Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 1 of 17

UN ITED STA TE S D ISTR ICT CO UR T

SO U TH ER N D ISTR ICT O F FL O RID A

No. /p-r)'-/Jz:/-Ty
UN ITED STA TE S O F A M ER ICA

V.

GM uV AL LE RIU S,
a/k/a,<CO X YM O N STER ,''

D efendant.
/

C R IM IN A L C O V ER SH EET

D id thism atteroriginate from a m atterpending in the N orthern Region ofthe United

States Attorney'sO ffice priorto O ctober 14,2003? Y es X No

D id thism atteroriginate from a m atterpending in the CentralRegion ofthe U nited States

Attorney's Office priorto Septem ber 1,2007? Y es Y No

Respectfully subm itted,

BEN JA M W G .G REEN BERG

U N ITED STA TES A TTO RN EY

Bv: >
FRAN CISC O R .M A D ERA L
A SSISTA N T UN ITED STATES A TTORN EY
Fla.Bar.N o.41481
99 N .E.4th Street
M iam i,Florida 33132-211l
TEL (305)961-9159
FAX (305)530-7976
francisco.maderal@ usdoj.gov
 Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 2 of 17

AO 91(Rev.08/09) CriminalComplaint

U NITED STATESD ISTRICT C OURT

forthe
Southern DistrictofFlorida

United StatesofAmerica )
V. ) .
GALVALLERIUS,a/k/a,''OXYM O NSTER,''
) casexo. j)-my-o5p//-rp
)
)

C RIM IN A L CO M PLA IN T

1,thecomplainantin thiscase,statethatthefollowing istruetothebestofmy knowledgeandbelief.

Onoraboutthedatets)of 3/2015-8/2017 inthecountyof Miami-Dade inthe
Southern Districtof Florida ,thedefendantts)violated:
Code Section OffenseDescri
ption
Title 21,United StatesCode, Conspiracy to Distribute Controlled Substances
Sections846& 841(b)(1)(a)

Thiscrim inalcomplaintisbased on these facts:

SEE ATTACHED AFFIDAVIT.

W Continuedontheattachedsheet.

Comp ainant'
ssignature

Austin D.l-ove S/A DEA

Printednameand title

Swornto beforeme and signed in my presence.

Date: 1 Q
Judge'ssignature

City and state: Miam i,Florida Jonat n Goodman,U.S.Magistrate Judge

Printednameand title
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 3 of 17

A FFID A V IT

1,AUSTIN D.LOVE,SpecialAgentwiththeDnlgEnforcementAdministration(DEA),
being tirstduly sworn,hereby depose and state as follow s:

INTRODUCTION

Thisapplication in furtheranceofan investigation workedjointly with theFederal

Bureau of lnvestigations (FB1), the Internal Revenue Service (lRS), Homeland Security
Investigations(HS1),andtheUnitedStatesPostallnspection Service(USPIS).
2. I am an investigative or law enforcem entofticer of the U nited States w ithin the

meaningofSection 251047)ofTitle18oftheUnitedStatesCode.Thatis,lam an officerofthe

United States w ho is em pow ered by 1aw to conduct investigations of,and to m ake arrests for,

offensesenumerated in Title 18,United StatesCode,Section 2516(1),and in Title 21,United

StatesCode,Sections 846 and 878.

This affidavit is m ade in support of a crim inal com plaint charging G al

V A LLERIU S, a/k/a,tr xyM onsterr''w ith conspiracy to distribute in narcotics in violation of

Title 21,United StatesCode,Section 846.

1 have notnecessarily included in the affidavit each and every factknow n to m e

about the m atters set forth herein, but only those facts and circum stances that I believe are

sufficientto establish probable cause forthe Courtto sign a crim inalcom plaint.

The statem ents contained in this affidavit are based upon m y investigation,
.

inform ation provided by other sw orn 1aw enforcem ent offcers and on m y expedence and

training as a federalagentand the experience and training ofotherfederalagents.

Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 4 of 17

PROBABLE C AUSE

This application stem s from an ongoing crim inal investigation into drug dealers

operating on crim inalonline m arketplace w ebsites,including a w ebsite know n as Dream M arket.

In the course ofthis investigation,Ihave learned thatthe Dream M arketw ebsite is one ofm any

The Onion Router (Tor'')network or dark web''criminalmarketplaces.Dream M arketis

designed to prom ote the anonym ous sale of illegal item s, such as narcotics, in exchange for

Bitcoinandother,peer-to-peercrypto-currencies(alsoknown as,virtualcurrencies).
A s set forth in m ore detailbelow ,probable cause exists thatV A LLERIU S,acted

as an A dm inistrator,Senior M oderator and Vendor on D ream M arket,playing a criticalrole in

supporting daily illicit transactions betw een buyers and vendors on D ream M arket, such as the

trafficking in narcoticsand laundering in the proceeds oftheir activitiesusing the Bitcoin and the

dark web,in conspiracy with additionalknown and unknown administratorts),moderators,and

vendors ofthe D ream M arket.

A .TH E TO R N ETW O R K A N D TH E RD A RK W EB ''

The Intenzetis a globalnetw ork ofcom puters and other devices. D evices directly

connected to the Intem et are identified by their unique IP address.This num ber is used to route

inform ation betw een devices. G enerally,w hen one device contacts a second device, the first

device m ustbe directed to the IP address of the second device. M oreover,when the firstdevice

contacts the second device,the first device provides its ow n IP address to the second device,so

that the second device know s where to direct its response. A ccordingly, the tw o connected

devices (forinstance,a home computerand the www.google.com website server)know each

other'sIP address.
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 5 of 17

9. The typicalusef m ay notknow the IP address ofa websites he visits. Typically,a

user w ill type the dom ain nam e of the w ebsite- which com m only corresponds to a plain-

language nam e for the w ebsite,e.g., ww w .google.com - into the Uniform Resource Locator

(:EURL'')baratthetop oftheirwebbrowsers.ThisdomainnamewillbetransmittedtoaDomain
Name System (DNS'') server,which then translates the domain name into the appropriate
num ericalIP address,and thereby allow sthe userto connectw ith the requested w ebsite.

10. How ever, if a user know s of a unique IP address for a particular w ebsite,

generally'the user can type that IP address directly into the U RL bar and access the w ebsite in

thatm anner.

In addition,publicly available databases can be easily searched to obtain the IP

addressfor any know n UR L and the registered ow ner and location ofany IP address.Thus,w ith

additionalinquiry, m ostany U RL or IP address can be traced to itsow nerand physicallocation.z

This isproblem atic foranyone conducting clim inalactivity on the intem etand w ishing to rem ain

anonyrRous.

1The server or virtual selwer w ith a particular IP address can hostm ultiple w ebsites,in w hich
case entering thatparticular IP address w ould notdirecta user to a single w ebsite.H ow ever,if
an IP address is associated with a single website,entering the IP address as desclibed above
w ould directthe userto thatparticularw ebsite.
2 Private individuals operating hom e com puters usually do not ow n and register their own IP
address',instead,they subscribe to broadband accounts w ith ISPS,such as Com cast or A T& T,
whichin tul'nassign orleasean IP addresstothem (thesubscriber).Nevertheless,theIP address
can usually be traced to its assigned user ata given pointin tim e using the ISPSrecordsofw hich
subscriberw asassigned which IP address and when.
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 6 of 17

B.U ser A nonym ity Provided by the Tor N etw ork

12. The Onion Router(Tor)network isa specialnetwork ofcomputers distlibuted

around the w orld designed to conceal the true IP addresses of the users of the netw ork.Every

com m unication sentthrough Tor is directed through num erous relays w ithin the netw ork- and

w rapped in a layerofencryption ateach relay- such thatthe end recipientofthe com m unication

hasno w ay oftracing the com m unication back to itstrue oliginating IP address.

13. ln orderto access the Tor netw ork,anyone can sim ply dow nload the Tor brow ser

softw are and use it to access the internet.The user sim ply inputs a w ebsite IP address or U RL

into the Torbrow ser and the Tor brow ser autom atically encrypts and routes the com m unication

through severalrelays and then outto the destination so thatthe destination w ebsite can only see

theIP addressofthelast(orexif')relayandnottheIP addressofthedeviceactuallyconnecting

to the destination website.

14. By way of illustration, in a standard internet com m unication, when a person

connectsto a w ebsite,thatw ebsite can see thatpersons IP address:

l'
lometrom ptlttr wstw,-google.
tom
1P':123.
456-789

In this illustration of a standard internet connection,the w ebsite ww w .google.com can see the

homecomputerIP address(123.456.789)and,ofcourse,theuserofthehome computerknew

the URL,and therefore the IP address,of ww w .google.com ,which the userhad to type into his

brow ser to colm ectto the w ebsite in the firstplace.Thus,each users'IP addressis know n to the

other,and the ow ner and location ofboth can laterbe traced.

Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 7 of 17

15. Sim ilarly, any person m onitoling the internet traffic at a point betw een the tw o

would see the connection betw een IP 123.456.786 and ww w .google.com and know that those

tw o devicesw ere com m unicating.

On the other hand, in the case of a Tor netw ork com m unication,w hen a person

connects to a w ebsite, the traffic is encrypted and routed through m ultiple relays, and that

w ebsite cannotsee thatpersonsIP address:

'
1-0rRelal-l
lP:00I.00 I-001

HomeCmputtr
IP:123,456.78t
) ww,w ,google-com

TnrRelay 2
1P:* 2.002,
002

TorRelay 3
IP:003.003.
003

ln this illustration of a Tor netw ork com w ction, the website w w w .google.com cannot see the

home computerIP address(123.456.789),

.instead itonly seestheIP addressofthedeviceitis
directly connected to,the third (or Etexit'') Torrelay,with IP address003.003.003,which IP
address cannotbe traced back to the hom e com puteruser.

In addition,any person m onitoring the internettraffic ata pointbetw een the hom e

com puter and w w w .google.com and would not know that those tw o devices w ere

com m unicating. Instead,depending on the m onitoring point, that person w ould only see the

directconnectionsbetween thehomecomputerand first(ortentry'')Torrelay,between thefirst

Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 8 of 17

and second, or second and third Tor relays,or between the third (or 6
exif') Torrelay and
ww w .google.com .

18. A s w ith a standard internetconnection,the userm usthave know n the U RL or IP

address of the w ebsite in order to have directed a connection to it through the Tor network.

Accordingly,although the IP address ofthe userishidden from the w ebsite,the IP addressofthe

w ebsite m ustbe known to the user- the anonym ity is only one-w ay.

19. The Tor netw ork addresses this problem through a feature know n as Ehidden

services.''

C .H idden Services:W ebsite Anonym ity Provided by the Tor N etw ork

To achieve tnle, tw o-w ay anonym ity, the Tor netw ork also enables w ebsites to

operate inside the netw ork in a m anner thatconceals the true IP address ofthe com puter server

hosting the website. Such hidden selwices'' operating on Tor have com plex w eb addresses,

generated in a com puter algorithm ,ending in i6.onion.''U nlike a standard U RL,there is no way

to retrieve a w ebsite server'strue IP addressfrom its .onion Toraddress alone.

This alleviates the need for a Tor netw ork user to know the tnle IP address of a

w ebsite.Rather the user can directhis Tor brow serto the .onion address,reach the website,and

neither the user northe w ebsite know s the other's IP address- tw o-w ay anonym ity is achieved.

This netw ork ofanonym oususersand websitesisthe tDark W eb.''

22. Crim inals have taken advantage of the D ark w eb to create w ebsites w ith online

m arketplaces dedicated to the trafficking of controlled substances and other illicit goods.

W ebsitessuch aswww.deepdotweb.com m aintain an overview ofillegalm arkem lacesoperating

Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 9 of 17

on the Dark W eb, and how -to guides such as: El-low to Buy D rugs Online from Darknet

M arkets.''3

D .Description ofthe Dream M arketN arcotics D istribution Conspiracy

Dream M arketprovides an infrastnlcture thatallows buyers and sellers to conduct

transactions online,in a m anner sim ilar to w ell-known online m arketplaces such as eB ay.Like

eBay:

a. D ream M arket functions as an interm ediary betw een buyers and sellers.

Sellers create accountson Dream M arketto advertise theirproducts,such asnarcoticsor hacked

com puter passw ords,and buyers create accounts to brow se sellers'products and purchase them ;

in thisregard,D ream M arket's website interface issim ilarto w ell-know n online m arketplaces;

b. D ream M arket perform s m oderator and m aintenance services, such as

receiving com plaints,providing technicalassistance,and allow ing custom ers to postreview s of

D ream M arket vendors. D ream M arket also provides a m eans by w hich its users can

com m unicate with itsadm inistratorsand operators;and

Dream M arket charges a com m ission from every transaction as a

percentage ofthe sale price.

24. How ever,unlike legitim ate online m arketplaces, Dream M arket is dedicated and

designed to facilitate the sale ofillegalnarcotics and drug paraphenzalia.Forexam ple:

Illegaldrugs,such as m etham phetam ines,heroin,and cocaine,are openly

advertised and sold and are im m ediately and prom inently visible on the Dream M arketw ebsite.

3htTs://www.deepbotweb.coe zols/lz/3o3uy-dOgs-online-from-daru etmarkets/

Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 10 of 17

The D ream M arket website is specifically designed to facilitate illegal

com m erce by w orking to ensure the anonym ity ofits adm inistrators,as wellas ofthe buyers and

sellers who participate in com m erce on the w ebsite.The w ebsite is designed to achieve this

anonym ity prim arily by operating as a hidden service on the Tornetw ork.

To further prom ote anonym ity,purchases are m ade prim arily in bitcoin

(orothervirtualcun-ency)using Dream M arket'sescrow services,i.e.,abuyertransfersfunds

from his or her ow n accountor virtual-currency w alletinto an Dream M arketaccountor w allet,

and D ream M arket subsequently transfers the funds to the seller's account or w allet upon

satisfaction of the term s of sale. ln doing so, D ream M arket also provides a t'tum bling''or

ttm ixing'' services w hich essentially scram bles m ultiple buyer-seller Bitcoin transactions

together in order to concealthe bitcoin paym ents from buyerto seller or com m ission paym ents

to the adm inistrator.Thus,there is no directbitcoin transaction betw een the buyerand the seller.

25. A s of A ugust 29,20l7,there are a total of 94,236 listings on D ream M arket,to

include the following categolies:

r nlgs''(47405listings).The''Dnlgs''categoryisbroken down intothe

follow ing sub-categories:Stim ulats,Opioids,Ecstasy,Cannabis,Barbituates,Belzzos,Cannabis,

Dissociatives, Prescription, Psychedelics, RCs, Steroids and W eight Loss. Each sub-category

contains differenttypesofcontrolled substances,such as heroin,fentanyl,m etham phetam ine and

cocaine. For exam ple, the E6stim ulats'' category contains 934 listings for crystal

m etham phetam ine ranging from .5 gram s to 11 pounds per listing,totaling over 200 pounds of

crystalm etham phetam ine atany given tim e.

Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 11 of 17

b. ttllligitalGoods''(41394listings).ThettDigitalGoods''categoryisbroken
dow n into the follow ing sub-categories: D ata,D rugs,E-Books,Fraud,Fraud Related,Hacking,

lnform ation,Other,Security,SoAw are.

tDl'ugParaphernalia''(456listings).
d. Services(3056listings).Theservices''category isbroken down intothe
follow ing sub-categories: Hacking,lDs & Passports,M oney,Other,Cash out.

tother''(2382 listings).The ttotherCategory''isbroken down into the

following sub-categories:Counterfeits, Electronics,Jew elry, Lab Supplies, M iscellaneous and

D efense.

These activities and the m arketplace w ebsite itself is overseen, m anaged and

controlled by Dream M arketadministratorts)and moderatorsin conspiracy with each otherand

allofthe vendors on the m arketplace.

Dark W eb m arketplace adm inistrators typically create,m odify,m aintain,

and controlthe actual w ebsite and the sever on which its located,as w ell as ultim ately

controlthe activity am ong the m arketplace's participants,including the appointm ent of

m oderators and otherto help in thatroll.

b. M oderators typically m oderate disputes betw een the m arketplace's

vendors and buyers and seek to assure the continued operation ofits activities.

The tnze identity of the gtloftheindividualswho currently controland operate on

..

the Dream M arketw ebsite asadm inistrators,m oderators orvendorsis unknown.

E .D ream M arket:D rug D istribution & V enue in Southern D istrictofFlorida

28. Since at least February of 20l6,agents identified narcotics vendors operating on

Dream M arket under the follow ing m onikers: Digitalpossizol4, Rexim usM axim us and
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 12 of 17

M ethForDum m ies.On severaloccasions,D EA agents have m ade undercover online purchases of

crystal m eth, LSD and hydrocodone from the aforem entioned vendors on Dream M arket and

received the drugs via U .S. M ail, shipped to undercover m ailboxes in M iam i, Florida. For

instance:

On February 25, 2016,D EA agents purchased 100 sheets of LSD from

Rexim usM axim us on D ream M arket for 1.084 bitcoins.ln the descliption, Rexim usM axim us

stated'
.'<100X G D F 150ug LSD !!''.

O n M ay 25, 2016, DEA agents purchased one hydrocodone pill from

D igitalpossizol4 on D ream M arket for 0.0993 bitcoins. In the description, Digitalpossizol4

stated:(ONE)10.325Hydrocodone 14.50apiece.''
On M ay 25, 2016, DEA agents purchased 10 hydrocodone pills from

D igitalpossizol4 on Dream M arket for 0.2207 bitcoins. In the description, D igitalpossizol4

stated,KKITEN)7.5Hydrocodone$100.00 free2/3daypriori.''
On M ay 25, 2016, DEA agents purchased gram s of crystal

m etham phetam ine from M ethForDum m ies on Dream M arket for 1.516 bitcoins. ln the

description,M ethForDummiesstated,CCM FD'SHQ crystalmethamphetamine28grams.''

29. ln a11 four instances, the controlled substances w ere shipped via United States

Priority M ail to M iam i, Florida. Laboratory results confinned that the above-listed item s

contained controlled substances,including LSD ,hydrocodone,and crystalm etham phetam ine.

F.Ro xyM onster''A dm inistrator,Senior M oderator & V endor on D ream M arket

30. On January 27,2017,D EA agents logged into Dream M arketand observed a link

to Fonlm ''on the Dream M arkethom e page.A gents clicked on the link,w hich took them to a

Torw ebsite called D ream M arketForum .Based on m y training and experience,dark w eb m arket

10
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 13 of 17

adm inistrators create forum w ebpages on the dark w eb to allow vendors, buyers and

adm inistrators to discuss anything related to the dark w eb m arket.In order to post on the forum ,

onemustcreate aprofilewith ausemameand password,anyone canjoin the forum,butonly a

Dream M arket,adm inistrator,m oderator or vendor,verified by the D ream M arketadm inistrators

w ill appear m arked as an adm inistrator,''m oderator'' or fvendor'' on the fonlm .4 U nverified

forum users are m arked as 'tm em bers''

31. W hile brow sing the D ream M arket Forum , agents navigated to a topic called

CCIELOFFICIAL STAFFjjI''undertheWnnouncements''tab.Thefirstpostingwaswrittenon July

23,2016 by user6r xyM onster.'' The posting stated:

Anyone that' s claim ing to M od orAdm in who '

s noton this list- should be reported
im m ediatelv.
A dm in:Speedstepper
SeniorM oderator:OxyM onster
M oderators..Quasimodo,Friedlhechicken
Ticketconductors..X ray,Spanishconnect''
SeniorModerator@ Dream marketIchud# eqm4ihj'.onl
'on//al=ss78l
32. The user 'to xyM onster's''title w as m arked as SeniorM oderator. A gents clicked

on the user 'toxyM onster'' and w ere taken to 'to xyM onster's''protile on D ream M arket. The

profile stated that'r xyM onster's''was a Senior M oderatoron Dream M arket,whose profile was

registered on the Dream M arketFort

zm on M ay 10,2015.

33. Severalm onths later,on June 30,2017,agentsalso identified tto xyM onster''as a

vendor on Dream M arket. oxyM onster's vendor profile featured listings for Schedule 11

4 On the Dream M arketForum , w henever a userposts a com m ent,his/herusernam e isdisplayed

nextto the com m ent.A lso,nextto the usernam e,a user is identified as a Dream M arketvendor,
m oderator, adm inistrator, or m em ber. A ll vendors, m oderators and adm inistrators have to be
veritied as such by the Dream M arketadministratorts).Unvelitied Dream M arketusers are
m arked asm em bers.
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 14 of 17

controlled substances O xycontin and Ritalin.H isprofile listed 60 priorsales and five starreview s

from buyers.In addition, his profile stated that he ships from France to anywhere in Europe.

U nderthe tt-rerm s and Conditions''section,hisprofile stated,

Iz
lzrchighl
y recommend using TradeRouteforpurchasingfrom us:
Trade routeilbgzton ion//shop =oxyM onster...''
THE OFFICIAL TIP JAR FOR ''
DM WATTEAM ''(STAFF)IS.
.
lDREAMv7kl6T8bMyE7ghe4nLQVSdBbPJAe.
A gents navigated to the aforem entioned TradeRoute link, w hich 1ed them to

OxyM onster's dnlg vendor page TradeRoute- an em erging dark w eb m arketplace sim ilar to

Dream M arket. O xyM onster's TradeRoute profile stated thathe w asan active drug vendor,w ho

ships from France to Europe and the United Statesand hasbeen a m em ber since February,2017.

In addition,hisprotile stated:

YES,wc wcrc m ods on E vo

YES,wc wcrc adm ins on D ream

35. In other posts on the Dream M arket forum ,'toxyM onster''characterized him self

as a D ream M arket adm inistrator.For instance,on Decem ber 10,2015,to xyM onster''posted

the follow ing'

.

Beingprom oted is always nice,especially once hitting the 'A dm in ''role.

Thatbeingsaid,wcwillbefocusingmoreonthemarket'
saspectsobviously.
O n A ugust28,2017,agents once again logged into the D ream M arketforum and

view ed o xyM onster's'' profile. At that tim e, his title was changed to E'V endor'' on D ream

M arket. H is profile also stated thathe has 1,052 posts and his last post w as on February l3,

2017.In addition,he had a signature,which stated:

12
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 15 of 17

SeniorM oderator@ Dream marketIchudk eqm4idjj.onion//ai=ss78l''*REAL DSAWAT

STAFF T1P JAR:1DM 'AMv7kl6T8bMyE7ghe4nLQVydBbPJAe.5
37. A gents review ed all of oxyM onster's'' posts on the D ream M arket Forum ,

w hich began on h4ay l0, 2015 and ended on Decem ber 22, 2016. f'O xyM onster's'' posts

responded to custom er com plaints,provided tips on staying anonym ous on the dark w eb and

posted the nam es ofthe officialstaffofDream M arket.

On A ugust 29, 2017, agents view ed toxyM onster's'' D ream M arket vendor

profile. This tim e, the vendor profile stated that he w ill also ship to the U nited States. The

vendorprofilenow had 70 verified salesand stilllisted the same Dream M arketstafftip jar
bitcoin w alletand he w as lastonline on August29,2017.

39. In sum ,6r xyM onster''know ingly participated the Dream M arket conspiracy not

only as a vendor,but also,in a leadership and organizational roll as a senior m oderator and

adm inistrator.

F.G aIV ALLE RIU S ldentified as Go xyM onster''

40. After observing the bitcoin ''tip jar'' advertised by toxyMonsyter,'' agents
conducted analysis of the incom ing and outgoing transactions from that bitcoin address and

learned that15outof17 outgoingtransactionsfrom thettoxyM onster''tipjarwentto multiple

wallets controlled by French nationalGalV A LLERIU S on Localbitcoins.com .

Open source data revealed that VA LLERIU S has lnstagram and Tw itter accounts.

A gents com pared the w riting style of '6oxyM onster''on D ream M arket fonlm while in Senior

5Based on m y training and expelience, abitcoin ktipjar,''isutilizedby darkwebmarketvendors

and adm inistrators to receive tips in bitcoin for their service from the users of the dark w eb
m arket.

13
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 16 of 17

M oderatorrole to the writing style ofV A LLER IU S on his public Instagram and Tw itteraccounts.

A gents discovered m any sim ilarities in the use of w ords and punctuation to including:the w ord

tcheersi''double exclam ation m arks; frequent use of quotation m arks'

, and interm ittent French

posts.

42. On A ugust 31,2017,VA LLER IU S travelled to the United States forthe firsttim e

to attend an internationalbeard com petition in Austin,Texas.A border search ofhislaptop upon

his anivalatA tlanta InternationalA irportconfinned his identity as tto xyM onster.''On his laptop

wastheTOR browser,apparentlog-in credentialsforDream M arket,$500,000 worth ofbitcoin,

and a PGP encryption ke/ entitled ''OxyMonster'' which matched that advertised as
E6oxyM onster's''on D ream M arket.

6Persons who are involved w ith Dark W eb narcotics trafficking utilize public key encryption to
com m unicate w ith other purchasers and sellers on the m arketplace in order, for instance, to
provide inform ation such as a shipping address.lf the m essage w as not encrypted,it w ould be
visible by the adm inistrators of the D ark W eb m arketplace, and by law enforcem ent, if the
m arketplace server w as ever located and seized.Public key encryption allow s the sender of a
m essage to encryptthatm essage using a long and unique passcode know n as a public key,w hich
the recipient of the m essage publicly provides to anyone w ishing to com m unicate w ith them .
Thatm essage,in tum ,can only be decrypted by the recipientusing a corresponding private key
know n only to them .The m ostcom m only used encryption is thatknow n as Pretty Good Privacy
(PGP)encryption.Almosta1lDark W eb marketplacevendorprotilesadvertiseapublicPGPkey
for thispup ose;the PG P key,therefore,doubles as a unique fingerprintvisible across dark w eb
platform s.

14
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 17 of 17

C ONCLIJSION

43. Based on the foregoing,probable cause exists thatG alV A LLERIU S,did,atleast

from M ay 20l5 to August 2017 conspire to distribute controlled substances,including cocaine,

fentanyl,m etham phetam ine,LSD ,and oxycodone in violation of Title 21, United States Code,

Section 846.

Respectfully subm itted,

A .
A U STIN D .LO VE,SPECIA L A G EN T
DRU G EN FOR CEM EN T A DM INISTR ATIO N

The cont nts of this written affidavit w ere subscribed and

swornbeforem onAugustx ,2017.

JON A H GO O DM A N HO N OR AB LE
UN IT STA TES M A G ISTRATE JU D GE