OAK — OnChain Attack Knowledge

Worked example · 2013

Silk Road "altoid" handle cross-layer de-anonymization — 2013

Loss
Attribution event, not financial loss. The "altoid" username cross-layer de-anonymization was the operational-security failure that enabled the FBI to identify Ross Ulbricht as Dread Pirate Roberts, the operator of Silk Road — the largest darknet marketplace of its era (~$1.2B in cumulative sales at later bitcoin prices, 2011–2013, per [wikisralt]).
OAK Techniques observed
OAK-T8.005 (Operational Security Procedural Failure) — canonical anchor. "altoid" promoted Silk Road on shroomery.org and bitcointalk.org in January 2011, and on 2011-10-11 posted on bitcointalk.org seeking an IT professional with replies directed to rossulbricht at gmail dot com, linking the operator persona to Ulbricht's real name by handle and email reuse ([nbcaltoid], [schneieraltoid]).
Attribution
confirmed — Ross Ulbricht was convicted on 2015-02-04 and sentenced on 2015-05-29; he received a full pardon on 2025-01-21 ([wikiulbrichtaltoid]). The "altoid" linkage was cited in the FBI's criminal complaint ([nbcaltoid]).
Corrected 2026-10-11
The Gmail address appeared in an October 2011 Bitcoin Talk post (not a shroomery post); a March 2012 Stack Overflow account is added; sentence and 2025 pardon added; the "laptop with DPR admin session active" detail is removed as unsourced here.
Key teaching point
The Silk Road "altoid" failure is the textbook T8.005 anchor: a single pseudonym reused across the clearweb and darknet surfaces linked the operator's anonymous marketplace persona to a verified real-world identity. The case established the operational template for law-enforcement attribution of darknet marketplace operators — cross-layer pseudonym correlation via OSINT, followed by physical-surveillance confirmation.

Summary

Ross Ulbricht operated Silk Road under the pseudonym "Dread Pirate Roberts" (DPR) from 2011 to 2013. Silk Road was a Tor-hidden-service marketplace facilitating approximately $1.2 billion in cumulative sales at later bitcoin prices (about $183 million at the time of the transactions), primarily for narcotics, using Bitcoin as the payment rail ([wikisralt]).

In January 2011 "altoid" promoted Silk Road on shroomery.org and, a few days later, on bitcointalk.org ([nbcaltoid]). On 2011-10-11 "altoid" posted on bitcointalk.org for an "IT pro in the Bitcoin community" and gave rossulbricht at gmail dot com as the contact ([nbcaltoid], [schneieraltoid]). IRS-CI agent Gary Alford found the "altoid" posts while searching for early mentions of the site ([wikiulbrichtaltoid]). A Stack Overflow account under the name Ross Ulbricht with the same email was created in early March 2012 ([schneieraltoid]).

The "altoid" linkage was cited in the criminal complaint. Ulbricht was arrested on 2013-10-01 at the Glen Park branch of the San Francisco Public Library ([wikiulbrichtaltoid]). The FBI said the server was in Reykjavik, Iceland, though security experts doubted its account of how it found it ([wikisralt]). Ulbricht was convicted on 2015-02-04 on all counts and sentenced on 2015-05-29 ([wikiulbrichtaltoid]).

Timeline (UTC)

When Event OAK ref
2011-01 "altoid" promotes Silk Road on shroomery.org, then bitcointalk.org ([nbcaltoid]) (clearweb pseudonym)
2011-10-11 "altoid" bitcointalk post gives rossulbricht at gmail dot com ([nbcaltoid]) T8.005 (pseudonym cross-layer linkage)
2012-03 Stack Overflow account created as Ross Ulbricht with the same email ([schneieraltoid])
2013-10-01 Ulbricht arrested at Glen Park Library, San Francisco ([wikiulbrichtaltoid]) (arrest)
2015-02-04 Ulbricht convicted on all counts ([wikiulbrichtaltoid]) (conviction)
2015-05-29 Sentenced; pardoned 2025-01-21 ([wikiulbrichtaltoid])

Public references

Techniques demonstrated (1)