Open-Source Intelligence
The Dropped Connection: How One VPN Failure Led to the Arrest of Wall Street Market's Three Administrators
Wall Street Market was one of the largest darknet markets in the world, with about 1,150,000 registered customers according to its own homepage. Three Germans ran it behind Tor, cryptocurrencies and VPN services. According to the U.S. criminal complaint, brief moments in which the cover failed opened the way to them.
In brief
- Wall Street Market operated on Tor. According to the complaint, its homepage advertised about 5,400 vendors and about 1,150,000 customers.
- According to the complaint, the administrators reached the infrastructure through two VPN providers. When one connection dropped, one administrator's real IP address was exposed, leading to a German telecom company and a cellular modem registered under a suspected false name.
- The device was located at the home and the workplace of Tibo Lousee. The IP address of Jonathan Kalla was registered in his mother's name.
- On 23 and 24 April 2019 Lousee, Kalla and Klaus-Martin Frost were arrested in Germany. The complaint was filed in the United States on 1 May 2019.
- Everything here is an allegation by the prosecution. We found no judgment in their case in the sources we checked, so this article does not state that they were convicted.
On 1 May 2019 a criminal complaint was filed in a federal court in California against three Germans, alleging that they ran Wall Street Market, one of the largest darknet markets in the world. According to the complaint, the site was put into maintenance mode by German authorities after the three were arrested. According to the complaint, the way to them was opened by a few small mistakes: a VPN connection that dropped for a moment, a cellular modem registered under a suspected false name, and an IP address registered in one man's mother's name.
The largest market on the dark web
Wall Street Market, or WSM, operated on the Tor network from 2016 to 2019, according to the complaint. Its homepage advertised about 5,400 vendors and about 1,150,000 customers worldwide. According to the complaint, it sold narcotics, stolen payment card data, counterfeit documents and malware, with payment in bitcoin and Monero.
According to AP, a U.S. prosecutor said the market had recently become the largest darknet market in the world.
Three administrators, three handles
According to the complaint, three Germans ran the site under the handles coder420, Kronos and TheOne. Tibo Lousee is alleged to be coder420, Jonathan Kalla is alleged to be Kronos, and Klaus-Martin Frost is alleged to be TheOne. The three administrator accounts received equal monthly payments.
The servers were in Germany and the Netherlands. In the site's database, named tulpenland, the investigators found conversations between the administrators, in German, about maintenance and about splitting commissions.
The moment the VPN dropped
According to the complaint, the administrators reached the site's infrastructure through two VPN providers. When the connection to the first provider dropped, the real IP address of one administrator was exposed. The address belonged to a German telecommunications company, and the German Federal Criminal Police Office, the BKA, approached it to find out to whom it was registered. At that stage the complaint does not attribute the address to a named person.
The inquiry led to a UMTS cellular modem registered under a suspected false name. The false name did not protect the owner of the device. According to the complaint, the device was located at Lousee's home in Kleve, Germany, and at his IT workplace, and when he was arrested his computer was unlocked and a modem of this type, suspected of having been used to log into the site, was found in his possession.
From there the prosecution moved on to further threads:
- Lousee's GitHub account used the handle codexx420, nearly identical to the administrator handle coder420, and the complaint links the two.
- The IP address of the second administrator was registered in the name of Kalla's mother. According to the complaint, Kalla stated that he was the administrator who operated as Kronos.
- The PGP public key of TheOne matches the key of a vendor account named dudebuy on the earlier darknet market Hansa, and according to the complaint it links Frost to that account.
- According to the complaint, a bitcoin payment was made to a gaming company for an account registered with an email address bearing Frost's name, from a wallet that later received funds from wallets associated with the site's administrators.
The last theft and the arrests
According to the complaint, between 22 and 26 April 2019 members of the public published analyses of virtual currency transactions suggesting that amounts estimated at 10 to 30 million dollars were being moved from wallets associated with the site to other wallets. AP reported about 11 million dollars. The amount is not proven, and the complaint presents it as an estimate by members of the public.
According to the complaint, German authorities arrested Lousee, Kalla and Frost on 23 and 24 April 2019. The complaint was filed in the United States on 1 May 2019, and the operation was announced on 3 May. According to AP, 550,000 euros in cash and virtual currency were seized in Germany, along with servers, and a Brazilian named Marcos Paulo De Oliveira-Annibale, who worked as a moderator on the site, was also charged.
What has not been determined
Everything in this article is an allegation by the U.S. prosecution, as set out in a criminal complaint. A criminal complaint is an initial step and not a judgment. In the sources we checked we found no judgment concerning the three defendants, so this article does not state that they were convicted.
What the case teaches
On paper, the administrators did almost everything right: Tor, a VPN, virtual currencies and a modem registered under another name. According to the complaint, the cover broke wherever one link failed.
A VPN is one link in the chain. A connection that drops for a second is enough for a real address to be recorded by whoever listens at the other end.
A false name does not hide a location. A device is always somewhere, and whoever tracks it reaches the door. Registering a SIM card or a modem in another person's name does not guarantee anonymity.
Similar handles and family ties leave traces. A handle that repeats across tools and an address registered to a mother connect an anonymous identity to a real person.
Source documents and reports
TechCrunch report, 3 May 2019 →
AP report on SecurityWeek, May 2019 →
Sources: Criminal complaint, United States v. Tibo Lousee, Klaus-Martin Frost and Jonathan Kalla, U.S. District Court for the Central District of California, 1 May 2019. TechCrunch report, 3 May 2019. AP report, May 2019.
The information in this section is general and is not legal advice. A criminal complaint presents the position of the prosecution only.
