{
  "id": "case-ulbricht-silk-road",
  "slug": "us-v-ulbricht-silk-road",
  "title": "U.S. v. Ross Ulbricht (Silk Road Darknet Marketplace)",
  "summary": "Landmark prosecution of Ross Ulbricht, creator and operator of the Silk Road dark web marketplace, which processed hundreds of millions in anonymous Bitcoin transactions for illicit narcotics, computer hacking tools, and money laundering services. Federal agents seized over $3.3 billion in Bitcoin.",
  "case_number": "1:14-cr-00068",
  "court": "U.S. District Court for the Southern District of New York",
  "district": "S.D.N.Y.",
  "country": "United States",
  "opened_at": "2014-02-04",
  "status": "sentenced",
  "victim_sector": "Public Safety, E-Commerce, Controlled Substances",
  "victim_country": "United States",
  "loss_amount_usd": 3360000000,
  "loss_amount_note": "U.S. Government seized over 144,000 Bitcoins from Ulbricht's laptop, and subsequent civil forfeiture actions recovered over 50,000 additional Bitcoins valued at $3.36 billion.",
  "first_seen_at": "2011-01-15T00:00:00Z",
  "last_updated_at": "2026-09-10T12:00:00Z",
  "actor_slug": "dread-pirate-roberts",
  "defendant_slugs": [
    "ross-ulbricht"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1090",
      "evidence_excerpt": "Ulbricht designed the Silk Road website to operate exclusively as a Tor hidden service with .onion addresses, utilizing onion routing to obscure server IP locations and operator identities.",
      "evidence_locator": "Indictment \u00b6 6, Page 3",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Ulbricht",
      "source_url": "https://www.justice.gov/usao-sdny/pr/ross-ulbricht-aka-dread-pirate-roberts-sentenced-manhattan-federal-court-life-prison",
      "technique_name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "technique_id": "T1071.001",
      "evidence_excerpt": "The Silk Road platform incorporated automated Bitcoin tumbling and internal escrow wallets to break transactional linkages on the public blockchain.",
      "evidence_locator": "Trial Exhibit 122, Trial Transcript Page 842",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Trial Records: U.S. v. Ulbricht",
      "source_url": "https://www.courtlistener.com",
      "technique_name": "Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2013-10-01",
      "description": "FBI agents arrest Ulbricht at the Glen Park Public Library in San Francisco with his administrative laptop unencrypted."
    },
    {
      "event_type": "verdict",
      "event_date": "2015-02-04",
      "description": "Federal jury in Manhattan convicts Ulbricht on all seven counts including narcotics trafficking, computer hacking, and money laundering conspiracy."
    },
    {
      "event_type": "sentencing",
      "event_date": "2015-05-29",
      "description": "Judge Katherine Forrest sentences Ulbricht to two life terms plus 40 years imprisonment without parole."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Creation and multi-year operation of the Silk Road hidden service marketplace on the Tor darknet, processing over 9.5 million Bitcoins for illicit drugs, hacking tools, and money laundering.",
    "blast_radius": "Facilitated over $213 million in illegal transactions, leading to the landmark forfeiture of 144,000 Bitcoins from Ulbricht's laptop and an additional 50,000 Bitcoins seized from James Zhong, totaling over $3.3 billion.",
    "kill_chain": [
      {
        "phase": "Anonymized Ingress",
        "title": "Tor Hidden Service Architecture",
        "description": "Ulbricht designed the marketplace as a Tor .onion hidden service, utilizing onion routing cryptography to conceal the server physical IP location and operator identity.",
        "technical_artifacts": [
          "Tor .onion hidden service",
          "PGP encryption keys"
        ],
        "mitre_technique_id": "T1090"
      },
      {
        "phase": "Cryptocurrency Obfuscation",
        "title": "Internal Bitcoin Tumbling and Escrow",
        "description": "The Silk Road platform incorporated automated Bitcoin tumbling and micro-transaction mixing to break the chain of custody on the public Bitcoin blockchain.",
        "technical_artifacts": [
          "Bitcoin tumbling mixer",
          "Cold storage wallet clusters"
        ],
        "mitre_technique_id": "T1071.001"
      },
      {
        "phase": "Physical Apprehension",
        "title": "San Francisco Public Library Seizure",
        "description": "FBI agents arrested Ulbricht at a public library by staging a distraction behind him, seizing his Samsung laptop unencrypted while he was actively logged into the Silk Road Mastermind control panel.",
        "technical_artifacts": [
          "Samsung laptop",
          "Silk Road admin panel session"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Perform behavioral blockchain analytics (Chainalysis, Elliptic) to trace cryptocurrency clustering and mixer deposits.",
      "Ensure full-disk encryption requires continuous hardware token proximity or short timeout locks.",
      "Implement robust logging and audit trails for infrastructure management access.",
      "Train operational security protocols for sensitive administrative key custody."
    ]
  }
}