{
  "id": "case-vallerius-oxymonster",
  "slug": "us-v-vallerius-oxymonster-dream-market",
  "title": "U.S. v. Gal Vallerius (Dream Market OxyMonster Administrator)",
  "summary": "Federal prosecution of French cybercriminal Gal Vallerius (known as OxyMonster), senior administrator and escrow vendor for Dream Market darknet marketplace, arrested at Atlanta Hartsfield-Jackson airport while traveling to the World Beard Championships and sentenced to 20 years in federal prison.",
  "case_number": "1:17-cr-20648-RNS",
  "court": "U.S. District Court for the Southern District of Florida",
  "district": "S.D. Fla.",
  "country": "France",
  "opened_at": "2017-09-01",
  "status": "sentenced",
  "victim_sector": "Darknet Marketplace & Narcotics",
  "victim_country": "International",
  "loss_amount_usd": 20000000,
  "loss_amount_note": "Forfeiture of 100 Bitcoins and 121 Bitcoin Cash to the United States Marshals Service.",
  "first_seen_at": "2015-01-01T00:00:00Z",
  "last_updated_at": "2026-10-06T10:00:00Z",
  "actor_slug": "unattributed-cybercrime",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1090",
      "evidence_excerpt": "Vallerius operated hidden Tor onion services to conceal server hosting locations while conducting darknet administration and cryptocurrency transactions.",
      "evidence_locator": "DEA Criminal Complaint \u00b6 14, Page 5",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "DOJ S.D. Fla. OxyMonster Sentencing Release",
      "source_url": "https://www.justice.gov/usao-sdfl/pr/french-national-sentenced-20-years-prison-role-dark-web-drug-trafficker-and-administrator",
      "technique_name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "technique_id": "T1557",
      "evidence_excerpt": "Operatives verified user credentials and moderated illicit vendor disputes through encrypted PGP signatures and darknet escrow balances.",
      "evidence_locator": "DOJ Plea Agreement \u00b6 9",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "DOJ Plea Agreement: U.S. v. Vallerius",
      "source_url": "https://www.justice.gov"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2017-08-31",
      "description": "DEA agents arrest Vallerius at Atlanta International Airport, finding PGP keys and Dream Market logins on his laptop."
    },
    {
      "event_type": "guilty_plea",
      "event_date": "2018-06-12",
      "description": "Vallerius pleads guilty to drug trafficking conspiracy and money laundering conspiracy."
    },
    {
      "event_type": "sentencing",
      "event_date": "2018-10-02",
      "description": "Federal judge sentences Vallerius to 20 years in prison and orders forfeiture of cryptocurrency."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Darknet marketplace administration and vendor escrow operations conducted across Tor hidden services by Dream Market senior moderator OxyMonster.",
    "blast_radius": "International darknet narcotics distribution hub dismantled, resulting in a 20-year federal prison sentence and forfeiture of 100 Bitcoins.",
    "kill_chain": [
      {
        "phase": "Darknet Operation",
        "title": "Tor Hidden Service Administration",
        "description": "Gal Vallerius operated encrypted Tor onion services to manage vendor disputes, escrow accounts, and narcotics sales on Dream Market.",
        "technical_artifacts": [
          "Tor onion service configs",
          "Dream Market moderator console"
        ],
        "mitre_technique_id": "T1090"
      },
      {
        "phase": "PGP Attribution",
        "title": "Cryptographic Key Attribution",
        "description": "Federal investigators matched PGP public keys and Bitcoin tip addresses from public forums to Vallerius online persona OxyMonster.",
        "technical_artifacts": [
          "PGP public key fingerprints",
          "Blockchain transaction graphs"
        ],
        "mitre_technique_id": "T1557"
      },
      {
        "phase": "Physical Interception",
        "title": "Airport Detainment & Laptop Seizure",
        "description": "DEA agents detained Vallerius at Atlanta Hartsfield-Jackson airport en route to the World Beard Championships, seizing his encrypted laptop.",
        "technical_artifacts": [
          "Seized MacBook",
          "Border search inspection"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Forensic Confirmation",
        "title": "Decrypted Tor Session Evidence",
        "description": "Forensic analysis of the seized machine confirmed active Dream Market administrative credentials and Tor browser configuration artifacts.",
        "technical_artifacts": [
          "Tor browser profile data",
          "Local PGP private keys"
        ],
        "mitre_technique_id": "T1005"
      },
      {
        "phase": "Federal Conviction",
        "title": "20-Year Prison Sentence & Crypto Forfeiture",
        "description": "Vallerius pleaded guilty in Miami federal court to drug trafficking and money laundering conspiracies, forfeiting 100 Bitcoins.",
        "technical_artifacts": [
          "DOJ plea agreement",
          "Cryptocurrency forfeiture order"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Never reuse cryptographic public keys or Bitcoin wallet addresses between commercial and anonymous identities.",
      "Implement full-disk hardware encryption and air-gapped signing keys for high-value administrative accounts.",
      "Recognize that network-layer Tor anonymity is defeated by operational security metadata linkage.",
      "Deploy multi-signature cold storage wallets for enterprise cryptocurrency custodial balances."
    ]
  }
}