OAK — OnChain Attack Knowledge

Worked example · 2011-20

Silk Road darknet marketplace — Bitcoin — 2011-02 to 2013-10

Loss
The FBI first seized about 26,000 BTC from Silk Road accounts in October 2013 (about $3.6M then), and later announced a seizure of 144,000 BTC (about $28.5M) it said belonged to Ulbricht [slkroadwiki][slkroadforbes]. The ~$18M figure that appeared in earlier text is the estimated value of the 29,657 BTC lot sold at the 2014-06-27 U.S. Marshals auction, not of the 144,000 BTC seizure [slkroadwiki]. The later-price and "largest seizure" claims are unsourced and removed.
OAK Techniques observed
OAK-T7.001 (Mixer-Routed Hop — earlier text described an internal "tumbler" routing every withdrawal; the cited sources do not establish this and it should be treated as unverified. Sales through the site were about $1.2B between 2011-02-06 and 2013-07-23 per the server image [slkroadwiki]). OAK-T3.001 (Sybil-Bundled Launch — broadly construed for the social-platform distribution primitive; Silk Road's Tor-hidden-service marketplace was a large-scale darknet-marketplace aggregation surface).
Attribution
confirmed. Arrested by FBI agents on 2013-10-01 at the Glen Park branch of the San Francisco Public Library [slkroadwiki]. Convicted on 2015-02-04 on seven charges in federal court in Manhattan; sentenced 2015-05-29 to two life sentences without parole (five concurrent sentences) plus a $183 million forfeiture; pardoned by President Trump on 2025-01-21 [slkroadwiki].
Key teaching point
Silk Road is the canonical 2011-2013 worked example of Bitcoin as a medium-of-exchange for an illicit-activity marketplace at scale and the first major US law-enforcement cryptocurrency-seizure operation. The case established the operational template for darknet-marketplace takedowns (server-seizure at the hosting layer, wallet-seizure via defendant-side endpoint access, blockchain-forensic reconstruction of the operator's financial flows) and demonstrated that Bitcoin's pseudonymity could be penetrated through a combination of traditional law-enforcement investigation and endpoint-side compromise — the operational ancestor of modern blockchain-forensic investigation methodology.
Corrected 2026-10-11
Seizure figures corrected (about 26,000 BTC initially, then 144,000 BTC reported 2013-10-25, about $28.5M); the ~$18M figure belongs to the 2014 auction lot; removed the unsourced internal-tumbler, Iceland-hosting, domain and 'second 144,000 BTC seizure' claims.

Summary

Silk Road operated as a Tor-hidden-service darknet marketplace from February 2011 until the FBI takedown on 2013-10-01. The platform facilitated the sale of narcotics and other illicit goods exclusively in Bitcoin, with the operator ("Dread Pirate Roberts" / Ross Ulbricht) collecting commissions. The server image shows about 1,229,465 transactions, 146,946 buyers and 3,877 vendors between 2011-02-06 and 2013-07-23, roughly $1.2 billion in sales [slkroadwiki].

Bitcoin was the sole payment rail. Earlier text here asserted a platform-integrated tumbler that mixed all withdrawals; that is not established by the sources cited here.

The FBI investigation culminated in the 2013-10-01 arrest of Ulbricht in San Francisco and seizure of his laptop; the FBI initially seized about 26,000 BTC from Silk Road accounts and later reported seizing 144,000 BTC it said belonged to Ulbricht [slkroadwiki]``[slkroadforbes]. How the FBI located the server is covered in [slkroadwired]; claims here about hosting country and server-compromise methodology are unverified.

The U.S. Marshals Service sold 29,657 BTC in 10 blocks on 2014-06-27 (estimated $18 million); Tim Draper bought them [slkroadwiki]``[slkroaddraper]. Claims that this was the first government cryptocurrency auction are unverified.

Timeline (UTC)

When Event OAK ref
2011-02 Silk Road launches as a Tor-hidden-service marketplace; Bitcoin is the sole payment rail T3.001 (social-platform distribution)
2013-10-01 FBI arrests Ulbricht at San Francisco Public Library and seizes his laptop; about 26,000 BTC initially seized from Silk Road accounts [slkroadwiki] (takedown / seizure)
2013-10-25 FBI reports seizing 144,000 BTC (about $28.5M) it said belonged to Ulbricht [slkroadforbes] (wallet seizure)
2014-06-27 U.S. Marshals Service sells 29,657 BTC in 10 blocks; Tim Draper buys them [slkroadwiki] (civil-forfeiture auction)
2015-02-04 Ulbricht convicted on seven charges [slkroadwiki]``[slkroadnytc] (criminal disposition)
2015-05-29 Sentenced to two life terms without parole plus $183M forfeiture [slkroadwiki] (sentencing)
2025-01-21 Presidential pardon granted by Donald Trump; Ulbricht released from federal prison (executive clemency)

Realised extraction

About 26,000 BTC seized early October 2013 and 144,000 BTC reported seized on 2013-10-25 (about $28.5M) [slkroadwiki]``[slkroadforbes]. Disposition of proceeds beyond the 2014-06-27 auction lot is not established in the cited sources. Earlier text valued

Public references

Techniques demonstrated (2)