You Keep Using That Word

Thirteen years since the Silk Road operator got caught with his laptop open.

Hello there cyber fanatics!

Thirteen years ago, on the afternoon of October 1st, 2013, a 29-year-old named Ross Ulbricht sat down at a table in the Glen Park branch of the San Francisco Public Library, opened his laptop, and logged in to run the biggest drug market on the internet. Federal agents were already in the room. A few minutes later he was in handcuffs, and his laptop was in their hands, open and logged in.

Silk Road was a black market on the dark web. For almost three years, anyone with a Tor browser and some Bitcoin could buy drugs, fake IDs and hacking services there, and get them delivered by regular mail.

And it sold one idea above everything else, and that idea was anonymity. The site ran as a Tor hidden service, payments were in Bitcoin, and the man in charge went by Dread Pirate Roberts. The buyers were anonymous, the sellers were anonymous, and the boss on top was anonymous too.

I have spent a good part of my career watching underground admins, and Ross Ulbricht made almost every mistake I still see them make today. So this one is about the operator and the trail he left behind. Let's go.

Anonymous Amazon

The Silk Road marketplace homepage in 2013, with the camel logo, product categories down the left side and listings priced in Bitcoin The storefront. Categories on the left, photos and prices in the middle, a camel on top, and a countdown to 4/20. Screenshot: Nicolas Christin, CMU CyLab (2012).

Silk Road went live in early 2011. Picture Amazon with a camel for a logo: categories down the side, product photos, prices in Bitcoin, vendor ratings and buyer reviews. The shelves are where it gets different.

Here are the numbers from the government's complaint, filed the day he was arrested. Between early 2011 and July 2013 the site did 9,519,664 bitcoins in sales and took 614,305 bitcoins in commission, roughly $1.2 billion and $80 million at the exchange rates the complaint used. It had 957,079 registered accounts. On September 23rd, 2013 it carried nearly 13,000 listings for drugs, plus forged documents, "digital goods" and hacking services.

Now let me look at it the way I look at every criminal operation, as a company.

Silk Road had a CEO. It had staff, admins and moderators on weekly salaries, which prosecutors showed at trial ranged from about $900 to $2,500 a week. It had customer support. It had an escrow system that held the buyer's money until the package arrived, which quietly made Dread Pirate Roberts the platform's bank. It had a seller's guide that told vendors to vacuum-seal everything. It had a pricing strategy: in January 2012 he moved to a sliding commission, a bigger cut on cheap items and a smaller cut on expensive ones. And it had an acceptable use policy. Anything whose purpose was to "harm or defraud" was banned, so no stolen credit cards and no child abuse material.

I have read a lot of rules written by criminals for their forums and markets. They always read like a startup's terms of service, and they always come with a founder who thinks he is building something bigger than a shop. Ross described his project on LinkedIn as an "economic simulation" of a world without force. The customers were there for the product catalogue.

A Silk Road item page for a "Hacking for beginners" ebook, with the seller's rating, a price in bitcoin and five-star buyer feedback An item page: seller rating, a price in bitcoin, and five-star feedback on a hacking ebook. The UX was better than some banks I have used. Screenshot: Nicolas Christin, CMU CyLab (2012).

Inconceivable?

The handle came later than people think. Until February 2012 the admin posted on the Silk Road forum as "Silk Road." Then he announced he needed a name, and he picked Dread Pirate Roberts.

If you have not seen The Princess Bride (please go fix that tonight), the Dread Pirate Roberts is a title. The pirate everyone is afraid of is really a line of men who hand the name and the ship to a successor and retire rich. Nobody knows who is under the mask, because the man wearing it keeps changing.

It is a clever pick for someone who wants deniability, and his defense used it. At trial in January 2015, his lawyer told the jury that Ross created Silk Road as a free-market experiment, handed it off to others, and was lured back right before the arrest to be the fall guy. The jury needed only a few hours.

The trouble with that story is that the man under the mask never changed, and he had been leaving his real name lying around since before the mask existed.

Ross Ulbricht, the founder of Silk Road Ross Ulbricht. Same man under the mask, the whole time. Photo via Wikimedia Commons.

Hello, My Name Is altoid

Timeline of the breadcrumbs that led investigators from the altoid forum posts in January 2011 to Ross Ulbricht's arrest in October 2013

This is my favourite part of the whole case, because it is the most boring detective work you can imagine.

On January 27th, 2011, a user called altoid posted on Shroomery, a forum about magic mushrooms, asking if anyone had come across this website called Silk Road, "kind of like an anonymous amazon.com." Two days later the same handle posted nearly the same thing on Bitcoin Talk. That is the founder doing his own marketing, in week one, on the clear web.

On October 11th, 2011, altoid went back to Bitcoin Talk to hire. He wanted an "IT pro in the Bitcoin community" for a venture-backed Bitcoin startup, and told candidates to write to rossulbricht@gmail.com.

On March 16th, 2012, a Stack Overflow account named Ross Ulbricht asked how to connect to a Tor hidden service using curl in PHP. Less than a minute later the username changed to "frosty." The SSH key on the Silk Road server ended in frosty@frosty.

In July 2013, border officers pulled a package from Canada with nine fake IDs inside, all with different names and the same face. Homeland Security agents knocked on his door on July 26th. He did not admit anything, and then he volunteered that "hypothetically" anyone could go on Silk Road and buy fake IDs.

That summer, investigators saw the admin reaching the server through a VPN from an internet café on Laguna Street, less than 500 feet from an address his own Gmail was being accessed from. When they got into the admin's chat logs, the time zone was set to Pacific.

The name itself came from Gary Alford, an IRS special agent on the New York side of the investigation. He did the thing every analyst should do first and most people skip. He searched for the earliest mentions of Silk Road he could find, he found altoid, and from altoid he found the Gmail address. By September 2013 he had given the name to the rest of the investigation.

I will be honest with you. I have never had subpoena power and I never will. Everything in my job is open source or HUMINT. But this piece of the case was pure open source, and Alford did it with Google.

When I start tracking a new market or forum, the first account I want to find is the one that promoted it in its first week. Before an operator learns to be careful, he is excited, and excited people talk. Ross was excited enough to tell a mushroom forum.

Fingers on the Keys

The Glen Park branch of the San Francisco Public Library The Glen Park branch library in San Francisco, where it ended. Photo via Wikimedia Commons.

By then the investigators also had the server. It was in a data center in Reykjavík, Iceland, and Icelandic authorities imaged it for them in July 2013. The FBI said they found its real IP address leaking from the site's login page. How exactly that leak worked has been argued about ever since, and I am not going to pretend I know more than the court record does.

So they had the name, the server and the habits. What they still needed was the laptop, open. Everybody on the case knew that if the lid closed, the disk encryption would take most of the evidence with it.

On October 1st, HSI agent Jared Der-Yeghiayan, who had taken over the account of a Silk Road staff member called "cirrus," sat in a café down the street and opened a chat with Dread Pirate Roberts, asking him to check something in the admin panel. Ulbricht walked into the library and logged in. Two agents staged a loud lovers' quarrel behind him, he turned around to look, and another agent pulled the laptop away from him. On the screen was the same chat Der-Yeghiayan had just been having with DPR. The computer's name was frosty.

Ross Ulbricht's laptop and mouse, seized at his arrest, now part of the FBI's artifact collection The laptop, now an exhibit in the FBI's own artifact collection. Photo: FBI.

What was on it made the trial short. There were chat logs with his staff and log files of the day-to-day business. And there was a journal. In one entry he wrote that he imagined someday there would be a story written about his life. He kept a diary about running the most anonymous shop in the world, on the laptop he carried into public libraries.

Who Watches the Watchmen?

This part does not make the movie posters, and it is the part I find most interesting.

The investigation had its own insider threat. DEA agent Carl Force ran an undercover identity called "Nob" that DPR trusted, and then made up a second persona called "French Maid" to sell DPR information about the investigation for about $100,000 in bitcoin. All together he stole more than $700,000 and was sentenced to 78 months in October 2015. Secret Service agent Shaun Bridges used the login of an arrested Silk Road support staffer to drain accounts, worth about $820,000 by the time he moved it, and got five years and eleven months in December 2015.

And the bank got robbed. In 2012 a user named James Zhong opened nine accounts and fired off more than 140 withdrawals in quick succession to confuse the withdrawal system, walking away with around 51,680 bitcoins. It took nine years to catch him. In November 2021 agents found the coins on a single-board computer hidden under blankets in a popcorn tin in his bathroom closet. Separately, a hacker the DOJ has only ever called "Individual X" also stole from the market, and in November 2020 the government seized 69,370 bitcoins from that wallet, worth over a billion dollars at the time.

Silk Road drawn as a company org chart, with the CEO, staff, support desk, escrow and vendors, and the two outsiders and two federal agents who took money out of it

Read all of that as an org chart and it is beautiful. The CEO kept a diary. The bank had a withdrawal bug. The customer support desk had a password that ended up with a Secret Service agent. And two of the people investigating the company had their own side hustles running off it - a real sh*t show for a multimillion dollar marketplace.

What the Jury Actually Found

The FBI and HSI seizure notice that replaced the Silk Road homepage on October 2nd, 2013 What visitors saw from October 2nd, 2013. Seizure notice: FBI and US Department of Justice.

On February 4th, 2015 a Manhattan jury convicted him on all seven counts, including narcotics trafficking, running a continuing criminal enterprise, conspiracy to commit computer hacking and money laundering conspiracy. On May 29th, 2015 Judge Katherine Forrest sentenced him to two life sentences plus forty years, without parole.

You will read everywhere that he hired hitmen, so here is what the record says. Prosecutors showed chats in which DPR arranged and paid for killings, and they also said none of those killings ever happened. He was never charged with murder-for-hire in New York, the separate Maryland charge was dropped in 2018, and the judge weighed the allegations at sentencing. I keep the allegations and the convictions in separate drawers, and I would ask you to do the same.

He lost his appeal in 2017 and the Supreme Court declined his case in 2018.

The Man Walks Among Us!

Ross Ulbricht speaking on stage at Turning Point USA's Student Action Summit in 2025 Ulbricht on stage at Turning Point USA's Student Action Summit, 2025. Photo via Wikimedia Commons.

On January 21st, 2025 President Trump gave him a full and unconditional pardon, and he walked out of a federal prison in Arizona that night after more than eleven years inside.

Four months later he gave his first speech as a free man, on stage at the Bitcoin 2025 conference in Las Vegas. A few days after that, an anonymous wallet sent him 300 bitcoins, around $31 million at the time. Chainalysis later traced the coins to a wallet associated with AlphaBay, another dark web market the FBI took down in 2017. You cannot make this stuff up.

He has kept speaking since, including at the Republican Midterm Convention this year. People will argue about the pardon for years. I am here for the tradecraft.

And he is not the only cybercriminal people decided to let go... but that is a story for another blog.

The Circle Doesn't Break

Silk Road 2.0 came online on November 6th, 2013, five weeks after the arrest, built by people from the old staff, with the same look and a new Dread Pirate Roberts at the wheel. That is the plot of The Princess Bride, played straight. Its operator was arrested a year later.

After that came the long parade of markets that learned from Silk Road. They added multisig escrow, made PGP mandatory, and moved to admins who never touch the clear web. And every generation of them still gets caught on something boring.

Gary Alford needed patience, Google, and months. I build agentic systems every day, and today I can point an agent at a handle and have every forum post, every username change and every reused email back before my coffee is ready. Joining the breadcrumbs used to be the hard part of this job. It is getting cheaper every month, and the breadcrumbs are all still out there, because the internet never throws anything away.

My prediction: the next big market operator who goes down will be caught by something they posted in their first month, excited, under a handle they were sure nobody would remember. Unfortunately for them.

So go and Google yourself. Your old handles, your old emails, the forum you were on when you were nineteen. Then do it for your admins and your executives. If a tax agent could find the biggest drug market operator in the world that way in 2013, think about what somebody with an agent can find about you in 2026.

I hope I was able to improve 0.1% of your knowledge. Have fun, and good luck!