After days of rumour on the Internet the U.S. Justice department has confirmed that a Canadian citizen living in Thailand was arrested in that country and is believed to have committed suicide while in custody after international authorities — including police here — worked to close the AlphaBay criminal marketplace on the Dark Web.
At the same time European law enforcement, led by Dutch police, shut down the Hansa trading site, believed to be the third largest criminal marketplace on the Dark Web, which also traded in high volumes in illicit drugs, malware, stolen and fraudulent documents and other commodities. AlphaBay was number one.
In a statement the Justice department said that on July 5, Alexandre Cazes, also known on the Web as Alpha02 and Admin, 25, a Canadian citizen residing in Thailand, was arrested by Thai authorities on behalf of the United States for his role as the creator and administrator of AlphaBay. That same day the RCMP executed search warrants at a home in Trois Rivieres, Que., and seized computer equipment.
On July 12 Cazes “apparently took his own life” while in a cell in Thailand, the U.S said.
Cazes was facing extradition to the U.S. after being charged with one count of conspiracy to engage in racketeering, one count of conspiracy to distribute narcotics, six counts of distribution of narcotics, one count of conspiracy to commit identity theft, four counts of unlawful transfer of false identification documents, one count of conspiracy to commit access device fraud, one count of trafficking in device making equipment, and one count of money laundering conspiracy.
The U.S. alleged in an a court document demanding seizure of goods and property in a number of countries that Cazes was the founder and leader of AlphaBay and “collected tens of millions of dollars in commissions” from sales. Sales were only made in digital currency.
Police had been investigating AlphaBay during 2016, making undercover purchases. But in the document the U.S. alleged that Cazes was unmasked after police learned in December of that year that a Hotmail account was included in the header of “welcome” email sent to new users. The same email address was in the header of AlphaBay’s password recovery process. That address was linked to Cazes after police found a 2008 post on an unrelated online tech forum that included the same email address and the name Alexandre Cazes.
The court document alleges that Cazes used a front company called EBX Technologies to justify his banking activity. Police also seized his PayPal account records.
According to the RCMP, it began investigating Cazes and AlphaBay in January after receiving lead information from the FBI and the U.S. Drug Enforcement Agency (DEA). In fact, Cazes was in Quebec that month, the force says, and was stopped by Trois Riveres police. H presented a Thailand drivers licence and mentioned he was visiting his mother.
As part of its investigation the RCMP obtained several production orders from courts for Internet providers and bank accounts, search warrants for emails, for a residence, a business and that company’s server. “We are analyzing the seized data,” Const. Erique Gasse, a media relations officer for the force, said in an email. “We are considering the possibility of potential associates in Canada.”
Earlier this week the National Post said Cazes moved to Thailand four years ago and lived a high life.
According to U.S. authorities, when the Royal Thai Police arrested Cazes on July 5 in Bangkok a laptop was found in his bedroom logged into the AlphaBay administrator’s Web page. It was trying to reboot the site after it went offline. Unknown the to administrator police had pulled the plug.
Because the laptop was unencrypted police had access to a file with all admin passwords, as well as a file of Cazes’ titled “Total Net Worth.” The total was north of US$23 million.
Meanwhile Dutch police arrested two of Hansa’s administrators in Germany and seized servers in the Netherlands, Germany and Lithuania.
The Wall Street Journal first broke news of the take-down of AlphaBay on July 13, but police only officially announced it and the closing of Hansa on Thursday.
Police in several countries had been monitoring the two marketplaces before charges were laid, then worked to freeze and preserve millions of dollars’ worth of cryptocurrencies that were the subject of forfeiture counts in the indictment and that represent the proceeds of the AlphaBay organization’s illegal activities, said U.S. authorities. In addition police have captured thousands of email addresses of buyers who used the two markets. Undoubtedly those will be used in follow-up investigations.
“The so-called anonymity of the dark web is illusory,” Chuck Rosenberg, acting director of the U.S. Drug Enforcement Agency, said in a statement.“We will find and prosecute drug traffickers who set up shop there, and this case is a great example of our commitment to doing exactly that. More to come.”
However, experts believe criminals will merely find other places on the Dark Web to do business. Indeed AlphaBay reportedly was set up after the take-down of the Silk Road market in 2013.
Still, law enforcement authorities were trumpeting the seizure of two big sites as a huge blow against criminals.
The operation against AlphaBay was led by the United States and involved Canada, Thailand, the Netherlands, Lithuania, the United Kingdom, and France, as well as the European law enforcement agency Europol.
U.S. authorities cited a public statement allegedly made by one AlphaBay staff member that the site serviced over 200,000 users and 40,000 vendors. Around the time of takedown, there were over 250,000 listings for illegal drugs and toxic chemicals on AlphaBay, said the Justice deparment, and over 100,000 listings for stolen and fraudulent identification documents and access devices, counterfeit goods, malware and other computer hacking tools, firearms and fraudulent services.
By comparison, the U.S. says, the Silk Road marketplace reportedly had approximately 14,000 listings for illicit goods and services at the time of seizure and was the largest dark web marketplace at the time.
As part of the AlphaBay investigation police had been making undercover purchases of illegal items from site vendors since 2016.
Europol credits security vendor Bitdefender with helping police on the Continent with the Hansa investigation. As part of that police took covert control of Hansa under Dutch judicial authority a month ago, which allowed Dutch police to monitor the activity of users without their knowledge. When the AlphaBay site was shut Dutch police also swept up the addresses of new users who fled to Hansa “in their droves.”
“As a law enforcement strategy, leveraging the combined operational and technical strengths of multiple agencies in the U.S. and Europe, it has been an extraordinary success and a stark illustration of the collective power the global law enforcement community can bring to disrupt major criminal activity,” Europol said in a statement.
(This story has been updated to include information on the RCMP participation in the investigations)