Ok.. he was a drug dealer... but check that XMR s**t...

[wellington]

https://www.justice.gov/usao-sdny/media/1352546/dl -> page 20 onwards.

This is the 'sealed complaint' -> this is pre-indictment -> look at the data they've gleaned from that server before probable cause.

24. Based on my involvement in this investigation, my training and experience, myreview of documents and other materials, as well as my conversations with law enforcementofficers and others, I have learned the following, among other things:a. All transactions on Marketplace-1 must use Marketplace-1’s bank. As explainedabove, Marketplace-1’s “bank” enables Marketplace-1 to retail and distribute narcotics securely17 The reference to successful DDoS attack prevention may be a reference to the purposeof Server-1.
between users (e.g., buyers) and sellers (e.g., vendors). Through the bank, customers depositcryptocurrency (Bitcoin or Monero) into the customer’s Marketplace-1 bank account—essentiallya cryptocurrency wallet. Once deposited, each user’s marketplace wallet is controlled byMarketplace-1. Then, after a buyer purchases a product from a vendor (e.g., narcotics)Marketplace-1 releases funds to the vendor’s Marketplace-1 bank account. In this way,Marketplace-1 serves as a financial link between vendors and customers and in so doing providesboth parties a level of comfort that the transaction will be consummated, while also allowing theparties to maintain distance and anonymity between each other. Marketplace-1’s bank also offersan escrow service, which provides sellers and buyers further protections. The escrow service canbe set such that a buyer’s money will be released to a seller only after specified actions occur, forexample, the shipment of narcotics. With the escrow service, sellers know they will be paid fortheir illegal narcotics and buyers know their payments will be released to sellers after specifiedevents occur. Although not every transaction on Marketplace-1 uses the bank’s “escrow” services,many do.b. Law enforcement officers identified the cryptocurrency wallets that Marketplace-1uses for its bank (collectively, “Bank Wallet-1”) and uses to funnel proceeds from Marketplace-1to Administrator-1 (“Administrator Wallet-1”):

Pursuant to the January 2024 judicially authorized warrant, lawenforcement officers searched Server-3. In Server-3, law enforcement officers identified thefollowing directories (i.e. computer folder) “/root/.bitcoin/wallets/[Marketplace-1] 1/”;/root/.bitcoin/wallets/[Marketplace-1] 2/”; “/root/.bitcoin/wallets/[Marketplace-1] 3; and/root/.bitcoin/wallets/[name of a cryptocurrency tracking software promoted by Administrator-1].Each of these computer folders contains a Bitcoin wallet file. A Bitcoin wallet file is a databasethat contains public and private Bitcoin keys to a particular Bitcoin wallet. 18 Because each of theseBitcoin wallet files were found on Server-3 and are named [Marketplace-1] or the cryptocurrencytracking software promoted by Adminstraotr-1, they appear to contain Marketplace-1 assets—specifically deposits made by customers and vendors into Bank-1.19 For simplicity, these fourwallets are defined herein as “BTC Bank Wallet-1.”

At the time of the search, wallets [Marketplace-1] 1, [Marketplace-1] 2,[Marketplace-1] 3, contained most proceeds, a total of approximately 1315.6 BTC ($36.8 million)in deposits. The wallet identified as a [name of a cryptocurrency tracking software promoted byAdministrator-1] contained approximately 0.41 BTC ($11,921) in deposits. 22ii. A review of BTC Bank Wallet-1 indicates that from on or about November9, 2020 through on or about January 9, 2024, there were approximately 244,483 Bitcointransactions in and out of BTC Bank Wallet-1, consisting of approximately 183,772 deposits andapproximately 60,711 withdrawals. The total Bitcoin deposited represents approximately1,316.038719 BTC ($36,895,586.12), and the total Bitcoin withdrawn represents approximately1,303.126267 BTC ($36,431,574.05).20iii. Server-3 also housed a Monero wallet (“XMR Bank Wallet-1”). Based ona review of XMR Bank Wallet-1, from on or about November 9, 2020, through on or about January9, 2024, there were approximately 265,375 Monero transactions consisting of 181,918 depositsand 83,457 withdrawals. The total XMR deposited represents approximately 296,094 XMR($46,728,991), and the total Monero withdrawn represents approximately 294,634 XMR($46,482,976).

Combining BTC Bank Wallet-1 and XMR Wallet-1—“Bank Wallet-1”—indicates that from its inception to on or about January 9, 2024, Marketplace-1 generated at leastapproximately $83,624,577 in revenue, which yielded at least approximately $4,181,228 from its5% commission. A review of Bank Wallet-1 further indicates that Marketplace-1 activityincreased year over year. For example, in 2022, Bank Wallet-1 received approximately $14.8million in deposits. In 2023, Bank Wallet-1 received approximately $65.5 million in deposits.c. Using software tools, law enforcement officers reviewed the publicly availableBitcoin digital ledger and traced transactions involving BTC Bank Wallet-1. In so doing, lawenforcement officers identified a series of wallets that received the majority of funds from BTCBank Wallet-1—i.e., that received the proceeds of Marketplace-1. One such particular wallet—“Administrator Wallet-1”—received the most funds from Bank Wallet-1, over approximately 58deposits from in or about October 2021 through in or about September 2023.i. During that time period, of the approximately 58 deposits intoAdministrator Wallet-1 from BTC Bank Wallet-1, approximately 24 were whole value transfers(e.g. 1 BTC or 5 BTC as opposed to 1.789 BTC.) Based on my training and experience, the transferof whole amounts is indicative of transferring proceeds (i.e. the proceeds derived from the 5% fee)from to an administrator as a profit. This is because when transferring funds, with the purpose ofmoving them, individuals tend use simple whole numbers. On the other hand, when transferringfunds, with the purpose of purchasing items, the amounts tend to not be in whole numbers becauseprices of items are pegged to fiat currencies and cryptocurrency is highly volatile.

Further, during that time period, the vast majority of Administrator Wallet1’s funds—approximately 123.14 BTC ($3,351,343)—came from BTC Bank Wallet-1. That is,the cryptocurrency flowing into Administrator Wallet-1 is from Markerplace-1. After receivingMarketplace-1 cryptocurrency, Administrator Wallet-1 transferred it elsewhere. Specifically,from on or about March 25, 2020 through on or about October 1, 2023, Administrator Wallet-1received approximately 77 deposits of Bitcoin, totaling approximately 126.0026 BTC, and thentransferred all of it to other wallets.20 Due to the volatility of cryptocurrencies, as to all United States Dollar converted amountsherein are approximate and based on the floating exchange rate near the time of the transaction.23iii. Accordingly, Administrator Wallet-1 appears to be a “pass through” walletused to obscure the source of funds (which is Marketplace-1), while transferring thecryptocurrency to other wallets under the control of Administrator-1.

 

[Forester]

https://www.justice.gov/usao-sdny/media/1352546/dl -> page 20 onwards.

Well, really an interesting reading even from the beginning (I've skipped through it when waiting at the airport).
Thanks for sharing!

 

[JohnnyDoe]

There’s no anonymity if the physical support where your XMR wallet sits is seized. I guess that everyone already knew this.

 

[0xDEADBEEF]

Interesting read, thanks for sharing. They deanonymized the transactions based upon outgoing TXs from market wallet, so I expect more people who did not properly 'hop' their XMR to be put on the DoJ website.

As always not a problem with XMR, but with the people using it.

 

[Forester]

As always not a problem with XMR, but with the people using it.

Yes, really.

1) This is a nasty example of using BTC & XMR. But guns do not kill people; people kill people.

2) In my deep opinion, in the absolute majority of cases the most problematic segment of any IT system is between the chair and keyboard (or mouse ) – sometimes it is a developer, many times a user.

 

[jafo]

https://www.justice.gov/usao-sdny/media/1352546/dl -> page 20 onwards.

This is the 'sealed complaint' -> this is pre-indictment -> look at the data they've gleaned from that server before probable cause.

24. Based on my involvement in this investigation, my training and experience, myreview of documents and other materials, as well as my conversations with law enforcementofficers and others, I have learned the following, among other things:a. All transactions on Marketplace-1 must use Marketplace-1’s bank. As explainedabove, Marketplace-1’s “bank” enables Marketplace-1 to retail and distribute narcotics securely17 The reference to successful DDoS attack prevention may be a reference to the purposeof Server-1.
between users (e.g., buyers) and sellers (e.g., vendors). Through the bank, customers depositcryptocurrency (Bitcoin or Monero) into the customer’s Marketplace-1 bank account—essentiallya cryptocurrency wallet. Once deposited, each user’s marketplace wallet is controlled byMarketplace-1. Then, after a buyer purchases a product from a vendor (e.g., narcotics)Marketplace-1 releases funds to the vendor’s Marketplace-1 bank account. In this way,Marketplace-1 serves as a financial link between vendors and customers and in so doing providesboth parties a level of comfort that the transaction will be consummated, while also allowing theparties to maintain distance and anonymity between each other. Marketplace-1’s bank also offersan escrow service, which provides sellers and buyers further protections. The escrow service canbe set such that a buyer’s money will be released to a seller only after specified actions occur, forexample, the shipment of narcotics. With the escrow service, sellers know they will be paid fortheir illegal narcotics and buyers know their payments will be released to sellers after specifiedevents occur. Although not every transaction on Marketplace-1 uses the bank’s “escrow” services,many do.b. Law enforcement officers identified the cryptocurrency wallets that Marketplace-1uses for its bank (collectively, “Bank Wallet-1”) and uses to funnel proceeds from Marketplace-1to Administrator-1 (“Administrator Wallet-1”):

Pursuant to the January 2024 judicially authorized warrant, lawenforcement officers searched Server-3. In Server-3, law enforcement officers identified thefollowing directories (i.e. computer folder) “/root/.bitcoin/wallets/[Marketplace-1] 1/”;/root/.bitcoin/wallets/[Marketplace-1] 2/”; “/root/.bitcoin/wallets/[Marketplace-1] 3; and/root/.bitcoin/wallets/[name of a cryptocurrency tracking software promoted by Administrator-1].Each of these computer folders contains a Bitcoin wallet file. A Bitcoin wallet file is a databasethat contains public and private Bitcoin keys to a particular Bitcoin wallet. 18 Because each of theseBitcoin wallet files were found on Server-3 and are named [Marketplace-1] or the cryptocurrencytracking software promoted by Adminstraotr-1, they appear to contain Marketplace-1 assets—specifically deposits made by customers and vendors into Bank-1.19 For simplicity, these fourwallets are defined herein as “BTC Bank Wallet-1.”

At the time of the search, wallets [Marketplace-1] 1, [Marketplace-1] 2,[Marketplace-1] 3, contained most proceeds, a total of approximately 1315.6 BTC ($36.8 million)in deposits. The wallet identified as a [name of a cryptocurrency tracking software promoted byAdministrator-1] contained approximately 0.41 BTC ($11,921) in deposits. 22ii. A review of BTC Bank Wallet-1 indicates that from on or about November9, 2020 through on or about January 9, 2024, there were approximately 244,483 Bitcointransactions in and out of BTC Bank Wallet-1, consisting of approximately 183,772 deposits andapproximately 60,711 withdrawals. The total Bitcoin deposited represents approximately1,316.038719 BTC ($36,895,586.12), and the total Bitcoin withdrawn represents approximately1,303.126267 BTC ($36,431,574.05).20iii. Server-3 also housed a Monero wallet (“XMR Bank Wallet-1”). Based ona review of XMR Bank Wallet-1, from on or about November 9, 2020, through on or about January9, 2024, there were approximately 265,375 Monero transactions consisting of 181,918 depositsand 83,457 withdrawals. The total XMR deposited represents approximately 296,094 XMR($46,728,991), and the total Monero withdrawn represents approximately 294,634 XMR($46,482,976).

Combining BTC Bank Wallet-1 and XMR Wallet-1—“Bank Wallet-1”—indicates that from its inception to on or about January 9, 2024, Marketplace-1 generated at leastapproximately $83,624,577 in revenue, which yielded at least approximately $4,181,228 from its5% commission. A review of Bank Wallet-1 further indicates that Marketplace-1 activityincreased year over year. For example, in 2022, Bank Wallet-1 received approximately $14.8million in deposits. In 2023, Bank Wallet-1 received approximately $65.5 million in deposits.c. Using software tools, law enforcement officers reviewed the publicly availableBitcoin digital ledger and traced transactions involving BTC Bank Wallet-1. In so doing, lawenforcement officers identified a series of wallets that received the majority of funds from BTCBank Wallet-1—i.e., that received the proceeds of Marketplace-1. One such particular wallet—“Administrator Wallet-1”—received the most funds from Bank Wallet-1, over approximately 58deposits from in or about October 2021 through in or about September 2023.i. During that time period, of the approximately 58 deposits intoAdministrator Wallet-1 from BTC Bank Wallet-1, approximately 24 were whole value transfers(e.g. 1 BTC or 5 BTC as opposed to 1.789 BTC.) Based on my training and experience, the transferof whole amounts is indicative of transferring proceeds (i.e. the proceeds derived from the 5% fee)from to an administrator as a profit. This is because when transferring funds, with the purpose ofmoving them, individuals tend use simple whole numbers. On the other hand, when transferringfunds, with the purpose of purchasing items, the amounts tend to not be in whole numbers becauseprices of items are pegged to fiat currencies and cryptocurrency is highly volatile.

Further, during that time period, the vast majority of Administrator Wallet1’s funds—approximately 123.14 BTC ($3,351,343)—came from BTC Bank Wallet-1. That is,the cryptocurrency flowing into Administrator Wallet-1 is from Markerplace-1. After receivingMarketplace-1 cryptocurrency, Administrator Wallet-1 transferred it elsewhere. Specifically,from on or about March 25, 2020 through on or about October 1, 2023, Administrator Wallet-1received approximately 77 deposits of Bitcoin, totaling approximately 126.0026 BTC, and thentransferred all of it to other wallets.20 Due to the volatility of cryptocurrencies, as to all United States Dollar converted amountsherein are approximate and based on the floating exchange rate near the time of the transaction.23iii. Accordingly, Administrator Wallet-1 appears to be a “pass through” walletused to obscure the source of funds (which is Marketplace-1), while transferring thecryptocurrency to other wallets under the control of Adm

Rui-Sang Lin is an idiot who opened his mouth (There are NO mutes in prison EVER ), and they SNITCHED him out! It's as simple as that!
He won't go to trial, but if he did, they would bring out his accuser(s) who is getting a reduction of sentence or (the inclusive or) a reward.

Source: https://www.state.gov/inl-rewards-program/narcotics-rewards-program/

Poor guy is only 23. He has NO idea that in the Criminal Justice System, the REAL criminals live, and it is RULED by the worst criminals. They eliminate ALL competition.

PS. Notice: ONLY the West, particularly the USA, is going after these guys and robbing them blind.

PSS. The Chinese looking at the West for torturing China during the Century of humiliation and the Opium Wars and asking: Whhhaaaaaaatttttttt?

PSSS. That indictment is so amateurish and a total POS. If I got to cross-examine that so-called expert, Mark Rubens, he would be toast, but most people aren't smart enough or interested enough to try to understand that he is just full of sh1t!

EDIT: There are NO mutes in Prison EVER!

"others known" are those who snitched on Rui-siang Lin. The rest of the words are just BS to justify siphoning, looting, and "embezzling" taxpayers' funds to their "friends and future colleagues/employers." Don't be fooled. I've seen this movie way TOO many times.

 

[ActionMan]

View attachment 6898

Rui-Sang Lin is an idiot who opened his mouth (There are NO mutes in prison EVER ), and they SNITCHED him out! It's as simple as that!
He won't go to trial, but if he did, they would bring out his accuser(s) who is getting a reduction of sentence or (the inclusive or) a reward.
View attachment 6899
Source: https://www.state.gov/inl-rewards-program/narcotics-rewards-program/

Poor guy is only 23. He has NO idea that in the Criminal Justice System, the REAL criminals live, and it is RULED by the worst criminals. They eliminate ALL competition.

PS. Notice: ONLY the West, particularly the USA, is going after these guys and robbing them blind.

PSS. The Chinese looking at the West for torturing China during the Century of humiliation and the Opium Wars and asking: Whhhaaaaaaatttttttt?

PSSS. That indictment is so amateurish and a total POS. If I got to cross-examine that so-called expert, Mark Rubens, he would be toast, but most people aren't smart enough or interested enough to try to understand that he is just full of sh1t!

EDIT: There are NO mutes in Prison EVER!
View attachment 6900
"others known" are those who snitched on Rui-siang Lin. The rest of the words are just BS to justify siphoning, looting, and "embezzling" taxpayers' funds to their "friends and future colleagues/employers." Don't be fooled. I've seen this movie way TOO many times.

I don't think this guy opened his mouth, he is greedy, stupid and to be honest, still young with millions of dollars.

He sold 300 XMR just 35 minutes after receiving 304 XMR in an instant exchange. Presumably, he converted KYCed BTC (registered in his name) to 304 XMR and then sold 300 XMR on a centralized exchange like Kraken. He should have known about time-correlation attacks, which can be used to identify individuals. and while it's easier to track pseudonymous coins like BTC and ETH, it's not impossible for privacy coins like XMR.

Yes, the main reason they caught him was identifying his IM BTC, which is a big mistake in that market, but selling that much XMR after 35 minutes only, just what was he thinking.

Additionally, when he was busted, he already had millions of dollars on his KYCed crypto exchange account, wo why selling now? when you have that much money with you!?


It seems he didn't even consider how the authorities could trace his actions. what an idiot

 

[wellington]

It seems he didn't even consider how the authorities could trace his actions. what an idiot

I guess another thing is he was obviously doing business and visiting the US, and banking or using companies in the US to layer/launder his funds.

I remember having a conversation in 2020 with a Professor in Australia on HYIPs / Yield Farming / MLM-Ponzi's in crypto, he was constantly going on about them, and i got rather bored and bluntly pointed out, they are 10 a penny, it's whack-a-mole and they will pop up 100 for every 1 taken down - hence 10m tokens exist off which the vast majority would be overnight ponzis, i pointed ou there just isn't the ability to police a US centric fraud scheme like a ponzi scheme (most of us outside of the US never really heard off until 2016 when the US devs started launching them en-mass) - and that the foolishness of it was they targeted the US, instead of targeting Chinese citizens in China and living in some non-China friendly nation (obviously not the US) like how the Russian hackers do...

To this day i am amazed i see it so often Thai gambling with the people behind living in Thailand or neighbouring states, Americans targeting Americans in their crypto-ponzi's etc.

Moral of that story in-line with the comment quoted - don't s**t where you eat, and don't s**t in the backyard of the US.

 

[ActionMan]

I guess another thing is he was obviously doing business and visiting the US, and banking or using companies in the US to layer/launder his funds.

I remember having a conversation in 2020 with a Professor in Australia on HYIPs / Yield Farming / MLM-Ponzi's in crypto, he was constantly going on about them, and i got rather bored and bluntly pointed out, they are 10 a penny, it's whack-a-mole and they will pop up 100 for every 1 taken down - hence 10m tokens exist off which the vast majority would be overnight ponzis, i pointed ou there just isn't the ability to police a US centric fraud scheme like a ponzi scheme (most of us outside of the US never really heard off until 2016 when the US devs started launching them en-mass) - and that the foolishness of it was they targeted the US, instead of targeting Chinese citizens in China and living in some non-China friendly nation (obviously not the US) like how the Russian hackers do...

If done correctly and with good operational security (OPSEC), having U.S. businesses can actually be advantageous. It simplifies matters when dealing with business in the U.S.

But True, I have noticed a pattern that often more than not, Ponzi schemes (in particular HYIPs) usually targets lower classes who seeks that easy retruns, and it didn't really matter where the money comes from, as long as they see $100 in and $130 out. you will find this widely spread in LATAM, MENA, ASEAN as well as african countries.

This goes for elderly people as well, but it's mostly Indians and Nigerians who opt for this kind of scam, and they never travel or go anywhere lese beside their country, India for example, is vast and has lots of beautiful spots, so why bother travelling outside.

To this day i am amazed i see it so often Thai gambling with the people behind living in Thailand or neighbouring states, Americans targeting Americans in their crypto-ponzi's etc.

Moral of that story in-line with the comment quoted - don't s**t where you eat, and don't s**t in the backyard of the US.

I suppose it comes down to cultural familiarity. Americans understand their fellowmen's' culture and habits better, just as Thai people understand theirs, and this applies to any group. That's why they operate this way.

 

[0xDEADBEEF]

I don't think this guy opened his mouth, he is greedy, stupid and to be honest, still young with millions of dollars.

He sold 300 XMR just 35 minutes after receiving 304 XMR in an instant exchange. Presumably, he converted KYCed BTC (registered in his name) to 304 XMR and then sold 300 XMR on a centralized exchange like Kraken. He should have known about time-correlation attacks, which can be used to identify individuals. and while it's easier to track pseudonymous coins like BTC and ETH, it's not impossible for privacy coins like XMR.

Yes, the main reason they caught him was identifying his IM BTC, which is a big mistake in that market, but selling that much XMR after 35 minutes only, just what was he thinking.

Additionally, when he was busted, he already had millions of dollars on his KYCed crypto exchange account, wo why selling now? when you have that much money with you!?


It seems he didn't even consider how the authorities could trace his actions. what an idiot

It's all pretty circumstantial, which is why a witness could really strengthen the DA's case. He might not have outright confessed, but he probably slipped up somewhere along the line. Darknet markets usually have an admin and a bunch of support people. If someone has a big enough ego, they'll eventually reveal too much.

Think about it, he's a 23-year-old kid managing a million-dollar underground operation while still in school. He might have bragged to someone, making them jealous enough to testify. The DA just needs a presentable case and will gladly share some of their winnings with the good samaritan.

Matching controlled buys with XMR wallet balances helps narrow down the investigation, making it easier to trace his actions, but still they need to have a direct TX to link him. In these cases, I just assume they will find a way to at least slap him with money laundering and find a way to make it about r*ping American citizens so that the idea of trial scares the monkeys doing rhetoric.

PSSS. That indictment is so amateurish and a total POS. If I got to cross-examine that so-called expert, Mark Rubens, he would be toast, but most people aren't smart enough or interested enough to try to understand that he is just full of sh1t!

I will gladly pay you instead of a lawyer if push comes to shove.

 

[diatessaron]

. LIN Used Administrator Wallet-1 to Purchase an Internet Domain. As described below, Administrator Wallet-1 was used to purchase a domain registered to LIN.

Namecheap Account-1 appears to be LIN’s Namecheap account. Namecheap Account-1 is registered to “RuiSiang Lin,”using a particular phone number with a Taiwanese country code (“Phone Number-1”), a physical address in Taipei, Taiwan, and a particular email address, which contains in its username the text “ruisiang” (“Lin Personal Email Account-1”).2

On or about October 4, 2023, “RUISIANG LIN” with the alias “林睿庠” applied for a visa to enter the United States. In the application, LIN provided Phone Number-1 as his phone number and Lin Personal Email Account-1 as his email address.

LIN Has the Required Technical Knowledge. Based on publicly availableinformation, LIN appears to have the requisite technical knowledge and experience to operate and manage a complex darknet market such as Marketplace-1.

Meow. (context:

)

 

[jafo]

I don't think this guy opened his mouth, he is greedy, stupid and to be honest, still young with millions of dollars.

I guess another thing is he was obviously doing business and visiting the US, and banking or using companies in the US to layer/launder his funds

Meow. (context:

)

100% several witnesses testified against him in a Grand Jury proceeding. Same "witnesses" (read snitches) who convinced him to fly to the US.
It's beyond unbelievable. I can't even go into it. You won't believe me anyway. You'll only believe me if you go through an indictment, the BOP, and a jury trial, but then you won't believe me; we'll just agree with each other.

I understand your incredulity! Your mind wants justice and courts to make sense. This reveals a reasonable person. Sadly, that is NOT reality.
It took me a while, too, to come to grips with reality, and I was in the middle of it for decades.

Source: Charging

The following is a heartbreaking video of a prosecutor who lashed out at the system. She did NOT realize how bad the system is UNTIL AFTER she became a target of the system! It's sad, but she explains it pretty well:

PS. Ike was heavily penalized by the Bar for making this video. Heavily!

PSS. I really can't go too much into it because I may be violating specific laws, and I really don't want to play a game of jury trial again where the opponents' losses end up in promotions at the expense of taxpayers. It's too negative and unproductive.

PSSS. All that "evidence"...it's called parallel construction in the Feds/Courts. Google it.

 

[0xDEADBEEF]

Update: A couple months ago I read some stories about a darknet market that pulled an exit scam. Turns out, it's the same market this guy was allegedly running.

Check out the details here: Krebs on Security - Incognito Darknet Market Mass Extorts Buyers and Sellers

Looks like he's screwed even more than we thought now that the DoJ has doxxed the kid.