European and American investigators have broken up one of the world’s largest online criminal marketplaces for drugs, hacking tools and financial-theft wares in raids in the United States, Germany and Brazil.

Three German men, ages 31, 22 and 29, were arrested after the raids in three southern states on allegations they operated the so-called “Wall Street Market” darknet platform, which hosted about 5,400 sellers and more than 1 million customer accounts, Frankfurt prosecutor Georg Ungefuk told reporters in Wiesbaden on Friday.

A Brazilian man, the site’s alleged moderator, was also charged.

The three Germans, identified in U.S. court documents as Tibo Lousee, Jonathan Kalla and Klaus-Martin Frost, face drug charges in Germany on allegations they administrated the platform where cocaine, heroin and other drugs, as well as forged documents and other illegal material, were sold.

They have also been charged in the United States with conspiring to launder money and distribute illegal drugs, according to a criminal complaint filed in Los Angeles federal court.

“The charges filed in Germany and the United States will significantly disrupt the illegal sale of drugs on the darknet,” Assistant U.S. Attorney Ryan White told reporters in Germany. “We believe that Wall Street Market recently became the world’s largest darknet marketplace for contraband including narcotics, hacking tools, illegal services and stolen financial data.”

Two-year operation

Ungefuk said Wall Street Market was at least the second biggest, refusing to name others for fear of jeopardizing other investigations.

In the nearly two-year operation involving European police agency Europol and authorities in the Netherlands as well as the U.S. and Germany, investigators pinpointed the three men as administrators of the platform on the darknet. It is part of the internet often used by criminals that is hosted within an encrypted network and accessible only through anonymity-providing tools, such as the Tor browser.

Transactions were conducted using cryptocurrencies, and the suspects took commissions ranging from 2% to 6%, Ungefuk said.

The site trafficked documents such as identity papers and driver’s licenses. But an estimated 60% or more of the business was drug-related, he said.

​Caught during ‘exit scam’

Authorities swept in quickly after the platform was switched into a “maintenance mode” April 23, and the suspects allegedly began transferring funds used on the platform to themselves in a so-called “exit scam,” Ungefuk said.

The U.S. Department of Justice said the administrators took about $11 million in the exit scam from escrow and user accounts.

The U.S. identified a fourth defendant as Marcos Paulo De Oliveira-Annibale, 29, of Sao Paulo, Brazil. It was not clear if he had been arrested, and federal police in Brazil wouldn’t comment.

Annibale, who went by the moniker “MED3LIN” online, faces federal drug distribution and money laundering charges in the United States for allegedly acting as a moderator on the site in disputes between vendors and their customers. He also allegedly promoted Wall Street Market on prominent websites such as Reddit, the Justice Department said.

Brazilian authorities searched his home Thursday after investigators linked his online persona to pictures he posted of himself years ago, U.S. officials said.

Impact will be short-lived

A University of Manchester criminology researcher who follows activity on dark web markets, Patrick Shortis, said the takedown was widely anticipated after Annibale leaked his credentials and the market’s true internet address online.

Knocking out Wall Street Market is unlikely to have a lasting impact on online criminal markets, though law enforcement officials make it clear they are going after sellers and customers, Shortis said.

In Los Angeles, two drug suppliers were arrested, and authorities confiscated about $1 million cash, weapons and drugs in raids. They were only identified by their online monikers, “Platinum45” and “Ladyskywalker,” and characterized as “major drug traffickers” dealing methamphetamine and fentanyl.

Other darknet busts

After the first big takedown of such a marketplace, Silk Road in 2013, it took overall trade about four to five months to recuperate, Shortis said. And after law enforcement took out Hansa and AlphaBay in 2017, it took about a month, he said.

Shortis said one threat he does see to the market, in the short term at least, are so-called denial of service cyberattacks that effectively knock web servers offline by flooding them with traffic.

“An extortionist is currently targeting Empire and Nightmare, who are both in the running to replace Wall Street as the top market,” he said.

The raids in Germany culminated Thursday with the seizure of servers, while federal police confiscated 550,000 euros ($615,000) in cash, Bitcoin and Monero cryptocurrencies, hard drives, and other evidence in multiple raids.

Because of the clandestine nature of the operation and the difficulty of tracing cryptocurrencies, Ungefuk said it was difficult to assess the overall volume of business conducted by the darknet group. But he said that “we’re talking about profits in the millions at least.”
…