DEA Arrests French Dream Vendor “OxyMonster”

According to DEA Special Agent Austin Love, probable cause existed to arrest a French citizen who has travelled to the United States to compete in a beard contest. The suspect, 38-year-old Gal Vallerius had landed at the Atlanta International Airport when law enforcement agents conducted a border search of Vallerius’s laptop. His laptop contained a private PGP key that belonged to a Dream Market and Traderoute Market vendor, Dream login credentials, and $500,000 in Bitcoin.

His interception in Atlanta was not a stroke of luck after the random search of an international traveler. The Drug Enforcement Administration had targeted Vallerius as early as January 2017, according to the criminal complaint filed on September 1 of this year. In Miami, Florida, the DEA targeted numerous Dream vendors. The criminal complaint named three vendors investigated in the operation: ReximusMaximus, DigitalPossi2014, and MethForDummies. After those three, the DEA agent wrote, focus shifted towards a vendor known as OxyMonster.

After an unusually brief investigation, the DEA connected OxyMonster to Gal Vallerius. The investigation began on the Dream Market homepage where Agents observed a link titled “forum.” Love described what happened after clicking the link, it “took them to a Tor website called Dream Market Forum.” Then, while browsing the Dream Market Forum, agents navigated to a topic called “Official Staff.” The post:

“Anyone that’s claiming to Mod or Admin who ‘s not on this list – should be reported
immediately.Admin: SpeedstepperSenior Moderator: OxyMonsterModerators: Quasimodo, FriedTheChickenTicket conductors: Xray, Spanishconnect ”
Senior Moderator @ Dream Market [Dream Market onion link]”

Several months later, in June, they discovered that OxyMonster also sold “Schedule 11 controlled substances.” (Yes, they claimed that it had taken months to connect the forum profile to the vendor profile). On OxyMonster’s vendor profile, the vendor provided the Bitcoin address for “Dream Team Staff” (lDREAMv7kl6T8bMyE7ghe4nLQVSdBbPJAe). He also linked to his TradeRoute profile.

On his TradeRoute vendor profile, he wrote that he had moderated on the Evo marketplace and that he currently functioned as an admin on the Dream Market.

To make a long and ultimately painful story short, officers traced the Bitcoin payments made to the allegedly official “Dream Team Staff” tip jar. The money eventually connected to a LocalBitcoins account with the username “vallerius.” The DEA searched social media (and undoubtedly elsewhere) for matches against Vallerius. And from this point onwards, the case unfolds look so many recent cases where compartmentalization seemingly slipped the vendor’s mind. His Instagram account, Twitter account, several random social media accounts, the URL “vallerius.com,” all provided investigators with information needed to connect Gal Vallerius to the LocalBitcoins account that connected to the OxyMonster Dream account.

The criminal complaint described how investigators compared the writing styles of OxyMonster and Vallerius. “Agents discovered many similarities in the use of words and punctuation, including: the word ‘cheers,’ double exclamation marks, frequent use of quotation marks, and intermittent French posts.”

When arrested at the Atlanta International Airport, en route to a beard competition in Texas, he carried all the evidence needed to further connect him to the darknet vendor. He had his pgp keys, 99.98 Bitcoin and 121.98 Bitcoin Cash wallets, his Dream login, and a Tor installation. He did not contest his identity or detention in an Atlanta court and will soon be transferred to Miami to face a drug dealing conspiracy indictment.

Share: