Gal Vallerius, a 36-year-old French national pleaded guilty this week in the US of selling narcotics on the Dark Web under the nickname of OxyMonster.
US authorities arrested Vallerius in September last year, at the Atlanta airport after he arrived in the US to attend and participate in the World Beard and Mustache Championships that was being held in Austin, Texas.
OxyMonster ousted after OpSec mistake
According to court documents, US authorities managed to identify Vallerius as OxyMonster and keep him under surveillance after they discovered one of his Bitcoin accounts.
In a criminal complaint filed last year, investigators say that Vallerius configured a “tip jar” on the Dream Market Dark Web marketplace.
The tip jar was meant to allow users or buyers to tip Vallerius for his services. Unlike most vendors on the Dream Market, OxyMonster did not configure the tips to go through the marketplace’s internal payment systems, which passed transactions through a tumbler/mixer (transaction anonymizer), but set the tip jar to receive funds in a Bitcoin address he set up.
40. After observing the bitcoin ‘tip jar’ advertised by OxyMonsyter, agents conducted [an] analysis of the incoming and outgoing transactions from that bitcoin address and learned that 15 out of 17 outgoing transactions from the OxyMonster tip jar went to multiple wallets controlled by French national Gal VALLERIUS on Localbitcoins.com.
This allowed law enforcement to get an initial clue of who may be behind the OxyMonster monicker. Their suspicions were later confirmed when an analysis of OxyMonster and Vallerius’ writing styles suggested they were the same person.
41. Open source data revealed that VALLERIUS has Instagram and Twitter accounts. Agents compared the writing style of OxyMonster on Dream Market forum while in Senior Moderator role to the writing style of VALLERIUS on his public Instagram and Twitter accounts. Agents discovered many similarities in the use of words and punctuation to including: the word ‘cheers;’ double exclamation marks; frequent use of quotation marks; and intermittent French posts.
Officials confirm suspect’s identity after seizing his laptop
When Vallerius traveled to the US for the first time last fall, border agents subjected him to a search in the airport. A search of his laptop, which was later seized, confirmed that Vallerius was OxyMonster.
Agents found incriminating evidence on the laptop, such as the PGP encryption key that OxyMonster used to sign messages online, OxyMonster login credentials for the Dream Market, and Bitcoin wallets containing Bitcoin addresses associated with OxyMonster’s vendor accounts.
The original criminal complaint tried to peg OxyMonster as a seller of several controlled substances such as cocaine, fentanyl, methamphetamine, LSD, and oxycodone.
OxyMonster pleads guilty
After nine months trying to avoid a lifetime prison sentence in the US, Vallerius signed a guilty plea this week, admitting to selling Oxycodone and Ritalin on the Dream Market under the name of OxyMonster.
Vallerius pleaded guilty for conspiracy to possess with the intent to distribute controlled substances (because he was an administrator and super moderator on the Dream Market, aiding in the distribution of many other illicit goods) and conspiracy to launder money. Vallerius now faces a sentence of around 20 years in prison, but no lifetime sentence.
Besides OxyMonster, Vallerius also went on Dark Web markets as VanDeevp, and had accounts on multiple marketplaces, such as AlphaBay, Hansa Market, TradeRoute, Valhalla, and Evolution.
Despite his crimes and how authorities tracked him down, OxyMonster will always be remembered for his glorious beard and the silly way he was arrested.
All in all, this is just another case where authorities have proven once more that Bitcoin as a cryptocurrency isn’t really anonymous as it was advertised for the past decade.
Image credits: Vallerius’ Instagram account