Update: Gal Vallerius has been sentenced to 20 years in prison. Coverage here.
An accused darknet criminal operating as “OxyMonster” plead guilty in a Miami federal court on Tuesday to charges concerning drug conspiracy and money laundering.
Reportedly, the French national will now face a prison sentence that could see him spend a whopping two decades behind bars.
Gal Vallerius, the heavily bearded 39-year-old man, is said to have been a controlling administrator for Dream Market. In his capacity, he oversaw the buying and selling of illicit goods and services, an aspect that typifies most dark web platforms.
Through a plea deal, Vallerius admitted to the charges levelled against him, as opposed to the initial life imprisonment he faced after his arrest in the United States.
According to an announcement from the Department of Justice, his sentencing is scheduled for September 25, 2018.
Following his arrest in August 2017, Vallerius was indicted in Miami to face charges that would send him to prison for life.
Anthony J. Natale, his attorney, is reported to have been instrumental in helping him avoid this possibility.
This came about as a compounding effect stemming from the lawyer’s various attempts to challenge the court on various grounds of case complexity.
The defendant’s lawyer tried to prevent the federal court from using his client’s laptop computer as an element in court proceedings. Ultimately, this move failed and meant that the court now had access to a vital piece of evidence to be used in arguing the case.
Next, Vallerius’ lawyer sought out a plea deal with prosecutor Tony Gonzalez that would otherwise save the dark web kingpin from life imprisonment.
Arguably, Vallerius’ choice to embrace the plea agreement was directly contingent on the course of his court case. In this tone, the prosecution had reportedly intended to provide additional incriminating evidence to convince the court of his wrongdoing.
Trial evidence was meant to include information that would prove the defendant’s illicit darknet sales endeavors apart from being a moderator for Dream Market.
Through court files, the prosecution provided that the man traded in Ritalin and Oxycontin on Hansa Market, another darknet site that was shut down in 2017. Additionally, it was said that Vallerius had other accounts in several other darknet markets like AlphaBay, which has also been shut down.
Vallerius’ role in Dream Market was that of a senior moderator. His assignment supported the platform in connecting the buyers and sellers of drugs between Europe and the U.S. Dream Market offers an ample environment where they could trade amongst themselves without the fear of being exposed.
Furthermore, it is essential to note that apart from drug sales, the darknet platform is known for according technical assistance to members through discussion forums.
This aspect extends to posting vendor reviews to advance customer confidence in their sellers.
Moreover, Dream Market administrators solve internal disputes from time to time to ensure the smooth running of the darknet site as a prerequisite for profit generation.
Gal Vallerius was a wanted man. The darknet criminal was literally hunted by multiple agencies including the Drug Enforcement Administration (DEA), the Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI).
A DEA affidavit expressed the methodologies used in cracking down on Dream Market and the subsequent linkage of the darknet site to Vallerius.
The eventual arrest of Vallerius was the product of an undercover operation in which DEA agents visited Dream Market to unravel its mysteries.
A January 2017, crackdown on Dream Market sent agents to the homepage belonging to the site.
In the page, the agents navigated to a link called “Forum,” which took them to a landing page that accommodates discussions surrounding the market’s user experience. In the forum, traders and their customers engage in discourses that are controlled by a site moderator.
On browsing, the agents came across the subject of “Official Staff” that fell under “Announcements.”
The first posting was made by one “OxyMonster” who, by then, had not been identified as Vallerius.
The investigative agents probed further by clicking on the account’s profile to understand its role in Dream Market. It was then found that OxyMonster was a senior moderator.
Further investigations led agents to discover that OxyMonster was not only a senior moderator, but a prolific seller on the darknet platform. Particular details indicated that the vendor traded in drugs that originated from France to the rest of Europe, and extended to the U.S.
The DEA did a critical analysis on OxyMonster’s posts on the Dream Market forum to identify trends that would lead the officers to a physical address. Among his posts included advice on staying anonymous through dark web activity.
Further analysis enlightened the agents on OxyMonster’s Bitcoin transactions that would be tied to an address.
In this sense, it was revealed that the vendor used Bitcoin in making sales. Regular Bitcoin traffic allowed the agents to learn trends concerning the account’s transactions which would later be linked to Vallerius on localbitcoins.com.
In a nutshell, the true identity of Vallerius was ultimately revealed after agents located a Bitcoin depository that was controlled by the darknet kingpin. This included a Bitcoin tip jar in which payments would be made before being deposited to numerous wallets managed by Vallerius.
A Somewhat Predictable Man Living a Double Life
Perhaps Vallerius’ greatest shortcoming was his propensity to leading a double life.
From a top secret darknet moderator to a contestant in the World Beard and Mustache Championships, there is no telling of how much appetite the man had for risks.
Social Media Activity
DEA investigations showed that Vallerius operated two social media accounts—Twitter and Instagram.
This achievement came about because of a match-making exercise that would reveal particular similarities between his social media feed and those of OxyMonster’s forum postings.
Vallerius’ writing style had a striking resemblance to the manner in which OxyMonster expressed his words. For example, DEA agents found out that he intermittently made posts on the three platforms using the French language.
While social media seems to be everyone’s cup of tea in today’s world, it is unusual to expect that a dark web kingpin would be careless with the internet.
Critical caution should have meant that he avoided any association between Dream Market’s OxyMonster and his real identity.
His obvious failure to consider the possibility of being traced, through the surface web, added up to the scale of evidence that would be used by prosecutors to pin him down.
Certainly, Vallerius’ biggest blunder must have been about traveling with a spouse from France to the U.S., just to participate at an event for “showing off beards.”
In August 2017, a DEA special agent consulted HSI on queries concerning Vallerius’ probable travel plans. The officer would then learn that the suspect was set to travel from Paris to Atlanta on August 31, 2017.
The DEA requested the HIS border enforcers to flag and detain him at customs for questioning.
The agent, Lilita Infante, would later testify in a court hearing to confess that she had no foreknowledge about specific belongings that would be found on Vallerius.
In her testimony, she pointed to the fact that dark web users are typically accustomed to the practice of doing business on portable computers.
In this regard, it was expected that the man would be carrying with him a laptop computer, which would form a critical part of prosecution evidence.
Moreover, Infante hoped that the search on the man’s belongings would open the lid to information regarding his linkage to Dream Market.
Well, the agent’s instincts worked in her favor after Vallerius, who was accompanied by his wife, was in possession of a laptop, mobile phone and an iPad tablet.
As per routine inspection procedures, Vallerius was asked to produce passwords to the electronic devices. This allowed the HSI officials to scan their contents and link Vallerius to Dream Market.
A Productive Arrest
The apprehension of Vallerius occurred last year in Atlanta, at an airport where he had landed from France.
The man was said to have fully cooperated with law enforcement officers who were keen on solving a dark web case dating back to 2016.
The agents confiscated his laptop computer believing that the decision would yield critical information regarding the man’s exploits.
Expectedly, Vallerius’ laptop opened up to a wealth of incriminating evidence that would instantly tie him to darknet activity. In the laptop, the Tor browser and Dream Market login credentials were identified.
Tor is regarded as the leading anonymity tool in the dark web world, which allows users to conceal their identity from possible law enforcement detection. This aspect allows them to partake in their illicit businesses without fear.
Furthermore, Vallerius’ laptop revealed a staggering $500,000 worth of Bitcoin.
Indeed, tracking down Vallerius was a laborious undertaking. While his arrest yielded concrete pieces of evidence, it may be easy to downplay the fact that the bearded Frenchman was most wanted in comparison to a long list of dark web criminals charged in the past few years.
Latest posts by Cherry Pepper (see all)
- Dark Web a Point of Focus in Annual Intellectual Property Report to Congress - February 28, 2019
- Silk Road Founder Loses Bid for New Trial - February 18, 2019
- Analysis: Importance of Law Enforcement Education on Cryptocurrencies & the Dark Web - January 17, 2019