The Hunt for the Kingpin Behind AlphaBay, Part 3: Alpha Male – WIRED

He described how he would explain to the Thai women he seduced that he was of a higher social class than them and they were lucky to have his attention, even briefly. “Once she started showing ‘strong personality’ I had to let her go,” he wrote of one woman. In another post, he counseled his fellow alphas to seek out single mothers for easy sex, but never a longer-term relationship. “Not interested in being a cuckold before even having started the relationship, but for the bang, it can be good,” he wrote. “Just let out a ‘fatherly’ vibe and you’re in.”

Cazes, like many Roosh V members, was obsessed with the threat of false rape allegations. He boasted of his solution, one that, for someone obsessed with privacy, was a shocking admission. “I secretly record EVERY new sex intercourse with a girl with a hidden camera in my room,” he wrote. “This is stored on an encrypted hard drive, ready to be pulled in case the shit hits the fan. If nothing bad happens, nobody will ever know that the video exists. I respect my girls’ privacy.”

In other posts, Rawmeo explained that he was married and in fact loved his wife, who was pregnant with their first child. He described her as possessing “everything a wife needs to have: virgin, well preserved body, university degree, complete family, no LGBT in social circle, cooks for me, doesn’t complain.” He said he kept tight control of her financially, storing most of his money in cryptocurrency, cashing out only what he needed, and never revealing his full net worth.

In some respects, Cazes was as privacy-minded as Rawmeo as he was as AlphaBay’s boss. He had fully compartmentalized his life, sealing off his philandering from his family almost as completely as he’d sealed off his Alpha02 persona from his real-world identity. “I am what we call a professional cheater,” he wrote. He kept his wife ignorant of the second home he used for sex. He maintained fake IDs to prevent his “plates” from learning his real name. He even used separate phone numbers for his different personas’ communications and bragged that he spoofed the IMEI identifiers a phone carrier can use to link two numbers on the same device, even when the SIM card has been swapped.

“I have a completely different identity with my plates,” he wrote, “and there’s no way that my two lives can be linked together.”

Among the global group of agents now assigned to the AlphaBay case, no one spent more time with Rawmeo than Jen Sanchez of the Bangkok Drug Enforcement Administration office. She read and reread his every Roosh V message with morbid fascination, amazed by the lurid details of his sexual escapades and marveling at the hypocrisy of his commentary. “I strongly favor ethics rather than money,” wrote the drug kingpin and obsessive womanizer, explaining his decision not to do web design work for “social justice warrior” customers or rent his real estate properties to LGBTQ couples for weddings. “It is important to follow our principles even if it implies a loss.”

Sanchez’s central task in the AlphaBay case wasn’t to catalog Cazes’ affairs, of course, but to trace his financial assets. She mapped out his four homes in Bangkok—his bachelor pad, his primary residence, another for his in-laws, and his mansion under renovation—as well as his $6 million, five-bedroom seaside villa in Phuket, his two sports cars and motorcycle, and even the Mini Cooper he’d bought for his wife. Despite years tracking corrupt politicians and organized criminals, she was amazed by Cazes’ casual extravagance. In one email, a complaint he’d sent to his favorite rooftop restaurant, Sirocco, about disappointing service, he mentioned in passing that he’d spent roughly $120,000 at the restaurant in just the previous two months.

At another point in their daily surveillance, Sanchez’s supervisor, Wilfredo Guzman, and the Thai police watched Cazes enter a Mail Boxes Etc. store to ship a package of documents. The police intercepted it after he left and found inside an application for economic citizenship in Cyprus, one of several countries where he sought to cache his wealth and perhaps find a safe haven, should the Thai authorities get on his trail. The documents provided a detailed accounting of Cazes’ finances, helping Sanchez track down bank and cryptocurrency exchange accounts in not only Thailand but Lichtenstein and Switzerland, as well as millions of dollars in real estate investments in Cyprus. Later, she found yet another property in the Caribbean island nation of Antigua and Barbuda.

But as she carried out that financial tracing, Sanchez found herself becoming more and more obsessed with Cazes’ Roosh V persona and the view into his personal life it offered. She discovered, just as tellingly, that his posts as Rawmeo revealed exactly when Cazes was online. A small gray figurine on Roosh V users’ profiles, next to their usernames, would turn green if they were active on the site. When she saw that figure light up next to Rawmeo’s name, she knew she was watching Cazes in real time, practically looking over his shoulder, into a part of his life he still believed to be secret.

In some cases, Sanchez’s online surveillance and the work of agents physically watching Cazes could now match up his real-world behavior with his online confessional. Guzman and the Thai police, following Cazes and tracking his cell phone location, would see Cazes pick up a young woman from a 7-Eleven, take her to his bachelor pad, and disappear inside. The next day, almost without fail, Sanchez would see Cazes describe in detail on Roosh V the sex he’d had with the woman. It was as if they now had eyes not only on Cazes’ movements but into the private recesses of his mind.

Into one recess of his mind at least. Cazes was careful never to give any hint on Roosh V of his other secret life as AlphaBay’s creator. But his writing on the forum nonetheless displayed, Sanchez came to believe, a deep psychological portrait. He wrote in one post, for instance, of his childhood and how his parents’ separation had affected him. “My father was pretty alpha, but he was absent,” Cazes wrote. “He tried hiring the best lawyers to fight for custody, but because of equality, i was able to see him 4 days per month. He got dumped by my mother when I was around 19 months old, because she found someone more exciting—who dumped her 1 year after.”

Cazes complained that because he never had a chance to live with his father as a child, he’d been denied masculine experiences until the age of 18. He listed these essential male activities with bullet points. “Using a chainsaw, driving a motorcycle, go-kart racing, approaching girls, changing a tire. All this stuff had to be learned from scratch,” he lamented.

To Sanchez, this was Alpha02’s origin story. She read it, perhaps a bit reductively, as the self-portrait of a man overcompensating, blaming his mother for what he perceived as his lack of masculinity, seeking in his adult life to become the ultimate “alpha” male.

Another autobiographical document the investigators dug up seemed to capture Cazes’ lifelong feeling of being an outsider, smarter than most everyone around him but struggling to find his place in society. Cazes had filed an official form with the government of Grenada, another country where he was seeking economic citizenship, in which he described his work history. It offered in abbreviated, blunt terms his life story, from skipping the second grade at his elementary school in Trois-Rivières—“due to being too ‘advanced’ in regards to the rest of the class”—to dropping out of college and his attempts to find a normal job.

He wrote that he had worked, for instance, at McDonald’s part-time for a few months during his first year of college but was fired “for not fitting in the gang.” He was fired from another Quebecois chain restaurant the next year for, he noted, “excessively eating on the job.” Cazes found another job at an insurance company for a few months but left “because the pay was too low and the work hours too long.” He wrote that he was fired from yet another job at a Canadian telecom firm for, again, “not fitting in the gang.” And yet another summer job between college semesters lasted only a month because “one of the shareholders hated me for having got the job without a diploma,” he wrote, “and I got fired when they found out that I was seeing his wife.”

Sorting through the detritus of Cazes’ private life could seem almost voyeuristic at times, Sanchez admits. But it wasn’t merely a distraction. Occasionally, amid all his prurient and sordid posts, the investigators would find a gem of precious information for their case.

One such morsel appeared in a Roosh V thread in which members of the forum were debating Windows versus Mac operating systems. Cazes, a talented programmer and IT administrator who would never miss an opportunity to one-up his fellow alphas, chimed in to describe his personal computer setup: He ran Linux, the “Cadillac” of operating systems, he said. What’s more, he described how he used LUKS encryption, or Linux Unified Key Setup, a free encryption tool specific to Linux that would securely scramble his laptop’s entire hard disk whenever he so much as closed the lid of his machine. Without his pass phrase, not even the world’s most powerful supercomputers could crack that encryption within many lifetimes.

For the team of investigators now close on Cazes’ heels, this had enormous implications. They knew from cases like the takedown of Silk Road that there were three central components to a truly successful dark-web bust. To have dead-to-rights evidence of their target’s guilt, they would need to seize AlphaBay’s servers, arrest its administrator, and access his laptop.

Now, when they came for that laptop’s secrets, they knew exactly what to expect. Just as the FBI had snatched Ross Ulbricht’s laptop from across the table where he was working in a public library, they understood they’d need to seize Cazes’ computer while he was using it if they wanted to capture it in an unencrypted state.

This presented a daunting challenge: Based on their physical surveillance of Cazes, he never seemed to log in to AlphaBay from anywhere other than his home. He had learned, it seemed, some lessons from his dark-web predecessor.

The team was six months into the AlphaBay investigation, and they had Alpha02 in their sights, practically within their grasp. But if they couldn’t also lay hands on his laptop in a live, open state, his most incriminating secrets would remain eternally locked inside it.

In may 2017, a core team of AlphaBay investigators—including Rabenn, Hemesath, Miller, and the prosecutor Louisa Marion from the Department of Justice’s computer crimes unit—convened at the US attorney’s office in Sacramento to review the mountain of evidence they’d accumulated. The question of the day: Were they ready to indict Alexandre Cazes?

For about an hour, as the agents and prosecutors talked over piles of bank documents, crypto exchange records, and social media clues, Hemesath remained bent over his laptop, silently typing. Some around the conference table wondered whether the Sacramento prosecutor, who had a reputation for professorial eccentricity, was rudely doing other work or answering emails in the midst of their meeting.

Then Hemesath suddenly broke in to show what he’d assembled: He connected his laptop to a large monitor on the wall and displayed a graphic to the room. It showed a flowchart, a tangle of nodes and lines that he’d illustrated. Each node represented a piece of evidence, with the lines between them indicating blockchain connections from Chainalysis’ Reactor software, traditional payments they’d tracked, and usernames and email addresses they’d linked to their target. On the left was the name Alexandre Cazes, the real-world person. On the right was Alpha02. Some lines meandered through multiple nodes, but every line began with Cazes, branched out into the mess of his online life, and then converged on his dark-web persona.

It was no smoking gun. For that, they’d still need to catch Cazes with his hands on the keyboard. But looking at the chart, summing up the totality of Cazes’ opsec failures and the indelible tracks he’d left across the blockchain, the group agreed. He was no patsy; these were no coincidences.

They had found Alpha02, and they were ready to charge him; the scrappy team from a dusty city in the Central Valley was now on track to bring down a kingpin. They had no idea, however, that the scope of their operation was about to expand dramatically yet again, thanks to another small group of police in a tiny country 5,000 miles to the east.

CHAPTER 7

HANSA

Around the same time that spring, in a long, black, four-story office building flanked by forest and highway in the leafy central Netherlands town of Driebergen, a secret began to spread among the Dutch National Police: The Americans were close to executing the biggest dark-web takedown in history.

Not long after the US team had been tipped off to AlphaBay’s Netherlands IP address, the FBI had discreetly alerted the Dutch that the bureau might soon need their cooperation to surveil and eventually seize an AlphaBay server hosted in their country.

The news that the United States was seeking to bust the world’s largest dark-web market soon reached one group of Dutch agents for whom this represented an intriguing coincidence. They were already deep in pursuit of a site that was quickly growing into the world’s second-largest dark-web market. And they began to wonder whether there might be an opportunity to make this confluence of events work in their favor.

Since the fall of 2016, a newly formed team of investigators at the Dutch National Police’s Driebergen office had been circling a dark-web drug market called Hansa. While far smaller than AlphaBay, Hansa had thousands of vendors and tens of thousands of listings for every narcotic imaginable. The Dutch investigation into Hansa had started with a tip from a security firm called Bitdefender, sent to the European police cooperation agency Europol. The company had found what appeared to be a Hansa server, also in a Dutch data center. Though the main server actively running Hansa’s market was protected by Tor and hadn’t been found, this one appeared to be an older machine that the administrators had left vulnerable. (Bitdefender has never revealed how it spotted the server’s unprotected IP address.)

When the Dutch set up a wiretap on that computer, they found that the administrators had connected to it from yet another Dutch server, along with four others in Germany, adding up to six servers in total. They quickly made a plan with the help of the German federal police to seize all six machines. When the Dutch police got their hands on the servers, they found an utter bonanza of Hansa’s sensitive data. It included the source code of the market, a collection of usernames and passwords, the database of all the market’s transactions, and messages between users, mostly encrypted—even the two administrators’ PGP private keys, allowing the team to both decrypt messages the admins received and verify their identities on messages they sent.

The seized Hansa database listed only the pseudonyms of the site’s users, and each of those users’ connections to the site had been obscured by Tor. Hansa buyers’ and sellers’ identities were still beyond the reach of the investigators. But the data included another prize: a massive chat log between Hansa’s two administrators, who went by the names HL and RonSwanson. This was a treasure trove of 17,000 messages. In some of those conversations, they’d even referenced each other’s full legal names. One had revealed his home address. Some quick social media searches shed more light on their lives: One was a 30-year-old based in the German city of Siegen, the other a 31-year-old in Cologne.

On a fall day in 2016, not long after the servers were seized, two Dutch investigators pored over that bounty of data at a desk on the second floor of the Driebergen police building. One investigator, Nils Andersen-Roed, was an agent on the Dutch National Police’s newly formed dark-web team; the other—who asked to go unnamed—was a technical adviser to the Dutch prosecutor. Both sat entranced by the highly sensitive information unspooling on the screen before them. They wondered aloud how they could capitalize on this rare windfall.

Andersen-Roed, thinking of the two administrators’ PGP keys, made a comment that he intended as a joke: With those two keys, he pointed out, they could go onto dark-web forums and impersonate the two German admins, writing messages and “signing” them as the founders of the Hansa market. They could essentially become the administrators.

As the two men batted around that impersonation idea, their conversation turned more serious. They’d both seen dark-web markets rise and fall over the past half decade, ad nauseam: When law enforcement busted one—or when its administrators ran off with their users’ money—a new one would simply emerge to replace it. It was an endless game of whack-a-mole.

“We should be able to do something more with this than just take the marketplace down and go on to the next one,” one man said to the other. “We’re in a unique situation; we should do something different.”

Soon, the notion of becoming Hansa’s bosses was no longer a joke. What if, instead of merely arresting the admins and seizing their site, the investigators secretly commandeered the market? With one of the most active sites on the dark web under their control, there was no telling what powers they might gain to identify Hansa’s users, including its most high-volume drug dealers.

If and when they did ultimately reveal their sting operation, the two Dutchmen daydreamed aloud, the psychological blow to the community would be insidious: No one would ever again be able to fully trust that a dark-web administrator wasn’t actually an undercover agent.

Sharing their idea with the rest of their team at the Dutch National Police, and then the German federal police who had helped seize the servers, the two Dutch investigators learned of another lucky break. The Germans were already on the trail of the two suspected Hansa admins—not for the massive drug market they had created, but for a book piracy site they were running on the side.

Rather than seeing a conflict, the Dutch police realized they could play this to their advantage. When the Germans arrested the men for their book piracy site, the Dutch would have the perfect opportunity to stealthily slip into their places, running Hansa with minimal publicity or disruption. “We could use that arrest,” says Gert Ras, the head of the Dutch National High Tech Crime Unit that was soon brought in to take charge of the operation. “We had to get rid of the real administrators to become the administrators ourselves.”

Just as this bold plan began to come together, however, it faced a fundamental problem. The cops’ initial seizure of Hansa’s German servers had shown their hand. On one of the computers, they had found a text file that appeared to show the IP addresses for the market’s central, still-active servers in Germany. But by then, the spooked admins appeared to have relocated them to an unknown data center, shuffling them back into Tor’s vast deck of anonymized machines around the globe. “That was a setback,” Ras said with grim understatement.

At that point, the Dutch cops might have simply cut their losses and given the Germans the go-ahead to arrest Hansa’s administrators—after all, they knew their names and locations—then charge them with running a massive drug market, for which they had ample evidence. Instead, remarkably, they decided to double down on their stealthy takeover plan. That meant they had to find not only the admins but the servers that had just disappeared from their radar.

They spent the next few months patiently hunting for those machines, looking for any clue that could help them reestablish the trail. It was only in April 2017, more than six months after they seized those first six servers, that they got another lead. This time, it came from the blockchain.

Among the two administrators’ thousands of messages to each other were a handful in which they’d mentioned bitcoin payments. When the Dutch police fed those addresses into Chainalysis’ Reactor software, they could see that the transactions led to an account on BitPay, a payment processor designed to let users spend cryptocurrency on traditional goods and services. In this case, unlike for most dark-web payments, there was a middleman to go after. The Dutch subpoenaed BitPay’s Netherlands office and discovered that the admins had funneled bitcoins into the service in order to rent servers at a Lithuanian hosting provider.

So a team of Dutch investigators flew to the Lithuanian capital of Vilnius and explained their first-of-its-kind takeover plan to the local police. “They were literally flabbergasted,” says Petra Haandrikman, a chief inspector for the Dutch police who had become team leader for their Hansa operation. “You want to do what?” she remembers them responding. But they agreed to cooperate. The Dutch detectives now had Hansa’s infrastructure back in their sights.

It was around that time, just as their Hansa-hijacking scheme became a real possibility again, that the Dutch learned of the US investigation into AlphaBay. They discussed what it might mean for their own operation, now the better part of a year in the making.

Their takeover idea was already the most daring undercover operation to ever target the dark-web drug world. But maybe, they thought, they could push their luck just a little further.

On an early May morning, a delegation from the US AlphaBay investigation team arrived at the airport in the Hague, a city on the Netherlands’ North Sea coast, 40 miles west of Driebergen. Jet-lagged and hungry after their red-eye flight, they stopped for breakfast at a Dutch-style pancake restaurant in an underground cellar.

Paul Hemesath, who could never sleep on airplanes, had used the time to assemble a list of potential names for their AlphaBay takedown operation. He recited his list to the group, which included Operation Blockbuster, Operation Block Party, Operation Chain of Fools—all references to their blockchain tracing evidence—Operation Siamese Dream, Operation Not-So-Darknet, and Operation Rawdogger. (“In retrospect,” Hemesath admits, “some of these were just kind of unfortunate.”) The sleep-deprived group rejected all of Hemesath’s submissions and began brainstorming other ideas. Finally, they settled on a pun that combined an element of the name AlphaBay with the notion of the net they were tightening around it, along with an allusion to piercing the dark web’s veil: Operation Bayonet.

A few hours later, the group arrived at Europol headquarters, a fortresslike building of blue-gray brick complete with a moat in front of its entrance. They were set to present their progress to an international group of law enforcement agencies. The team sat down in a vast conference room, with tables for each delegation arranged with placards and microphones—a kind of UN General Assembly of dark-web snoops.

The meeting was a routine event, mostly designed to prevent the agencies from stepping on one another’s toes. The Americans went first, presenting the latest developments on AlphaBay: They believed they had both AlphaBay’s server and its administrator, Alexandre Cazes, within reach. They planned to indict Cazes under seal in a matter of days and were working with the Thai police to arrest him soon thereafter.

After a short coffee break, it was the Dutch delegation’s turn to speak. The technical adviser to the Dutch prosecutor’s office made a proposal, one he had received approval for just minutes earlier, after hurriedly telling prosecutors about the Americans’ presentation. The Dutch police were ready, he said, to arrest the administrators of Hansa with the help of the German federal police, take control of the market, and run it in secret.

They now could see just how close the Americans were to taking down AlphaBay. What if, the Dutch technical adviser suggested, they combined their operations?

All the Americans would need to do, he explained, was wait for the Dutch takeover of Hansa before green-lighting their takedown of AlphaBay. Then, after they’d arrested Alpha02 and seized his servers, they would simply delay any official announcement of their victory. If all went according to plan, a massive throng of the dark web’s users would flood from the dead market to the next-best option—a market under Dutch police control.

Then, only after the Dutch had a chance to spy on the internal workings of the dark-web economy like never before—from the privileged position of its newly crowned kingpins—would they publicly announce their Hansa and AlphaBay operations simultaneously. Together, their sting operation would be what the Dutch technical adviser described as a “one-two” punch.

At the American table, eyes widened. Ali, the FBI analyst, remembers her exhilaration at the epic ambition of the plan. The prosecutor Louisa Marion’s mind excitedly raced through the risks and rewards. Was this even legal? Was it ethical?

Paul Hemesath, still deeply jet-lagged, remembers being both impressed and wary of the complexity the Dutch were adding to their AlphaBay operation. There had been prior investigations in which law enforcement had secretly taken control of a dark-web site. In 2014, for instance, the Australian Federal Police had run a site trafficking in child sexual abuse materials called the Love Zone for six months. Cases like the Love Zone were operational successes, but controversial. Journalists and legal scholars would later point out that in order to more deeply infiltrate the underground community they were targeting, law enforcement had essentially engaged in the same crime they were investigating.

Now the Dutch were suggesting doing something similar, but for the second-biggest online narcotics market in the world. There was no precedent for it.

“In terms of dark-web drug market impersonation,” Hemesath says, “this was the first monkey being shot into space.”

Aside from the legal or ethical implications, he wondered whether it wasn’t a little “pie in the sky,” as he put it. Coordinating among the agents across the United States was difficult enough. Now they were going to coordinate among the Dutch, the Germans, half a dozen US agencies, and the Thais, too?

Still, the serendipity of these two investigations unfolding in tandem was uncanny. When would they have another opportunity to try something like this again?

“To time this and to count on it happening, who knows?” Hemesath thought. “But let’s give it a shot.”

Continued next week: The team finds a crucial vulnerability in Cazes’ personal opsec—and deploys a secret technique to locate AlphaBay’s main server. But just as Operation Bayonet heats up, the investigators have an unexpected encounter with their target.

This story is excerpted from the forthcoming book Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency, available November 15, 2022, from Doubleday. 

If you buy something using links in our stories, we may earn a commission. This helps support our journalism. Learn more.

Chapter Illustrations: Reymundo Perez III

Photo source: Getty Images

This article appears in the November 2022 issue. Subscribe now.

Let us know what you think about this article. Submit a letter to the editor at mail@wired.com.