Episode

EP 58 — OxyMonster

04 February 2020 Official episode · Official transcript

dark web cybercrime bitcoin

The episode describes the identification and prosecution of Gal Vallerius, known as OxyMonster, through darknet-market activity and Bitcoin tracing, along with law-enforcement operations targeting opioid vendors and marketplaces.

Topics: Darknet-market anonymity and operational security, Tor and onion services, PGP public-key encryption, Bitcoin blockchain analysis and wallet tracing, Bitcoin tumblers and cryptocurrency cash-outs, Undercover law-enforcement operations, DDoS attacks against darknet marketplaces, Darknet-market administration and vendor infrastructure, Digital-device searches and forensic evidence

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

Entities (49)

Claims (29)

Qualified statements from this episode, not graph facts.

Jack Rhysider AUTHORED Darknet Diaries

Jack says the show is created and written by him.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“This show is created by me”

Jack Rhysider · offsets 58687–58713

Kyle Enos USES AlphaBay

Jack says Kyle Enos sold fentanyl on AlphaBay.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“he was selling fentanyl on AlphaBay”

Jack Rhysider · offsets 6449–6484

Kyle Enos USES Hansa

Jack says Kyle Enos sold fentanyl on Hansa.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“selling fentanyl on AlphaBay, Hansa, and the Dream”

Jack Rhysider · offsets 6456–6506

Kyle Enos USES Dream Market

Jack says Kyle Enos sold fentanyl on Dream Market.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“selling fentanyl on AlphaBay, Hansa, and the Dream”

Jack Rhysider · offsets 6456–6506

Silk Road DEVELOPED_BY Ross Ulbricht

Jack identifies Ross Ulbricht as the founder of Silk Road.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“Ross Ulbricht was the founder of Silk Road”

Jack Rhysider · offsets 7791–7833

AlphaBay DEVELOPED_BY Alexandre Cazès

Jack says Alexandre Cazes created AlphaBay.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“Alexandre Cazes, he created another dark marketplace called AlphaBay”

Jack Rhysider · offsets 8067–8135

Gal Vallerius SAME_AS OxyMonster

The DEA found a matching private PGP key and Jack says this proved Gal Vallerius was OxyMonster.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“This proved that Gal Vallerius was OxyMonster”

Jack Rhysider · offsets 30935–30980

OxyMonster USES Dream Market

OxyMonster was an administrator, vendor, and active participant on Dream Market.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“OxyMonster is an admin to Dream Market”

Jack Rhysider · offsets 17342–17380

OxyMonster USES TradeRoute

OxyMonster maintained an account and sold drugs on TradeRoute.

Explicit Confidence 98% · Jack Rhysider EP 58 Details

“check out OxyMonster’s account on TradeRoute”

Jack Rhysider · offsets 18268–18312

OxyMonster USES Evolution

Jack says OxyMonster was a moderator on the Evolution market.

Explicit Confidence 98% · Jack Rhysider EP 58 Details

“OxyMonster was a mod on the now-defunct Evolution dark market”

Jack Rhysider · offsets 18460–18521

OxyMonster USES Bitcoin

OxyMonster used Bitcoin for a tip jar and later cashed out those Bitcoin proceeds.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“OxyMonster cashed out on his tip jar earnings”

Jack Rhysider · offsets 24650–24695

OxyMonster USES localbitcoins.com

The DEA observed OxyMonster sending Bitcoin to localbitcoins.com fifteen times to cash out.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“OxyMonster sent his Bitcoin to a website called localbitcoins.com. He did this fifteen times.”

Jack Rhysider · offsets 24355–24449

OxyMonster USES PGP

A private PGP key labeled OxyMonster was found on Gal Vallerius’s laptop and matched the key on the OxyMonster account.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“they found a private PGP key labeled OxyMonster”

Jack Rhysider · offsets 30777–30824

Gal Vallerius USES Bitcoin

Gal possessed Bitcoin and agreed to forfeit Bitcoin proceeds from his darknet activities.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“He would also forfeit all of the Bitcoin proceeds he had amassed through his darknet activities”

Jack Rhysider · offsets 38357–38452

Gal Vallerius USES Silk Road

Prosecutors found connections linking Gal to Silk Road under another username.

Explicit Confidence 95% · Jack Rhysider EP 58 Details

“connections of him being on Silk Road, Silk Road 2, AlphaBay, Hansa”

Jack Rhysider · offsets 36926–36993

Gal Vallerius USES Silk Road 2

Prosecutors found connections linking Gal to Silk Road 2 under another username.

Explicit Confidence 95% · Jack Rhysider EP 58 Details

“connections of him being on Silk Road, Silk Road 2, AlphaBay, Hansa”

Jack Rhysider · offsets 36926–36993

Gal Vallerius USES AlphaBay

Prosecutors found connections linking Gal to AlphaBay.

Explicit Confidence 95% · Jack Rhysider EP 58 Details

“connections of him being on Silk Road, Silk Road 2, AlphaBay, Hansa”

Jack Rhysider · offsets 36926–36993

Gal Vallerius USES Hansa

Gal was described as a vendor on Hansa, although Jack notes that the username connection was not fully clear.

Uncertain Confidence 88% · Jack Rhysider EP 58 Details

“Gal was a vendor there, too. Now, the details are not clear here because it seems it was a different username”

Jack Rhysider · offsets 37257–37367

Drug Enforcement Administration USES Chain Analysis

Jack says the DEA used Chain Analysis to trace Bitcoin transactions in criminal cases.

Explicit Confidence 96% · Jack Rhysider EP 58 Details

“they’re being used by the DEA, FBI, IRS, Europol, to trace Bitcoin transactions”

Jack Rhysider · offsets 21966–22045

Drug Enforcement Administration USES Elliptical

Jack says Elliptical was among the tools used by the DEA to trace Bitcoin transactions.

Explicit Confidence 96% · Jack Rhysider EP 58 Details

“one is called Chain Analysis and the other is called Elliptical”

Jack Rhysider · offsets 21864–21927

Dream Market RELATED_TO Silk Road

Dream Market was modeled to look and operate like Silk Road.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“The Dream Market was stood up pretty quickly and it was modeled to look and act just like Silk Road”

Jack Rhysider · offsets 10996–11095

J-CODE INVOLVES Drug Enforcement Administration

J-CODE brought together the DEA as part of a task force targeting online opioid trafficking.

Explicit Confidence 99% · Jeff Sessions EP 58 Details

“By bringing together the DEA, our Safe Streets Task Forces, our drug-trafficking task forces, our healthcare fraud special agents and other assets, and the FBI”

Jeff Sessions · offsets 32133–32292

J-CODE INVOLVES Federal Bureau of Investigation

J-CODE was described as the FBI’s flagship task force against dark marketplaces and opioid trafficking.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“J-CODE stands for Joint Criminal Opioid Darknet Enforcement and was going into full effect”

Jack Rhysider · offsets 32402–32492

Operation Disarray INVOLVES Federal Bureau of Investigation

Operation Disarray coordinated FBI action against darknet vendors in the United States.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“Operation Disarray’s goal was to coordinate takedown of multiple dark market vendors who were in the US”

Jack Rhysider · offsets 33908–34011

Operation SaboTor INVOLVES Federal Bureau of Investigation

Operation SaboTor was a J-CODE mission involving the FBI and international law-enforcement agencies against darknet drug sellers.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“the FBI’s J-CODE team ... were onto their next mission. This time they called it Operation SaboTor”

Jack Rhysider · offsets 44400–44495

Dream Market shutdown INVOLVES Dream Market

The Dream Market shutdown incident involved a notice that the market would close and move to a partner platform.

Explicit Confidence 99% · Jack Rhysider EP 58 Details

“the market would be shutting down on April 30th but it would be moving to a partner platform”

Jack Rhysider · offsets 44234–44326

Dream Market ASSOCIATED_WITH DDoS attack

Dream Market was reported to be under a DDoS attack by hackers demanding payment.

Explicit Confidence 93% · Jack Rhysider EP 58 Details

“Dream Market was under a DDoS attack by hackers demanding $400,000”

Jack Rhysider · offsets 42302–42368

Empire ASSOCIATED_WITH DDoS attack

Empire was reported to be among the marketplaces receiving DDoS attacks.

Explicit Confidence 95% · Jack Rhysider EP 58 Details

“two other leading marketplaces, Empire and Nightmare, were also getting Ddossed”

Jack Rhysider · offsets 42545–42624

Nightmare ASSOCIATED_WITH DDoS attack

Nightmare was reported to be among the marketplaces receiving DDoS attacks.

Explicit Confidence 95% · Jack Rhysider EP 58 Details

“two other leading marketplaces, Empire and Nightmare, were also getting Ddossed”

Jack Rhysider · offsets 42545–42624

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:16:19.952820+00:00