Open-Source Intelligence
A Teenage Hotmail Address: How AlphaBay Founder Alexandre Cazes Was Identified
According to the U.S. Department of Justice, AlphaBay was the largest dark web market of its time. Its operator hid behind encryption, cryptocurrency, a shell company and purchased citizenship. According to the forfeiture complaint, the path to him began with an email address he was already using in 2008, at the age of 17, which appeared in the header of the site's automated emails.
In brief
- AlphaBay operated from December 2014. According to the U.S. Department of Justice it had about 200,000 users and 40,000 vendors, and was the largest dark web market of its time.
- According to the forfeiture complaint, the header of the site's automated emails carried its operator's personal address, Pimp_Alex_91@hotmail.com, from December 2014. Law enforcement learned of it in December 2016.
- The address led to Alexandre Cazes, a Canadian born in 1991, and to a 2008 post on a French forum signed with his full name and the same address.
- He was arrested in Bangkok on July 5, 2017, with his laptop open and logged in to the site's server as administrator. On July 12 he died in custody.
- On April 27, 2018 the court dismissed all 16 counts of the indictment following his death. Cazes was never tried or convicted. His assets were forfeited in a separate civil proceeding.
In July 2017, in a suburb of Bangkok, an unmarked police car crashed into the gate of a villa. The officers who climbed out played confused, as if they had botched a three-point turn. About a minute later the owner, a 25-year-old man, came out to see what had happened. That is how an FBI agent described the arrest at a security conference in January 2018, according to Vice. The man was arrested on the spot and his phone was taken.
In the bedroom, investigators found a laptop that was open and unencrypted. According to the forfeiture complaint filed by the U.S. Department of Justice, it was logged in to the server hosting AlphaBay under the username Admin, and it was also logged in to the site's forum under the same name, where he was replying to users. The man was Alexandre Cazes. The path to him began with an email address he was already using in 2008, when he was 17.
The largest market on the dark web
According to the U.S. Department of Justice, AlphaBay was the largest dark web market of its time. It had about 200,000 users and 40,000 vendors, more than 250,000 listings for drugs and toxic chemicals, and more than 100,000 listings for stolen and fraudulent identification documents and access devices, counterfeit goods, malware and firearms. Payment was accepted only in digital currencies.
The indictment describes a site that looked like an ordinary online store, with search, vendor ratings and a user forum. The site itself encouraged users not to put anything in their profiles that could reveal their true identities.
According to the complaint, between May 2015 and February 2017 the site's Bitcoin addresses received deposits worth about 450 million dollars. The government estimated that a commission of 2 to 4 percent on such transactions would have earned the operator between 9 and 18 million dollars.
A cover that looked professional
According to the complaint, Cazes did not rely on encryption alone. He ran a shell company, EBX Technologies, presented as a web design firm. Its website was barely functional, its blog had not been updated since January 2015, and its bank records showed little income. The company was used to justify the movement of money and to open accounts at cryptocurrency exchanges, where he converted Bitcoin into cash.
He bought citizenship of Antigua and Barbuda through a 400,000 dollar investment in beachfront property, and tried to obtain citizenship in Cyprus as well: investigators intercepted a package he sent there, indicating a transfer of 2.38 million euros to a Cypriot bank for the purchase of a villa. His LinkedIn profile listed cryptography, network security and server administration.
The header of the "welcome" email
When the site launched in December 2014, a user forum opened alongside it. Everyone who registered received an automated welcome email, and anyone who asked to reset a password received another. In the technical header of both messages, the information attached to every email that most recipients never see, the sender address appeared: Pimp_Alex_91@hotmail.com. According to the complaint, this was Cazes's personal email address. The document does not explain how it got there. Law enforcement learned of the address in December 2016, two years after the launch.
The identification was then built in five steps:
- The address belonged to a Canadian man named Alexandre Cazes, born on October 19, 1991. The number 91 in the address matched his birth year.
- A LinkedIn profile for Alexandre Cazes showed him as an employee of EBX Technologies, with skills in servers, networks and encryption.
- On the French computer forum commentcamarche.com, investigators found a post dated December 3, 2008, in which a user named Alpha02 explained in French how to remove a virus from a digital photo. The user signed the post with his name, Alexandre Cazes, and the same email address.
- Alpha02 was also the username of AlphaBay's administrator, until it was changed to Admin in August 2015.
- PayPal records showed accounts in his name that listed the same address alongside an EBX Technologies address.
He also liked to show off
The complaint describes a forum called RooshV, where he paid a membership fee and regularly wrote about his financial success and about cryptocurrency. When he said he had bought a Porsche Panamera and another user doubted it, he posted the details of his negotiation with the dealership and sent the user a video of himself driving the car. Officers saw him driving that car in Thailand; it was registered in his name and parked at his home on the day of the arrest.
On the open laptop, investigators found text files with the passwords to AlphaBay's servers, and a document laid out like a personal financial statement, headed TOTAL NET WORTH, with a net worth of 23,033,975 dollars. It listed, among other things, a Lamborghini bought for more than 900,000 dollars, properties in Thailand, Cyprus and Antigua, a Swiss account with 781,000 dollars, and 6.5 million dollars in cryptocurrency. Next to the wallet addresses he had also written the private keys. Using them, investigators moved cryptocurrency worth about 8.8 million dollars to government-controlled addresses.
The end, and what was never decided
Cazes was arrested by the Royal Thai Police on July 5, 2017, with the assistance of the FBI and the DEA. On July 12 he died in custody in Thailand. According to the U.S. Department of Justice, it appeared to be a suicide.
He faced a 16-count indictment filed in California on June 1, 2017: conspiracy to engage in a racketeer influenced corrupt organization, conspiracy to distribute narcotics, distribution of narcotics, conspiracy to commit identity theft, unlawful transfer of false identification documents, access device fraud and money laundering. On April 26, 2018 the government moved to dismiss the indictment following his death, and on April 27 the court dismissed all 16 counts. Cazes was never tried or convicted, and everything in the documents is an allegation by the prosecution.
His assets were forfeited in a separate civil proceeding. On September 5, 2018 the U.S. District Court for the Eastern District of California ordered the forfeiture of vehicles, bank accounts, real property in Thailand, Cyprus and Antigua and Barbuda, and cryptocurrency. None of the claimants to the assets appeared, and the judgment was entered by default.
On July 20, 2017 the operation against AlphaBay was presented as a joint action led by the FBI, the DEA and the Dutch National Police, with the support of Europol, which also included the shutdown of the dark web market Hansa.
What the case shows about open-source investigation
The address itself, together with the username Alpha02, remained online from 2008 until investigators reached it. Three things stand out in the chain of identification.
Reusing a name or an address links identities. An operator of an anonymous service who uses a username or address he had used before gives anyone who searches for it a link between the two identities.
One connection is a lead, not proof. Each link in the identification rested on an independent data point: a birth year against a date of birth, professional skills against the running of a site, a username against an old post.
Not everything is found in the open. PayPal records and bank data are held by private companies, and law enforcement obtains them through legal process. A private investigator in Israel cannot obtain them, and works within the limits of the Protection of Privacy Law. What remains open is what people leave behind themselves.
Source documents
Indictment, United States v. Cazes, Eastern District of California (PDF, 24 pages) →
Verified complaint for forfeiture in rem, July 19, 2017 (PDF, 27 pages) →
U.S. Department of Justice announcement on the AlphaBay shutdown, July 20, 2017 →
Europol announcement on the AlphaBay and Hansa operation, July 20, 2017 →
Sources: Indictment, United States v. Alexandre Cazes, U.S. District Court for the Eastern District of California, case 1:17-CR-00144, June 1, 2017; verified complaint for forfeiture in rem, case 1:17-at-00557, July 19, 2017; magistrate judge's findings and recommendations and default and final judgment of forfeiture, case 1:17-CV-00967, August 8, 2018 and September 5, 2018; U.S. Department of Justice announcement, July 20, 2017; Europol announcement, July 20, 2017; Vice report on the arrest video.
The information in this section is general and is not legal advice. An indictment and a complaint present the prosecution's position only.
