OAK — OnChain Attack Knowledge

Worked example · 2013

Silk Road "altoid" handle cross-layer de-anonymization — 2013

Loss
Attribution event, not financial loss. The "altoid" username cross-layer de-anonymization was the operational-security failure that enabled the FBI to identify Ross Ulbricht as Dread Pirate Roberts, the operator of Silk Road — the largest darknet marketplace of its era (~$1.2B in cumulative transaction volume, 2011–2013).
OAK Techniques observed
OAK-T8.005 (Operational Security Procedural Failure) — canonical anchor. Ulbricht used the same pseudonym ("altoid") on bitcointalk.org and in a post to shroomery.org that included his personal Gmail address (rossulbricht@gmail.com), linking his darknet operator persona to his real-world identity via username reuse.
Attribution
confirmed — Ross Ulbricht was convicted in February 2015 following FBI investigation and trial. The "altoid" cross-layer linkage was a key evidence item in the FBI's criminal complaint.
Key teaching point
The Silk Road "altoid" failure is the textbook T8.005 anchor: a single pseudonym reused across the clearweb and darknet surfaces linked the operator's anonymous marketplace persona to a verified real-world identity. The case established the operational template for law-enforcement attribution of darknet marketplace operators — cross-layer pseudonym correlation via OSINT, followed by physical-surveillance confirmation.

Summary

Ross Ulbricht operated Silk Road under the pseudonym "Dread Pirate Roberts" (DPR) from 2011 to 2013. Silk Road was a Tor-hidden-service marketplace facilitating approximately $1.2 billion in cumulative transaction volume, primarily for narcotics, using Bitcoin as the payment rail.

Ulbricht's critical operational-security failure: in 2011, he used the handle "altoid" to promote Silk Road on bitcointalk.org (a clearweb Bitcoin forum) and on the Silk Road forum. The same "altoid" handle had been used earlier on shroomery.org (a clearweb psychedelics forum) in a post that included the email address rossulbricht@gmail.com. The FBI correlated the "altoid" posts across the two forums, linking the Silk Road promoter ("altoid") to a Gmail address bearing Ulbricht's real name.

The "altoid" linkage was included in the FBI's criminal complaint (September 2013) and was corroborated by physical surveillance, seized laptop evidence (FBI San Francisco field office arrest at Glen Park Library, October 2013), and server-seizure data (Silk Road server in Iceland). Ulbricht was convicted on multiple counts including money laundering, computer hacking, and conspiracy to traffic narcotics (February 2015) and sentenced to life in prison.

Timeline (UTC)

When Event OAK ref
2011-01 "altoid" posts on shroomery.org including rossulbricht@gmail.com (clearweb pseudonym)
2011-01/06 "altoid" promotes Silk Road on bitcointalk.org and Silk Road forum — same handle linked to DPR persona T8.005 (pseudonym cross-layer linkage)
2013-09 FBI criminal complaint filed; "altoid" linkage is a key probable-cause item (law enforcement)
2013-10 Ulbricht arrested at Glen Park Library, San Francisco; laptop seized with DPR admin session active (arrest)
2015-02 Ulbricht convicted on all counts; sentenced to life imprisonment (conviction)

Public references

  • FBI criminal complaint (September 2013): United States v. Ross William Ulbricht, Southern District of New York.
  • Trial evidence: "altoid" posts on bitcointalk.org, shroomery.org; server-seizure data from Silk Road Iceland server.
  • U.S. v. Ulbricht trial record and appellate decisions.

Techniques demonstrated (1)