son Jung-woo and seizing the server in South Korea.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“they needed the actual Korean police, the Korean National Police Agency, the KNPA, to actually carry out this arrest”
Welcome to Video ASSOCIATED_WITH Son Jung-woo
Investigators connected enough dots to believe Son Jung-woo was the administrator and owner of Welcome to Video; the relationship is presented as an investigative belief rather than an unconditional fact.
Uncertain Confidence 93% · Jack Rhysider EP 131 Details
“they connected enough dots for them to believe Son Jung-woo was the admin and owner of the dark web site Welcome to Video”
Welcome to Video investigation and takedown INVOLVES National Center for Missing and Exploited Children
Investigators shared the seized material with NCMEC, which assessed the uniqueness and scale of the videos.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“When they share all of this stuff with the National Center for Missing and Exploited Children”
Welcome to Video investigation and takedown INVOLVES phishing
A Welcome to Video user impersonated a moderator and phished other users' credentials to access their videos.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“He was actually just phishing people, essentially, on Welcome to Video, pretending to be a moderator”
Welcome to Video investigation and takedown INVOLVES cryptocurrency exchange
The investigation relied on subpoenas to cryptocurrency exchanges for identifying information about wallets and users.
Explicit Confidence 95% · Andy Greenberg EP 131 Details
“get a law enforcement agency involved that would send subpoenas to them”
Welcome to Video investigation and takedown INVOLVES BTCE
Investigators used records from BTCE, which had been taken down by US authorities, to investigate the site's suspected moderator.
Explicit Confidence 98% · Jack Rhysider EP 131 Details
“they were able to find a similar e-mail address as a user of a popular Bitcoin exchange called BTCE”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:52:09.303804+00:00