How Did Investigators Identify AlphaBay's Founder?

TL;DR

Investigators identified AlphaBay founder Alexandre Cazes through a welcome email whose metadata exposed an old personal address. That address connected his pseudonym to social media, a technology forum, PayPal, LinkedIn, and ultimately Thailand, where authorities tracked his properties, vehicles, phone, and daily routines while preparing an arrest operation.

Transcript

On the morning of July 5th, 2017, a man sits in front of his laptop in his villa in Bangkok. Online he is only known under a pseudonym: Alpha02 He is a multi-millionaire, lives a luxurious life and drives expensive cars. He feels safe in Thailand. Suddenly, he hears a loud bang in front of his house. A woman crashed her Toyota Camry into his front ... Read More

Key Insights

• AlphaBay was launched five months after Alpha02 began developing it in July 2014, entering a market shaped by the closure of Silk Road, the failure of Silk Road 2.0, Evolution's exit scam, and Agora's voluntary withdrawal.
• AlphaBay operated like a conventional online marketplace, offering searches, filters, categories, dispute moderation, and cryptocurrency payments while facilitating the sale of drugs, weapons, malware, stolen data, logins, and services such as money laundering.
• AlphaBay had more than 200,000 registered users and 40,000 sellers barely a year after its founding, then grew to over 300,000 listed items and more than half a million dollars in daily sales by 2017.
• Alpha02 earned a 2 to 4 percent share from every transaction, allowing him to become a multimillionaire and maintain an expensive lifestyle that included several properties and cars, including a Lamborghini and a Porsche Panamera.
• Tor made conventional tracing difficult because website requests passed through multiple servers around the world, so investigators instead bought drugs anonymously and examined packaging and postage for errors that might identify sellers.
• The investigative breakthrough was an early AlphaBay welcome email whose metadata displayed the sender address [email protected], an operational mistake that had been corrected but preserved by an anonymous tipster and later sent to the DEA.
• The exposed email address connected Alpha02 to old photographs, a dating profile, a French-language technology forum post, PayPal, LinkedIn, and the full name Alexandre Cazes, transforming an anonymous identity into a traceable person.
• Thai and American authorities linked Cazes to Bangkok through his fiancée's Facebook profile, identified properties associated with him, tracked his iPhone and driving routes, and studied his daily routines while planning how to arrest him.

Questions & Answers

Q: How did investigators identify the founder of AlphaBay?

Investigators identified AlphaBay's founder through an early welcome email preserved by an anonymous tipster. The email metadata exposed the sender address [email protected]. Searches tied that address to old photographs, a dating profile, and a French-language technology forum post containing the username Alpha02 and the full name Alexandre Cazes. PayPal, LinkedIn, and Facebook then helped connect Cazes to Thailand.

Q: What was AlphaBay and what did it sell?

AlphaBay was a dark web marketplace developed by a person using the name Alpha02 and launched five months after development began in July 2014. It initially sold stolen credit card data, then expanded to drugs, weapons, malware, other data, logins, and money-laundering services. The site resembled Amazon by providing categories, search functions, filters, cryptocurrency payments, and moderators for buyer and seller disputes.

Q: Why did AlphaBay become the dominant dark web market?

AlphaBay benefited as competing markets disappeared through arrests, hacks, exit scams, and voluntary closures. It also offered a user-friendly marketplace with searches, filters, categories, dispute handling, and payments using Bitcoin, Monero, or Ethereum. While rival platforms appeared and vanished, AlphaBay remained operational and expanded rapidly, reaching more than 200,000 registered users and 40,000 sellers barely a year after its founding.

Q: How large was AlphaBay by 2017?

By 2017, AlphaBay had over 300,000 items listed on its website and recorded more than half a million dollars in sales every day. Earlier, barely a year after its founding, it already had more than 200,000 registered users and 40,000 sellers. The founder received a 2 to 4 percent share from each transaction, which helped make him a multimillionaire.

Q: Why was AlphaBay difficult for authorities to investigate?

AlphaBay operated within Tor, where website requests were routed through multiple servers around the world. This design made tracing the locations of servers, operators, sellers, and users deliberately difficult. Investigators therefore browsed the marketplace and purchased drugs anonymously, hoping packaging or postage would reveal seller mistakes. Those efforts could identify individual dealers, but investigators considered them small participants compared with Alpha02.

Q: What operational security mistake exposed Alpha02?

Alpha02's crucial mistake occurred during AlphaBay's early period, when welcome emails sent to newly registered users exposed the true sender address in their metadata. Although the problem was corrected quickly, an anonymous person retained one of those messages. In December 2016, the preserved address reached DEA investigator Robert Miller and gave authorities the breakthrough needed to trace Alpha02's earlier online activity.

Q: How did the email address lead investigators to Alexandre Cazes?

The exposed Hotmail address led investigators to photographs from 2008 and 2009 on the French-language platform Skyrock.com and to an old dating profile listing Trois-Rivières in Quebec as Alex's hometown. The same address appeared beneath a 2008 technology forum post using Alpha02 and displaying the full name Alexandre Cazes. Related PayPal and LinkedIn records revealed his software work and EBX Technologies.

Q: How did authorities locate and monitor Alexandre Cazes in Thailand?

Investigators found the Facebook profile of Cazes's Thai fiancée, which suggested that the Canadian lived in Thailand. With Thai authorities, they identified three Bangkok properties associated with him, including his home in a gated community and a mansion outside the city. Agents then followed his routes, tracked his iPhone, observed his cars and relationships, and documented his routines while planning the arrest.

Summary & Key Takeaways

• AlphaBay emerged after arrests, scams, hacks, and voluntary shutdowns weakened earlier dark web markets. Launched five months after development began in July 2014, it expanded from stolen credit card data into drugs, weapons, malware, money laundering, and other illicit products and services, supported by familiar shopping features and cryptocurrency payments.

• By 2017, AlphaBay listed over 300,000 items and generated more than half a million dollars in daily sales. Its founder, Alpha02, received a 2 to 4 percent share of transactions, became a multimillionaire, delegated operations to a team, renamed himself Admin, and communicated through representative DeSnake.

• Investigators struggled because Tor obscured server and user locations, while anonymous purchases mostly produced leads on individual dealers. Their breakthrough came from an early welcome email exposing a personal Hotmail address. Its online history revealed Alexandre Cazes, connected him to Thailand, and enabled authorities to study his properties, vehicles, phone, and routines.