OAK — OnChain Attack Knowledge

Worked example · 2013-20

Off-chain opsec failure cohort enabling attribution — chain-agnostic (off-chain attribution surface) — 2013–2024

Loss
non-financial for direct victims; the "loss" in T8.005 cases is the attacker's loss of operational anonymity — the opsec failure enables attribution, arrest, prosecution, and (in seizure cases) asset forfeiture. The attacker's financial loss is the seized cryptocurrency, frozen exchange accounts, and forfeited infrastructure; the defender's gain is the prosecutable case. In cases where the opsec failure is corrected in a later operation (a revival under a new handle, a server relocated to a more favourable jurisdiction), the loss is the operational-intelligence value of the seized administrative database and the deterrent effect of the attribution.
OAK Techniques observed
OAK-T8.005 (Operational Security Procedural Failure — Non-Technical OpSec) — primary; the structural technique covering off-chain opsec failures that create attribution bridges between on-chain entities and real-world identities. Specific axes observed across the cohort: axis 1 (handle/identity reuse — Silk Road "altoid," AlphaBay "DeSnake", whose PGP key matched a former administrator), axis 3 (funding-exchange reuse — alleged in Bitcoin Fog/Sterlingov), axis 4 (physical-world — Silk Road library arrest; Hydra server hosting in Germany is OAK interpretation), axis 7 (infrastructure-procurement trail — alleged for Bitcoin Fog domain registration). OAK-T8.001 (Common-Funder Cluster Reuse) — the on-chain cluster layer that T8.005 attribution bridges complement: the on-chain funder graph identifies the operator cluster; T8.005 provides the off-chain attribution bridge that links the cluster to a named individual. OAK-T8.003 (On-Chain Transaction Graph De-Anonymization) — the on-chain transaction-graph analysis that traces operational Bitcoin/Ethereum flows to exchange-deposit points; the exchange-KYC subpoena return (T8.005 axis 3) completes the attribution chain.
Attribution
unattributed (aggregate cohort). Outcomes differ by case: Ulbricht (Silk Road) convicted 2015; Sterlingov (Bitcoin Fog) convicted 2024 in the District of Columbia; Son Jung-woo (Welcome to Video) convicted in South Korea but not extradited to the US; Hydra servers seized by the BKA in 2022; AlphaBay's 2021 revival operator unidentified in the sources cited. Attributing agencies include IRS-CI, FBI, HSI, DOJ and BKA.
Corrected 2026-10-11
Silk Road Gmail address appeared in an October 2011 Bitcoin Talk post (not a Stack Overflow edit); Bitcoin Fog was tried in the District of Columbia, not SDNY; Son Jung-woo was not extradited or convicted in the US (18 months was a South Korean sentence); AlphaBay's DeSnake was not attributed by law enforcement; Hydra database-seizure and Welcome to Video exchange-KYC details removed as unsourced; Ulbricht received a full pardon.
Key teaching point
T8.005 is the "attribution-completing" technique in the OAK T8 tactic — every T8.001 on-chain cluster and T8.003 transaction graph is only as attributionally strong as the off-chain procedure that links them to a physical-world identity. The on-chain analysis tells you WHAT happened and WHERE the funds went; the T8.005 analysis tells you WHO did it. No amount of on-chain clustering or transaction-graph tracing can produce an arrest warrant without a T8.005 bridge. Defenders who invest exclusively in on-chain T8 detection are producing intelligence products; the arrest warrant requires the off-chain opsec failure analysis that T8.005 documents.

Summary

The period 2013–2024 produced a cohort of high-profile cryptocurrency enforcement cases in which the load-bearing attribution evidence was not on-chain blockchain analysis but off-chain procedural operational security failure. The cases span darknet-marketplace operators (Silk Road, AlphaBay, Hydra), cryptocurrency mixing-service operators (Bitcoin Fog), and darknet content-platform operators (Welcome to Video), and collectively demonstrate that off-chain opsec failure — handle reuse, funding-exchange KYC trails, physical-server-hosting jurisdiction misalignment, domain-registration billing trails — is the highest-signal attribution surface for pseudonymous cryptocurrency operators, consistently outperforming on-chain analysis as the attribution-completing evidence.

The cohort's canonical case is Silk Road (2011–2013). Ross Ulbricht, operating as "Dread Pirate Roberts," used the handle "altoid" to promote Silk Road on shroomery.org in January 2011 and, a few days later, on bitcointalk.org; on 2011-10-11 "altoid" posted on Bitcoin Talk seeking an "IT pro in the Bitcoin community" and directed replies to "rossulbricht at gmail dot com" ([nbcsilkroad], [schneiersilkroad]). Reporting on the criminal complaint ([fbiulbrichtcomplaint2013]) also cites a Stack Overflow account created under the name Ross Ulbricht in early March 2012 with the same Gmail address, used to ask about code for a Tor hidden service ([schneiersilkroad], [nbcsilkroad]). IRS-CI agent Gary Alford's search for early mentions of the site traced the "altoid" posts to that email address ([wikisilkroad]). Ulbricht was arrested on 2013-10-01 at the Glen Park branch of the San Francisco Public Library ([wikisilkroad]). Earlier drafts of this paragraph also claimed that Ulbricht used the Gmail address for server-administration emails and had fake-ID documents shipped to his San Francisco address; neither claim is supported by the sources cited here and both are removed. The Silk Road case illustrates operator attribution through off-chain handle and email reuse.

The AlphaBay case (launched December 2014; taken down July 2017; relaunched August 2021) is cited here for handle continuity. Alexandre Cazes ("alpha02") was arrested in Bangkok on 2017-07-05 and reportedly found dead in his cell on 2017-07-12 ([wikialphabay]). In August 2021 a user calling himself "DeSnake" relaunched AlphaBay; Wired reported that he signed a message with the same PGP key as a former AlphaBay administrator ([wikialphabay], [flashpointalphabay]). Earlier drafts said law enforcement attributed DeSnake to a known administrator and cited a stylometric fingerprint; the cited sources describe no law-enforcement attribution and no stylometric analysis, and both claims are removed. DeSnake's real identity is not established in these sources, and the site went dark in February 2023 ([wikialphabay]).

The Bitcoin Fog case is cited as an on-chain mixer whose operator was convicted using blockchain analysis combined with other evidence. Roman Sterlingov, a Russian-Swedish national, was charged with operating Bitcoin Fog from 2011 to 2021, laundering over 1.2 million BTC, about $400 million at the time ([occrpfog]). He was arrested in April 2021 at Los Angeles International Airport and convicted in March 2024 by a federal jury in the District of Columbia (not the Southern District of New York) ([occrpfog]). Prosecutors said blockchain analysis can identify a bitcoin owner and reveal other accounts the same person controls ([occrpfog]); the court admitted Chainalysis Reactor expert testimony and noted the government's theory did not rest on Reactor alone ([mlnfog]). Press accounts say prosecutors tied the domain registration, paid through a multistep process with burner emails, to Sterlingov, with a Mt. Gox account transaction as one link; the defense disputed this and said it would appeal ([bnnfog], [mlnfog]). The earlier claim that Bitcoin Fog defeated on-chain analysis and was beaten purely by off-chain procurement and exchange-KYC failures is not supported by these sources and is removed.

The Welcome to Video case concerns a darknet child-exploitation site, run from South Korea, that took cryptocurrency payments. IRS-CI found cryptocurrency transactions linked to the site and the server's IP address embedded in its source code, which showed it was operating from South Korea; HSI passed information to the Korean National Police Agency, which arrested Son Jung-woo (also spelled Jong-woo) in March 2018 ([wikiwtv]). The site received roughly ₩400 million (~$360,000) in cryptocurrency from about 4,000 paid members ([wikiwtv]). Son was sentenced in South Korea (a second-trial sentence of one and a half years in 2019, and in 2022 a further 24 months for concealing proceeds); he was indicted in the US in October 2019 on nine charges, but a Seoul court denied the US extradition request on 2020-07-06, so he was not extradited to or convicted in the United States ([wikiwtv], [asiaeconwtv]). Earlier drafts' claims of a 420 BTC figure, an exchange-KYC subpoena return identifying Son, and a US conviction with an 18-month sentence are not supported by the cited sources and are removed.

The Hydra case is cited for server seizure. Hydra, the largest Russian-language darknet market, launched in early 2015 and, per TRM Labs, generated over $1 billion annually from 2019 to 2021 ([trmhydra]); other reporting puts total receipts at about $5.2 billion ([techtargethydra]). Germany's BKA, working with US law enforcement, raided buildings housing the Hydra servers and seized 543 BTC, about €23 million ([trmhydra], [techtargethydra]). The sources cited do not state that a full administrative database was obtained, and they do not describe an operator opsec failure; the earlier framing of German hosting as an operator opsec failure and the database-seizure claim are removed or should be read as OAK interpretation, not sourced fact.

Timeline (UTC)

When Event OAK ref
2011-01 Ross Ulbricht uses "altoid" handle on BitcoinTalk to promote Silk Road T8.005 axis 1 (handle reuse — operational context)
2011-10-11 "altoid" Bitcoin Talk post seeks an IT pro and gives rossulbricht at gmail dot com ([nbcsilkroad]) T8.005 axis 1 (handle reuse bridge to real identity)
2012-03 (early) Stack Overflow account created as Ross Ulbricht with the same Gmail address ([schneiersilkroad]) T8.005 axis 1
2011 Bitcoin Fog begins operating (charged period 2011–2021) ([occrpfog])
2013-10-01 FBI arrests Ulbricht at the Glen Park branch of the San Francisco Public Library ([wikisilkroad]); the complaint cites the altoid handle bridge T8.005 axes 1, 4 (handle reuse + physical-access pattern)
2014-12-22 AlphaBay officially launches ([wikialphabay])
2015 Hydra darknet marketplace launches; server infrastructure hosted in Germany T8.005 axis 4 (physical-hosting jurisdiction misalignment)
2015–2018 Welcome to Video operates; IRS-CI traces cryptocurrency transactions to the site ([wikiwtv]) T8.003 (on-chain transaction graph)
2017-07-05 AlphaBay operator Alexandre Cazes arrested in Thailand; reportedly found dead 2017-07-12 ([wikialphabay])
2018-03 Son Jung-woo arrested in South Korea ([wikiwtv]) T8.003 (on-chain trace)
2020-07-06 Seoul court denies US extradition request ([wikiwtv])
2021-04 Roman Sterlingov arrested at Los Angeles International Airport ([occrpfog])
2021-08 AlphaBay relaunched by "DeSnake"; same PGP key as a former administrator per Wired ([wikialphabay]) T8.005 axis 1 (handle continuity)
2022-04-05 BKA seizes Hydra servers and 543 BTC ([trmhydra]) T8.005 axis 4 (physical-server seizure)
2024-03-12 Sterlingov convicted by a federal jury in the District of Columbia ([occrpfog]) T8.005 (adjudicated attribution outcome)

Realised extraction

The attacker's loss in each case is the loss of operational anonymity and the consequent legal consequences:

  • Silk Road (Ulbricht): ~144,000 BTC seized by FBI (2013-10), life imprisonment sentence (2015-05-29; full pardon 2025-01-21, [wikiulbricht]).
  • Bitcoin Fog (Sterlingov): Sterlingov convicted March 2024 in the District of Columbia; forfeited seized assets including 1,354 BTC ([occrpfog]).
  • Welcome to Video (Son): ₩400 million ($360,000) received; Son sentenced in South Korea; US extradition denied ([wikiwtv]).
  • Hydra: servers raided and 543 BTC (~€23 million) seized by the BKA (April 2022) ([trmhydra]).
  • AlphaBay (2017 takedown): Cazes arrested and later found dead ([wikialphabay]). AlphaBay (2021 revival): operator unidentified in the cited sources.

The structural loss is not the seized funds but the attribution bridge: in each case, the off-chain opsec failure provided evidence that was sufficient for an arrest warrant and criminal charges — evidence that on-chain analysis alone could not have produced.

The T8.005 attribution workflow (cross-layer integration)

The cohort cases reveal a consistent attribution workflow that integrates T8.001, T8.003, and T8.005:

  1. T8.003 (on-chain transaction graph de-anonymization): trace the operational Bitcoin/Ethereum flows from the platform's wallet infrastructure to exchange-deposit points using co-spend heuristic, change-address detection, and exchange-deposit-address clustering. This identifies the exchange accounts receiving the operational proceeds.
  2. T8.005 axis 3 (funding-exchange KYC subpoena): subpoena the receiving exchanges for KYC records of the deposit-address owners. This produces a real-world identity candidate. (Exchange-KYC subpoenas as the bridge are not established by the sources cited for Welcome to Video or Bitcoin Fog; see the corrected case paragraphs above.)
  3. T8.005 axis 1 (handle cross-referencing): for darknet-marketplace operators, cross-reference operational handles across forums, WHOIS records, domain-registration databases, and social-media platforms. Flag matches where the operational handle appears in non-operational contexts that carry PII. (Silk Road, AlphaBay — the highest-signal axis.)
  4. T8.005 axis 7 (infrastructure-procurement trail): trace domain registrations, server-hosting payments, and VPN/VPS subscriptions to billing identities via subpoena to registrars, hosting providers, and payment processors. (Bitcoin Fog: prosecutors cited a domain-registration trail per [bnnfog]; not established for Welcome to Video.)
  5. T8.005 axis 4 (physical-access pattern / physical-hosting jurisdiction): for operators under physical surveillance, correlate access patterns with known individual routines. For infrastructure-hosted cases, the hosting jurisdiction provides the seizure authority. (Silk Road library arrest; Hydra German server seizure is not shown by the cited sources to be an operator opsec failure.)
  6. T8.001 (on-chain funder-graph clustering): the on-chain cluster analysis provides the operator profile that the T8.005 axes attribute to a real-world identity. The T8.001 cluster is the "what"; T8.005 provides the "who."

The operational lesson from the cohort is that the full attribution chain requires ALL layers: on-chain clustering (T8.001), on-chain transaction-graph analysis (T8.003), and off-chain opsec failure analysis (T8.005). An investigation that stops at the T8.001 cluster identification has an intelligence product; an investigation that stops at the T8.003 exchange-deposit identification has a subpoena target; an investigation that completes the T8.005 attribution bridge has an arrest warrant.

Public references

Techniques demonstrated (3)