How feds have been able to identify the users of the largest child porn website

[Saint-loup]

Welcome To Video: How the website worked

Welcome to Video (WTV) was a child pornography website that operated out of South Korea and allowed users to buy content with Bitcoin or to upload their own. Upon signing up for the site, users received a unique Bitcoin address where they could send funds to buy content to view.

When law enforcement shut down the site, they seized over 8 terabytes of child pornography, making it one of the largest siezures of its kind. The site had 1.3 million Bitcoin addresses registered. Between 2015 and 2018, the site received nearly $353,000 worth of Bitcoin across thousands of individual transactions.

Taking down Welcome to Video

Cybercrime transcends national borders. Welcome to Video had a global customer and contributor base requiring cross-border collaboration among law enforcement agencies across the world. IRS-Criminal Investigations (IRS-CI), Homeland Security Investigations (HSI), and other agencies used Chainalysis software to analyze blockchain transactions and map out contributors and users of the site. This enabled them to disseminate the blockchain evidence to their partners in the United Kingdom, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil and Australia, and ultimately make arrests.

With the site’s listed Bitcoin address, IRS-CI and HSI used Chainalysis Reactor, our investigations product, to analyze transaction activity and build a graph showing the flow of funds in and out of the WTV address.




Here we see that WTV received funds from several different exchanges. This information allowed IRS-CI to contact exchanges for more information on the addresses sending money to WTV.  Because exchanges typically perform Know Your Customer (KYC) processes, many were able to provide copies of identification, addresses, and other relevant transactions associated with those accounts.  While in many cases the information supplied by the exchanges was enough to identify WTV users, in other cases IRS-CI was able to combine the account information with open source intelligence and standard investigative techniques to identify users.

Chainalysis tools then augmented the work done by IRS-CI and Homeland Security Investigations (HSI) to break down regionally-specific information. This both helped law enforcement teams around the world make arrests related to WTV, and understand how blockchain evidence can be used to take down sites like WTV more generally.

By March 2018, agents arrested the WTV owner and shut down the site.

https://blog.chainalysis.com/reports/chainalysis-doj-welcome-to-video-shutdown

The US Department of Justice announcement unveils the identity of 34 american, 2 british and one korean people.

https://www.justice.gov/opa/pr/south-korean-national-and-hundreds-others-charged-worldwide-takedown-largest-darknet-child

[1715569974]

1715569974

[1715569974]

1715569974

[1715569974]

1715569974

[1715569974]

1715569974

[1715569974]

1715569974

[LTU_btc]

Very interesting, feds did great job! But these people who got cauch are really dumb (fortunately). Because spending Bitcoins on Dark Web directly from exchanges and centralised wallets isn't very smart idea. They probably thought that using Bitcoins is enought to stay anonymous. But they didn't thought about KYC and that exchanges knows everything about them and that feds can ask them to give information about user.
But obviously not all people were identified. As seen in image, some people used mixers or websites or decentralised wallets.

[Kyraishi]

Those people are so stupid... I don't understand what's going through their mind for them. Why would they engage in criminal acts with coins that they purchase off a exchange where they have verified their identity.

Would have expected them to at least purchase their coins via an OTC service, or at least an exchange that didn't have their kyc information.

This kinda showcases how bitcoin isn't as anonymous as people think it is...

[Ailmand]

Some people are scared to undergo the KYC procedure because of possible leak of personal information. Well, in this case KYC helped a lot in shutting down the website and catching those pedophiles. This is a good move the authorities did, tracing blockchain transactions and coordinating with exchange to gain information about the address where the transaction came from. For the culprits, I think it is a stupid mistake that they used such platform in doing illegal transactions, where they know they can be traced with their identities saved om the platform.

[acroman08]

other than the criminal being stupid thinking they won't be traced because they thought bitcoin is completely anonymous. it also show
the importance of KYC in exchanges. although I am not a huge fan of KYC but it has it's purpose and right now one of it's purpose has
been shown and it helped tracked down hundreds of pedophiles around the world.

[CryptoBry]

Those people are so stupid... I don't understand what's going through their mind for them. Why would they engage in criminal acts with coins that they purchase off a exchange where they have verified their identity. Would have expected them to at least purchase their coins via an OTC service, or at least an exchange that didn't have their kyc information. This kinda showcases how bitcoin isn't as anonymous as people think it is...

Not anymore. Bitcoin can now be considered as a "public" cryptocurrency. And though this may not be good news for the criminals, I am actually happy with this because from now on no one can be claiming that with Bitcoin criminals can flourish. In fact, using Bitcoin, there can be more criminals that can be traced, tracked and be incarcerated compared if these people are using the usual fiat money. Maybe it is time that we weed out these people from Bitcoin so as to improve its "shady" image to the general population and the regulators. Our society has no place for child pornography or even illicit drugs.

[Tylev]

This case clearly showed that the state-regulated bitcoin, as well as the bulk of other cryptocurrencies, with KYC checks, are the most documented types of means of payment. Now, apparently, conventional means of payment will even have greater anonymity than cryptocurrency. However, the most anonymous will remain old and reliable paper money.
Of course, if you take the necessary precautions, including if you use Monero and other anonymous cryptocurrencies, then in general it will remain completely anonymous, provided that the user evades the KYC procedure.
That is, informed users can continue to remain anonymous when using cryptocurrency. Under these conditions, there is a demand for fully decentralized exchanges that will not request KYC, and if there is demand, there will be an offer.

[Anonylz]

At least there is a positive outcome with kyc process, if not for kyc the exchange wouldn't have been able to provide some of the identities behind those wallets, this is some of the negative side of crypto, because of it's anonymity people can use it for illegal purposes, now we understand why the authorities are so against it, there is a good side and bad side to everything.

[smyslov]

Very interesting, feds did great job! But these people who got cauch are really dumb (fortunately). Because spending Bitcoins on Dark Web directly from exchanges and centralised wallets isn't very smart idea. They probably thought that using Bitcoins is enought to stay anonymous. But they didn't thought about KYC and that exchanges knows everything about them and that feds can ask them to give information about user.
But obviously not all people were identified. As seen in image, some people used mixers or websites or decentralised wallets.

If I have that kind of activity I will never use an exchange because exchanges are compliant and they prefer to betray their clients than get their license to revoke, that is the purpose of the mixer or they should request to send their fee through a privacy coins, but not that does a KYC in exchanges are their true identity, some of them are using fake or from other people's identity to pass their KYC, so doing airdrops and giving them your information is really bad.

[figmentofmyass]

Of course, if you take the necessary precautions, including if you use Monero and other anonymous cryptocurrencies, then in general it will remain completely anonymous, provided that the user evades the KYC procedure.
That is, informed users can continue to remain anonymous when using cryptocurrency.

indeed, they went after low hanging fruit in this case. i'm amazed it took them 3 years to shut it down. users sending payments directly from exchanges, and a sloppy admin who was leaking his server's real IP address to the internet:

In a statement, British authorities said the National Crime Agency’s cybercrime unit deployed “specialist capabilities” to identify the server’s location.

The justice department gave a different explanation, saying that Welcome To Video’s site was leaking its server’s South Korean internet protocol address to the open internet.

sadly this case will be used as fodder to continue pushing increasingly strict KYC rules, when we all know that more technically savvy criminals can render them ineffective anyway.

[Sadlife]

Very interesting, feds did great job! But these people who got cauch are really dumb (fortunately). Because spending Bitcoins on Dark Web directly from exchanges and centralised wallets isn't very smart idea. They probably thought that using Bitcoins is enought to stay anonymous. But they didn't thought about KYC and that exchanges knows everything about them and that feds can ask them to give information about user.
But obviously not all people were identified. As seen in image, some people used mixers or websites or decentralised wallets.

with this mistakes now those other child porn operator was given idea how to keep safe their next operation.but i'm sure that feds wont stop seeking on how to track down all of this who is abusing the rights of every child worldwide.
this may send as message to the aspiring pornographer to stop their operation or they will be behind bars in the next couple of days.

Those people are so stupid... I don't understand what's going through their mind for them. Why would they engage in criminal acts with coins that they purchase off a exchange where they have verified their identity.

Would have expected them to at least purchase their coins via an OTC service, or at least an exchange that didn't have their kyc information.

This kinda showcases how bitcoin isn't as anonymous as people think it is...

maybe they are confident that crypo is decentralized lol.but maybe there's something inside this arrest or at some point those arrested wasn't really the operators they can be a employee that is being used as accomplish

[blckhawk]

This is one of the reasons why Bitcoin need a centralized agency to provide identification to bitcoin addresses. However, I think it's too late. The good thing is that the exchanges themselves implement KYC. The offenders must have thought that while having a bitcoin address can be anonymous, the exchanges sure would store your KYC information on their databases.

The centralized agency idea won't affect the prices since it does not aim to control price movement, instead its main focus would be for security purposes. To regulate exchanges, have identification of companies that utilizes bitcoin, and various ICOs and crypto-blockchain related services.

[Kyraishi]

Those people are so stupid... I don't understand what's going through their mind for them. Why would they engage in criminal acts with coins that they purchase off a exchange where they have verified their identity. Would have expected them to at least purchase their coins via an OTC service, or at least an exchange that didn't have their kyc information. This kinda showcases how bitcoin isn't as anonymous as people think it is...

Not anymore. Bitcoin can now be considered as a public cryptocurrency. And though this may not be good news for the criminals, I am actually happy with this because from now on no one can be claiming that with Bitcoin criminals can flourish. In fact, using Bitcoin, there can be more criminals that can be traced, tracked and be incarcerated compared if these people are using the usual fiat money. Maybe it is time that we weed out these people from Bitcoin so as to improve its "shady" image to the general population and the regulators. Our society has no place for child pornography or even illicit drugs.

Bitcoin isn't really a public coin, or a fully anonymous crypto-currency either. It's in decent position where it does provide good security if you avoid certain things and manage your data and wallet well.

Obviously from this article, the criminals where dumb enough to connect their real identity with their crimes, and don't know about mixers and other services, so we thank them for their stupidity.

[nasipadang]

Cases like this are usually big cases, not many institutions have very broad authority and relations. In my opinion if it's not a big case, a search like you said wouldn't be done. I've also researched about everything that is connected to the internet can be tracked even though they use Fake IP.

[Darker45]

sadly this case will be used as fodder to continue pushing increasingly strict KYC rules, when we all know that more technically savvy criminals can render them ineffective anyway.

This will definitely going to feed the regulators to push for a stricter approach. Well, it might deter to a certain extent the proliferation of such disgusting act. And I certainly support reasonable measures to finally put a stop to this perversion. What I feel a little bit unfair though is that the news seem to closely associate the existence of this largest child porn website to cryptocurrency alone, and so much so that it appears as if its operation is only fueled by crypto patrons alone. For sure, even before Satoshi made the first step toward Bitcoin development, child porn was already present.

[Kakmakr]

Let's be honest, it does not matter what method they used to track these pedophiles, the important thing is that they caught them. The whole community must help the authorities to identify these sites where Bitcoin are used to pay people to provide content where children are raped and violated.  

Yes, some might say that the method they used are important, because the authorities might also have access to methods to identify each and every person that owns bitcoins and it is important that we should know about this, because it puts "legal" Bitcoin users in jeopardy if they can track and trace everyone to their coins. <... but in cases like this, I am OK with that>  

[th3nolo]

Very interesting, feds did great job! But these people who got cauch are really dumb (fortunately). Because spending Bitcoins on Dark Web directly from exchanges and centralised wallets isn't very smart idea. They probably thought that using Bitcoins is enought to stay anonymous. But they didn't thought about KYC and that exchanges knows everything about them and that feds can ask them to give information about user.
But obviously not all people were identified. As seen in image, some people used mixers or websites or decentralised wallets.

The problem is that being anonymous nowadays is very difficult, whether it's due to advances in technology, the NSA, or ignorance.

Something that still surprises me a lot in 2019 is that Bitcoin remains the currency most used in the darknet, luckily for the authorities, thanks to it are that they were able to catch these criminals.

Europol: Bitcoin is the still the dark web’s favorite cryptocurrency
https://thenextweb.com/hardfork/2019/10/14/europol-bitcoin-cryptocurrency-underground-organized-crime-monero-privacy/

Darknet transactions up 70% — with BTC still the currency of choice
https://bravenewcoin.com/insights/darknet-transactions-up-70-with-btc-still-the-currency-of-choice

[Haunebu]

The problem is that being anonymous nowadays is very difficult, whether it's due to advances in technology, the NSA, or ignorance.

It is actually not that tough if you know what you are doing. A BTC address won't be enough to track down a user unless they fill in KYC or do something stupid. It all comes down to how smartly you utilize the tech behind BTC.

Something that still surprises me a lot in 2019 is that Bitcoin remains the currency most used in the darknet, luckily for the authorities, thanks to it are that they were able to catch these criminals.

Why is this so surprising? BTC has been steadily rising in value and gaining popularity over time which is why more and more users around the world are embracing it. Also, I am happy that the FEDS actually tracked these pedophiles which is why I applaud them in this case.

[7788bitcoin]

Very interesting, feds did great job! But these people who got cauch are really dumb (fortunately). Because spending Bitcoins on Dark Web directly from exchanges and centralised wallets isn't very smart idea. They probably thought that using Bitcoins is enought to stay anonymous.

Majority of the user doing illegal activity through bitcoin does not have any idea what they are dealing, the only see that a string of address will not link them to their identity and even though there are many criminals being sent to jail they will never understand bitcoin cannot be used to conduct illegal activities and i am certain that all the scammers and hackers will be caught in the future even if they use mixers.

[milani]

It took them years to caught everyone involves this is the biggest accomplishment of the authority in our time. The closing of this site will make a positive effect on the use of Bitcoin in the near future because investors don't need to think about being involved with this kind of thing. Also, the other sites like this will also closed they will no reason to continue their operation because the big fish among them has been caught.

 The story of the kiddie porn site or service has a good continuation, with good investigation results, and of course I am very happy that this result is against organizers of such service. It is great that Blockchain and such procedure like Know Your Customer (KYC) played really useful role in this situation. Despite of such a risk to loose your assets or become vulnerable because you send all your data to lots of services, in this case it played really great and positive role. The one sticking point in whole this story is that such services ( and it is a pity, but it is true) find other ways to prolong their life, and of course only low-level workers will be punished. I am afraid that as a rule the main organizer of such service is still and will stay in the shade till the time when all this story will be forgotten. And after that he or they will continue this dirty business again..