Three Germans Who Allegedly Operated Dark Web Marketplace with over 1 Million Users Face U.S. Narcotics and Money Laundering Charges

SACRAMENTO, Calif. — Following a nearly two-year international investigation involving U.S. law enforcement and authorities in Germany and the Netherlands, federal prosecutors have charged three German nationals with being the administrators of Wall Street Market (WSM), which was one of the world’s largest dark web marketplaces that allowed vendors to sell a wide variety of contraband, including an array of illegal narcotics, counterfeit goods and malicious computer hacking software. A Brazilian national was also charged for allegedly acting as a moderator for WSM.

A criminal complaint filed Wednesday in United States District Court in Los Angeles alleges that the three defendants, who currently are in custody in Germany, were the administrators of WSM, a sophisticated online marketplace available in six languages that allowed approximately 5,400 vendors to sell illegal goods to about 1.15 million customers around the world. Like other dark web marketplaces previously shut down by authorities — SilkRoad and AlphaBay, for example — WSM functioned like a conventional e-commerce website, but it was a hidden service located beyond the reach of traditional internet browsers, accessible only through the use of networks designed to conceal user identities, such as the Tor network.

For nearly three years, WSM allegedly was operated on the dark web by the three men who now face charges in both the United States and Germany. An “exit scam” was allegedly conducted last month when the WSM administrators took all of the virtual currency held in marketplace escrow and user accounts – believed by investigators to be approximately $11 million – and then diverted the money to their own accounts. Exit scams are common among large darknet marketplaces, which typically hold money in escrow while a vendor delivers illicit goods.

A defendant linked to Wall Street Market was charged yesterday in a criminal complaint filed in U.S. District Court in Sacramento. Marcos Paulo De Oliveira-Annibale, 29, of Sao Paulo, Brazil, also faces federal drug distribution and money laundering charges for allegedly acting as a moderator who, among other things, mediated disputes between vendors and their customers. Annibale, who used the online monikers “MED3LIN,” also acted as a public relations representative for WSM by, among others things, promoting WSM on websites such as Reddit, according to the complaint. The case naming Annibale was unsealed today when Brazilian authorities executed a search warrant at his residence.

The three defendants arrested in Germany on April 23 and 24 and charged in the United States are a 23-year-old resident of Kleve, Germany; a 31-year-old resident of Wurzburg, Germany; and a 29-year-old resident of Stuttgart, Germany. The complaint charges the men with two felony counts – conspiracy to launder monetary instruments, and distribution and conspiracy to distribute controlled substances. These defendants also face charges in Germany.

The two cases filed in the United States are the result of an investigation by the Federal Bureau of Investigation, the Drug Enforcement Administration, the U.S. Postal Inspection Service, IRS Criminal Investigation, and Homeland Security Investigations.

“We are on the hunt for even the tiniest of breadcrumbs to identify criminals on the dark web,” said U.S. Attorney McGregor W. Scott for the Eastern District of California. “The prosecution of these defendants shows that even the smallest mistake will allow us to figure out a cybercriminal’s true identity. As with defendant Marcos Annibale, forum posts and pictures of him online from years ago allowed us to connect the dots between him and his online persona ‘Med3l1n.’ No matter where they live, we will investigative and prosecute criminals who create, maintain, and promote dark web marketplaces to sell illegal drugs and other contraband.”

“We continue to keep pace with sophisticated actors on the dark web by increasing our technical abilities and working even more closely with our international law enforcement partners,” said U.S. Attorney Nick Hanna. “While they lurk in the deepest corners of the internet, this case shows that we can hunt down these criminals wherever they hide.”

“Just as international law-enforcement partners began dismantling Wall Street Market and taking action against its members, as alleged in the complaint, the site’s administrators decided to steal their customers’ money via an exit scam,” said Assistant Attorney General Brian Benczkowski.  “This operation sends a crystal-clear message: dark markets offer no safe haven.  The arrest and prosecution of the criminals who allegedly ran this darknet marketplace is a great example of our partnership with law enforcement authorities in Europe, with the support of Europol, and demonstrates what we can do when we stand together.”

“Investigators from many countries overcame the national, legal and diplomatic challenges to hold accountable sophisticated actors who operated one of the largest known encrypted marketplaces in the shadowy environment of the Darknet,” said Assistant Director Paul Delacourt of the FBI’s Los Angeles Field Office. “This case is an example of successful global collaboration among law enforcement entities who share the many challenges of prosecuting transnational criminal activity conducted by individuals who operate anonymously across borders.”

The affidavit in support of the criminal complaint filed in Los Angeles outlines how the defendants operated a sophisticated online marketplace that offered encrypted communications between buyers and sellers, as well as an online forum to discuss vendors and the quality of their wares. The affidavit also describes an international investigation that was able to identify the three administrators of WSM, show how they previously operated another German-based darknet marketplace that shut down in 2016, and link them to computer servers in Germany and the Netherlands that were used to operate WSM and process virtual currency transactions.

The three defendants allegedly created WSM, maintained the website, and operated the marketplace to ensure that buyers could access vendor pages and that financial transactions were properly processed. The investigation outlined in the complaint affidavit linked the three defendants to WSM in a number of ways, including their access to the WSM computer infrastructure. One defendant, for example, used virtual private networks to access WSM computers, but when a VPN connection would fail, his IP was revealed and authorities were able to identify his specific location.

The three defendants charged in Los Angeles were arrested in Germany after the WSM administrators conducted an exit scam in the wake of WSM recently becoming regarded as the world’s pre-eminent dark web marketplace and gaining a significant influx of new vendors and users, according to the affidavit. On April 16, vendors realized they could not collect the virtual funds that had been placed in escrow by their customers, which prompted German authorities to execute a series of arrest and search warrants.

The complaint affidavit identifies several cases that have been filed in the United States against WSM vendors. One darknet vendor who advertised on WSM is currently serving a 12‑year federal prison sentence after being convicted in the Western District of Wisconsin for distributing a fentanyl analogue resulting in the overdose death of a Florida resident who ordered a nasal spray laced with the powerful opioid from the vendor.

Other defendants include Jose Robert Porras III, 21, and Pasia Vue, 23, both of Sacramento, who were charged with drug distribution, money laundering, and illegally possessing firearms, in a 16-count indictment returned by a grand jury in the Eastern District of California. According to the indictment, Porras and Vue were using the online monikers “Cannabars” and “TheFastPlug,” to distribute marijuana, Xanax, and methamphetamine on various dark web marketplaces, including Wall Street Market.

“The dark web marketplace, Wall Street Market, was one of the largest operating hosts for vendors peddling illegal wares,” said DEA San Francisco Special Agent in Charge Chris Nielsen. “Law enforcement is always adapting to changes in technology and this case sends a clear message to those breaking the law and attempting to hide behind the illusion of anonymity – we will identify and find you. The success of this case is due to the excellent cooperation between law enforcement agencies from around the globe who delivered another blow to criminal networks operating in the underground cyberspace.”

“Anyone who thinks the dark web is a safe place to conduct illegal commerce should know they are not anonymous,” said Inspector in Charge Michael Ray of the Postal Inspection Service. “They will be found and they will be brought to justice. The Postal Inspection Service has a highly trained, skilled and committed cyber unit that works tirelessly with other law enforcement agencies to disrupt marketplaces and stop vendors from using the U.S. mail to ship illegal goods and dangerous drugs.”

“Taking down this site is a huge win for past and future victims of crimes perpetrated due to the proliferation of illegal products and services being sold,” said Chief Don Fort of IRS Criminal Investigation. “We are committed to using our unique financial investigative abilities to tackle these kinds of threats head on to protect citizens, to promote cyber security and to inform the global community.”

“HSI and our partners are at the forefront of combating narcotics trafficking, financial crimes and illicit activities purveyed by online black markets,” said HSI Acting Executive Associate Director Alysa D. Erichs. “While criminal operators may continue to grow the reach of their businesses through these dark web marketplaces, ultimately they do not escape the reach of law enforcement. We continue to investigate, disrupt, and dismantle hidden illegal networks that pose a threat in cyberspace.”

The charges against the three WSM administrators were announced today in conjunction with authorities in Germany and the Netherlands.

The cases in the United States are being prosecuted by Assistant U.S. Attorney Grant Rabenn of the Eastern District of California, Assistant U.S. Attorneys Ryan White and Puneet Kakkar of the Central District of California, Justice Department Trial Attorney C. Alden Pelker of the Criminal Division’s Computer Crime and Intellectual Property Section, and Justice Department Trial Attorney Joseph Wheatley of the Criminal Division’s Organized Crime and Gang Section.

The U.S. investigation was conducted with support and coordination provided by the Department of Justice’s multi-agency Special Operations Division.

The Justice Department thanks its law enforcement colleagues at the German Federal Criminal Police (the Bundeskriminalamt), the German Public Prosecutor’s Office in Frankfurt, the Dutch National Police (Politie), the Netherlands National Prosecutor’s Office, Federal Police of Brazil (Policia Federal), Europol and Eurojust. Significant assistance was provided by the Office of International Affairs at the Justice Department and the Organized Crime and Drug Enforcement Task Force program.

The charges are only allegations; the defendants are presumed innocent until and unless proven guilty beyond a reasonable doubt.