From The Big Story: Inside the Bitcoin Bust That Took Down the Web's Biggest Child Abuse Site

Listen to more of The Big Story here: ⁠⁠⁠⁠http://swap.fm/l/wi-bigstorypod-feeddrop They thought their payments were untraceable. They couldn’t have been more wrong. The untold story of the case that shredded the myth of Bitcoin’s anonymity. Written by Andy Greenberg. Originally published on April 7th, 2022. For more of the most ambitious, future-defining stories from our favorite human writers, subscribe to The Big Story newsletter: https://www.wired.com/newsletter/the-big-story Learn more about your ad choices. Visit podcastchoices.com/adchoices

• 0:05Speaker 00

  This is the big story from Wired. You're listening to Inside the Bitcoin Bust That Took Down the Web's Biggest Child Abuse Site, written by Andy Greenberg, originally published on April 7, 2022. They thought their payments were untraceable. They couldn't have been more wrong. The Untold Story of the Case That Threated the Myth of Bitcoin's Anonymity.

• 0:32Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions, it needs limits. Control AI with zero trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 1:11Speaker 02

  Host Thanksgiving with industry-leading quality standards from Whole Foods Market. There are no antibiotics in their meat department, ever, so carve up turkey and spiral-cut ham with peace of mind. Shop organic sides like stuffing mix and cranberry sauce from 365 brand. And guess what? All their delectable pies are made with no high-fructose corn syrup. Gourmet Thanksgiving flavors with the quality you want, only at Whole Foods Market.

• 1:40Speaker 03

  Done settling for close enough? DXL Big & Tall has the sizes, the fit, and the brands you already love, plus quality you can feel, at a price that makes sense. We're talking sizes XL to 8XL, waists 38 to 60, and over 75 brands, all in one place. Finally, no more settling. Just clothes that actually fit Big & Tall guys right. Shop DXL.com or visit one of the 250 stores nationwide. DXL: Wear what you want.

• 2:11Speaker 00

  Content Warning: The story told here includes references to suicide and child abuse, though the abuse is not graphically described. Chapter 1: Divining Rod Early one fall morning in 2017, in a middle-class suburb of the outskirts of Atlanta, Chris Janczewski stood alone inside the doorway of a home he had not been invited to enter. Moments earlier, armed Homeland Security Investigations Agents in ballistic vests had taken up positions around the tidy two-story brick house, banged on the front door, and when a member of the family living there opened it, swarmed inside.

• 2:54Speaker 00

  Janczewski, an Internal Revenue Service criminal investigator, followed quietly behind. Now he found himself in the entryway, in the eye of a storm of activity, watching the agents search the premises and seize electronic devices. They separated the family, putting the father, an assistant principal at the local high school, and the target of their investigation in one room; his wife in another; the two kids into a third. An agent switched on a TV and put on Mickey Mouse Clubhouse in an attempt to distract the children from the invasion of their home and the interrogation of their parents. Janczewski had come along on this raid only as an observer, a visitor flown in from Washington,

• 3:38Speaker 00

  DC, to watch and advise the local Homeland Security Team as it executed its warrant. But it had been Janczewski's investigation that had brought the agents here, to this average-looking house with its well-kept yard among all the average-looking houses they could have been searching, anywhere in America. He had led them there, based on a strange, nascent form of evidence. Janczewski had followed the links of Bitcoin's blockchain, pulling on that chain until it connected this ordinary home to an extraordinarily cruel place on the internet, and then connected that place to hundreds more men around the world, all complicit in the same massive

• 4:22Speaker 00

  network of unspeakable abuse. All now, on Janczewski's long list of targets. Over the previous few years, Janczewski, his partner Tigran Gambaryan, and a small group of investigators at a growing roster of three-letter American agencies, had used this newfound technique: tracing a cryptocurrency that once seemed untraceable, to crack one criminal case after another on an unprecedented epic scale. But those methods had never led them to a case quite like this one, in which the fate of so many people, victims and perpetrators alike, seemed to hang on the findings of this novel form of forensics.

• 5:05Speaker 00

  That morning's search, in the suburb near Atlanta, was the first moment when those stakes became real for Janczewski. It was, as he would later put it, "a proof of concept." From where Janczewski was positioned, at the front of the house, he could hear the Homeland Security Agents speaking to the father, who responded in a broken, resigned voice. In another room, he overheard the agents questioning the man's wife. She was answering that, yes, she'd found certain images on her husband's computer, but he'd told her he had downloaded them by accident when he was pirating music. And in the third room, he could hear the two grade-school-aged children, kids about

• 5:47Speaker 00

  as old as Janczewski's own, watching TV. They asked for a snack, seemingly oblivious, to the tragedy unfolding for their family. Janczewski remembers the gravity of the moment hitting him. This was a high school administrator, a husband and a father of two. Whether he was guilty or innocent, the accusations this team of law enforcement agents were leveling against him, their mere presence in his home would almost certainly ruin his life. Janczewski thought again of the investigative method that had brought them there, like a digital divining rod, revealing a hidden layer of illicit connections underlying the visible world.

• 6:30Speaker 00

  He hoped, not for the last time, that it hadn't led him astray. On a summer's day in London a few months earlier, a UK-born tech entrepreneur named Jonathan Levin had walked into the unassuming brick headquarters of the UK's National Crime Agency, Britain's equivalent to the FBI, on the south bank of the Thames. A friendly agent led him to the building's second floor and through the office kitchen, offering him a cup of tea. Levin accepted, as he always did on visits to the NCA, leaving the teabag in. The two men sat, cups in hand, at the agent's desk in a collection of cubicles. Levin was there on a routine customer visit, to learn how the agent and his colleagues

• 7:14Speaker 00

  were using the software built by the company he'd co-founded. That company, Chainalysis, was the world's first tech firm to focus solely on a task that a few years earlier might have sounded like an oxymoron: tracing cryptocurrency. The NCA was one of the dozens of law enforcement agencies around the world that had learned to use Chainalysis's software to turn the digital underworld's preferred means of exchange into its Achilles' heel. When Bitcoin first appeared in 2008, one fundamental promise of the cryptocurrency was that it revealed only which coins reside at which Bitcoin addresses: long, unique

• 7:55Speaker 00

  strings of letters and numbers, without any identifying information about those coins' owners. This layer of obfuscation created the impression among many early adherents that Bitcoin might be the fully anonymous internet cache long awaited by libertarian cipher punks and crypto anarchists, a new financial netherworld where digital briefcases full of unmarked bills could change hands across the globe in an instant. Satoshi Nakamoto, the mysterious inventor of Bitcoin, had gone so far as to write that "participants can be anonymous" in an early email describing the cryptocurrency.

• 8:36Speaker 00

  And thousands of users of dark web black markets like Silk Road had embraced Bitcoin as their central payment mechanism. But the counterintuitive truth about Bitcoin, the one upon which Chainalysis had built its business, was this: every Bitcoin payment is captured in its blockchain, a permanent, unchangeable, and entirely public record of every transaction in the Bitcoin network. The blockchain ensures that coins can't be forged or spent more than once, but it does so by making everyone in the Bitcoin economy a witness to every transaction. Every criminal payment is, in some sense, a smoking gun in broad daylight.

• 9:20Speaker 00

  Within a few years of Bitcoin's arrival, academic security researchers, and then companies like Chainalysis, began to tear gaping holes in the masks separating Bitcoin users' addresses and their real-world identities. They could follow Bitcoins on the blockchain as they moved from address to address, until they reached one that could be tied to a known identity. In some cases, an investigator could learn someone's Bitcoin address by transacting with them, the way an undercover narcotics agent might conduct a buy-and-bust. In other cases, they could trace a target's coins to an account at a cryptocurrency exchange where financial regulations required users to prove their identity.

• 10:04Speaker 00

  Un rápido juicio para el intercambio de uno de los clientes de Chainalysis en la policía fue suficiente para deshacerse de cualquier ilusión de la anonimidad de los bitcoins. Chainalysis combinaba estas técnicas para desanonymar a los usuarios de los bitcoins con métodos que le permitían clústerar las direcciones, mostrando que cualquier lugar, desde decenas hasta millones de direcciones, a veces pertenecían a una sola persona o organización. Cuando se gastaban bitcoins de dos o más direcciones en una sola transacción, por ejemplo, revelaba que quien creó esa transacción multi entrada tiene que tener el control de las direcciones de ambos prestadores, permitiendo que Chainalysis las colapsara en una identidad única.

• 10:48Speaker 00

  En otros casos, Chainalysis y sus usuarios podrían seguir una cadena de desgaste, un proceso similar a la rastreando un solo montón de dinero mientras un usuario lo sacaba repetidamente, desgastaba unos pocos billetes y lo ponía de nuevo en un bolsillo diferente. En esas cadenas de desgaste, los bitcoins se alejarían de una dirección mientras una fracción se pagaba a un recibidor y luego el resto se devolvía al prestador en una dirección de cambio. Distinguir esas direcciones de cambio podría permitir que un investigador siga una suma de dinero mientras saltaba de una dirección a la siguiente, trazando su camino a través del ruido de la blockchain de los bitcoins. Gracias a trucos como estos, Bitcoin se mostró prácticamente el opuesto de inaludible,

• 11:33Speaker 00

  un tipo de calefacción para criminales de criptomonedas que habían, durante años, recortado y inaludablemente grabado evidencia de sus tratos sucios. En 2017, agencias como la FBI, la Administración de la Enfermedad Drugal y la División de Investigación Criminal del Servicio de Investigación de la Région, o IRSCI, habían rastreado las transacciones de los bitcoins para llevar a cabo una corte investigativa tras otra, muy a menudo con la ayuda de Chainalysis. Los casos comenzaron pequeños y luego ganaron un impulso furioso. Los investigadores habían rastreado las transacciones de dos agentes federales corruptos para mostrar que antes del desmantelamiento de la Ruta Silca, uno había robado bitcoins

• 12:18Speaker 00

  de ese mercado de la web oscura y el otro había vendido el intel de la policía a su creador, Ross Ulbricht. Después, rastrearon medio millón de dólares de bitcoins robados del intercambio de la Mount Gox y mostraron que los procedimientos habían sido robados por el administrador ruso de otro intercambio de criptomonedas, BTC-E, eventualmente localizando los servidores del intercambio en Nueva Jersey. Y finalmente, siguió los rastros de los bitcoins para localizar la identidad del fundador de AlphaBay, un mercado de la web oscura que había crecido a diez veces la tamaño de la Ruta Silca. De hecho, incluso mientras Levin estaba sentado en Londres hablando con el agente de la NCA,

• 13:01Speaker 00

  una coalición de medio decen de agencias de la policía se estaba convergiendo en Bangkok para arrestar al creador de AlphaBay. Levin fue, como siempre, en la mira para la próxima gran investigación de Chainalysis. Después de analizar algunos casos abiertos con él, el agente de la NCA mencionó un sitio en la web oscura que recientemente había llegado al radar de la agencia. Se llamaba Welcome to Video. La NCA había atravesado el sitio en medio de un caso horrible involucrando a un delincuente llamado Matthew Falder. Un académico basado en Manchester, Inglaterra, Falder se presentaría como artista femenino

• 13:41Speaker 00

  y solicitaría fotos desnudas de extraños en Internet, luego amenazaba con compartir esas imágenes con familia o amigos a menos que los víctimas se grabaran realizando actos cada vez más desagradables y depravidos. En última instancia, forzaría a sus víctimas a cometer daño a sí mismos y incluso abusar sexualmente a otros en cámara. Al tiempo que fue arrestado, había atacado a 50 personas, al menos tres de las cuales habían intentado suicidarse. En los computadores de Falder, la NCA encontró que era un usuario registrado de Welcome to Video, una empresa criminal que, por su escala, ponía incluso las atrocidades de Falder en la sombra.

• 14:22Speaker 00

  Este indicio evidente luego se vendió de la equipo de investigación de explotación de niños de la NCA a la equipo de crimen de computadoras, incluyendo al agente de criptomoneda enfocado a quien despierta ahora. Welcome to Video, parecía, era uno de los raros sitios que vendían acceso a clips de abuso sexual infantil en cambio de bitcoin. Fue claro a un vistazo que su biblioteca de imágenes y videos era poco común y que estaba siendo accedido y frecuentemente renovado con material nuevo de nuevo por una gran base de usuarios en todo el mundo. A veces conocido como pornografía infantil, la clase de imágenes que traficaba en Welcome

• 15:07Speaker 00

  to Video se ha vuelto cada vez más llamada material de abuso sexual infantil por defensores de niños y la policía, para deshacerse de cualquier duda de que involucra actos de violencia contra niños. CSAM, como es usualmente abreviado, había durante años representado una gran submarcha de la web oscura, la colección de miles de sitios web protegidos por software de anonimidad como Tor y I2P. Esos instrumentos de anonimidad utilizados por millones de personas en todo el mundo buscando evitar la vigilancia online también han venido a servir como la infraestructura oscura para una red de abuso abrumadora, que muy a menudo fuejó los intentos de la policía

• 15:50Speaker 00

  de identificar visitantes o administradores de los sitios de CSAM. El agente de la NCA mostró a Levin una dirección de bitcoin que la agencia determinaba que era parte de la red financiera de Welcome to Video. Levin sugirió que lo cargara en el software de rastreo de Chainalysis, conocido como Reactor. Sostuvo su taza de té, levantó su mesa al laptop del agente y comenzó a trazar la colección de direcciones del sitio en la blockchain de los bitcoins, representando los bolsillos donde Welcome to Video había recibido pagos de miles de clientes. Se dolió de lo que vio. Muchos de los usuarios de este sitio de abuso infantil y, por todas sus apariencias, sus administradores

• 16:35Speaker 00

  habían hecho casi nada para esconder sus rastros de criptomoneda. Una red completa de pagos criminales, todos pretendidos ser secretos, estaba descubierto antes de él. Durante años, Levin había visto a algunos operadores de la web oscura acostumbrarse a ciertos de sus propios trucos de rastreo de criptomonedas. Pasaban su dinero a través de numerosos intermedios o servicios de mezclador diseñados para deshacer a los investigadores o usar la moneda criptomoneda, diseñada para ser mucho más difícil de rastrear. Pero mirando el clúster de Welcome to Video en el oficina de la NCA ese día, Levin podía ver inmediatamente que sus usuarios eran mucho más ingenuos.

• 17:16Speaker 00

  Muchos simplemente compraron bitcoins de intercambios de criptomonedas y luego los enviaron directamente de sus propios bolsillos a Welcome to Video. El contenido de los bolsillos de los sitios web, en cambio, había sido liquidado en solo unos intercambios, Bit Thumb y Coin One en Corea del Sur, Hobi en China, donde se convirtieron de nuevo en moneda tradicional. Parecía que alguien estaba continuamente usando transacciones multi entrada grandes para recoger los fondos del sitio y luego gastarlos. Esto hizo fácil el trabajo para Reactor de clústerar miles de direcciones de forma instantánea y automática, determinando que todos pertenecían a un único servicio, que ahora podía etiquetar en el software como Welcome to Video.

• 18:01Speaker 00

  Además, Levin podía ver que la constelación de intercambios que rodean y conectan a ese clúster probablemente mantuvo los datos necesarios para identificar una amplia gama de los usuarios anónimos del sitio, no simplemente quién gastaba bitcoins del sitio, sino quién estaba comprando bitcoins para ponerlos en él. Los vínculos de la blockchain entre Welcome to Video y sus clientes eran algunas de las conexiones más claramente incriminantes que Levin había visto jamás. Estos clientes de abuso sexual infantil parecían estar completamente preparados para el estado financiero moderno de la blockchain. Con los estándares de la jugada de perro y gato que Levin había jugado durante años,

• 18:42Speaker 00

  Welcome to Video era como un rodante sin llave que nunca había encontrado a un predador. Mientras sentaba frente al laptop del agente de la NCA, se daba cuenta, quizás más claramente que nunca antes, de que estaba viviendo en una era dorada de rastreo de criptomonedas, que los investigadores de la blockchain, como los de Chainalysis, habían ganado un indicio significativo sobre los que estaban atacando. "Hemos creado algo extremadamente poderoso y estamos un paso por delante de estos tipos de operadores", recordaba pensando. "Tienes un crimen feo, una cosa terrible en el mundo y en un instante nuestra tecnología ha pasado y revelado en muy clara lógica quién lo está detrás".

• 19:27Speaker 00

  Viendo que alguien estaba gastando la mayoría de los ingresos de Welcome to Video a través de los dos intercambios en Corea del Sur, Levin ya podía suponer que el administrador estaba muy probablemente localizado allí. Muchos de los usuarios del sitio parecían estar pagando directamente al sitio a través de las direcciones donde habían comprado los coins, en intercambios como Coinbase y Circle, basados en Estados Unidos. Bajar esta red global de abuso infantil podría requerir solo obtener otra agencia de la policía en los Estados Unidos o Corea, una que pudiera exigir identificar detalles de esos intercambios, y Levin tenía solo la agencia en mente. "Tengo algunas personas que estarían interesadas", dijo a su anfitrión de la NCA.

• 20:11Speaker 00

  Pero primero, mientras se preparaba para irse, Levin silenciosamente memorizó los primeros cinco caracteres de la dirección de Welcome to Video que el agente le mostró. El software de Reactor de Chainalysis incluía una función que podía completar automáticamente las direcciones de bitcoins basadas en sus primeros pocos números o letras. Cinco sería suficiente, un solo contraseña corta para desbloquear la mapa de vida de una conspiración criminal global.

• 20:40Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions, it needs limits. Control AI with zero trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 21:09Speaker 02

  Host Thanksgiving with industry-leading quality standards from Whole Foods Market. There are no antibiotics in their meat department, ever, so carve up turkey and spiral-cut ham with peace of mind. Shop organic sides like stuffing mix and cranberry sauce from 365 brand. And guess what? All their delectable pies are made with no high-fructose corn syrup. Gourmet Thanksgiving flavors with the quality you want, only at Whole Foods Market.

• 21:38Speaker 04

  PrizePix packs are here. Rip digital packs and get real basketball, footfall, and Pokemon cards on PrizePix packs. Available now nationwide. Once you see your pool, you have a choice to sell back instantly for real cash or ship at home. Cash from your sale will immediately be added to your PrizePix balance. It's just another way to run your game. New users, download the PrizePix app today and use code SPOTIFY to get $25 instantly in bonus packs when you buy your first $5 pack. PrizePix, run your game. 18-plus eligible areas. Terms apply. Collect responsibly.

• 22:10Speaker 00

  Chapter 2. Search Videos. It was evening in Thailand when Levin spoke with Chris Gencheski and Tigran Gambarian. That night, in early July 2017, the two IRS Criminal Investigation Special Agents were sitting in Bangkok's Suanapoom Airport, stewing over the frustration of being sidelined from the biggest dark web market takedown in history. The IRS, by 2017, had come to possess some of the most adept cryptocurrency tracers in the US government. It was Gambarian, in fact, who had traced the Bitcoins of the two corrupt agents in

• 22:50Speaker 00

  the Silk Road investigations, and then cracked the BTC-E money laundering case. Working with Levin, Gambarian had even tracked down the AlphaBay server, locating it at a data center in Lithuania. Yet, when Gambarian and Gencheski had come to Bangkok for the arrest of AlphaBay's administrator, the French-Canadian Alexander Koz, they had been largely excluded from the inner circle of DEA and FBI agents who ran the operation. They hadn't been invited to the scene of Koz's arrest, or even to the office where other agents and prosecutors watched a video livestream of the takedown. For Gambarian and Gencheski, the story was utterly typical.

• 23:35Speaker 00

  IRS CI agents did shoe-leather detective work, carried guns, and made arrests, just like their FBI and DEA counterparts. But because of the IRS's dowdy public image, they often found that fellow agents treated them like accountants. "Don't audit me," their peers from other law enforcement branches would joke when they were introduced in meetings. Most IRS CI agents had heard the line enough times that it warranted an instant eye roll. At loose ends in Bangkok, Gambarian and Gencheski spent much of their time idly contemplating what their next case should be, browsing through Chainalysis's blockchain tracing software, Reactor, to brainstorm ideas.

• 24:19Speaker 00

  Dark web markets like AlphaBay seemed to have been reduced to a shambles by the Thailand operation, and they'd take months, or even years, to recover. The agents considered taking on a dark web gambling site, but illegal online casinos hardly seemed worth their attention. On the day of their departure from Thailand, Gambarian and Gencheski arrived at the airport only to find that their flight to DC was badly delayed. Stuck in the terminal, with hours to kill, they sat half-awake and bored, literally staring at the wall. To pass the hours, Gambarian decided to try calling Chainalysis's Levin to discuss next cases.

• 25:01Speaker 00

  When Levin picked up the phone, he had news to share. He'd been looking into a website that didn't fit among the IRS's usual targets, but that he hoped they'd be willing to check out. Welcome to Video. Child exploitation cases had traditionally been the focus of the FBI and Homeland Security investigations, certainly not the IRS. In part, that was because child sexual abuse images and videos were most often shared without money changing hands, in what investigators described as "a baseball card trading system", which put them outside the IRS's domain. Welcome to Video was different.

• 25:43Speaker 00

  It had a money trail, and it seemed to be a very clear one. Soon after they arrived back in DC, Gambarian and Gencheski enlisted a technical analyst named Aaron Bice from a contact technology firm called Exigent, with whom they'd investigated the crypto exchange BTC-E. Together, they charted out Welcome to Video in Reactor and saw what Levin had recognized right away: how glaringly it presented itself as a target. Its entire financial anatomy was laid before them: thousands of clustered Bitcoin addresses, many with barely concealed pay-ins and cash-outs at exchanges they knew they could squeeze for identifying information.

• 26:28Speaker 00

  It did indeed look, as Levin said, "like a slam dunk." In short order, Gencheski brought the case to Zia Faruki, a federal prosecutor who was instantly sold on the idea of taking on Welcome to Video and formally opened an investigation. Gambarian, Gencheski, Bice, and Faruki made an unlikely team to focus on busting a massive child exploitation network. Gencheski was a tall, midwestern agent with a square jaw, like a hybrid of Sam Rockwell and Chris Evans, who wore horn-rimmed glasses when looking at a computer screen. He'd been recruited to the DC Computer Crimes Team from the IRS office in Indiana after

• 27:12Speaker 00

  proving his mettle in a grab-bag of counterterrorism, drug trafficking, government corruption, and tax evasion cases. Bice was an expert in data analysis and was, as Gencheski described his computer skills, "part robot." Faruki was a seasoned assistant US attorney with a long history of national security and money laundering prosecutions. He had an almost manic focus and intensity, spoke in a comically rapid patter, and, it seemed to his colleagues, barely slept. And then there was Gambarian, an agent with buzzed hair and a trimmed beard, who by 2017

• 27:53Speaker 00

  had made a name for himself as the IRS's cryptocurrency whisperer and dark web specialist. Faruki called him "Bitcoin Jesus." Yet none of the four had ever worked a child sexual exploitation case. They had no training in handling images and videos of child abuse, whose mere possession in the hands of normal Americans represented a felony. They had never seen these sorts of radioactively disturbing materials, and they had no emotional or psychological preparation for the graphic nature of what they were about to be exposed to. Still, when the two agents showed Faruki what they saw in the blockchain, the prosecutor

• 28:37Speaker 00

  was undeterred by their collective inexperience in the realm of child exploitation. As an attorney who focused on money laundering cases, he saw no reason why, with the evidence of criminal payments Gencheski and Gambarian had handed him, they couldn't approach Welcome to Video as fundamentally a financial investigation. "We're going to treat this case like we would any other," he said. "We are going to investigate this by following the money." When Gencheski and Gambarian first copied the unwieldy web address, mt3plrzdyyqf6jim. onion

• 29:20Speaker 00

  to their Tor browsers, they were greeted by a bare-bones site with only the words "Welcome to Video" and a login prompt. A minimalism Gencheski compared to the Google homepage. They each registered a username and password and entered. Past that first greeting page, the site displayed a vast, seemingly endless collection of video titles and thumbnails, arrayed in squares of four stills per video. Apparently chosen automatically from the file's frames, those small images were a catalog of horrors, scene after scene of children being sexually abused and raped.

• 30:04Speaker 00

  The agents had steeled themselves to see these images, but they were still unprepared for the reality. Gencheski remembers the blank shock he felt at the parade of thumbnails alone, the way his brain almost refused to accept what it was seeing. He found that the site had a search page with the misspelled words "Sarok videos" written on top of it. Below the search field, it listed popular keywords users had entered. The most popular was an abbreviation for "one-year-old." The second most popular was an abbreviation for "two-year-old." Gencheski at first thought he must have misunderstood.

• 30:46Speaker 00

  He had expected to see recordings of the sexual abuse of young teenagers, or perhaps preteens, but as he scrolled, he found, with mounting revulsion and sadness, that the site was heavily populated with videos of abuse of toddlers and even infants.

• 31:06Speaker 00

  "This is a thing, really?" "No," Gancheski says, numbly recounting his reactions as he first browsed the site. "Oh, there's this many videos on here." "No, this can't be real." The two agents knew that, at some point, they would have to actually watch at least some of the advertised videos. But mercifully, on their first visits to the site, they couldn't access them. To do so, they'd have to pay Bitcoins to an address the site provided to each registered user, where they could purchase points that could then be traded for downloads. And since they weren't undercover agents, they didn't have the authorization to buy

• 31:50Speaker 00

  those points, nor were they particularly eager to. At the bottom of several pages of the site was a copyright date: "March 13, 2015." Welcome to Video had already been online for more than two years. Even at a glance, it was clear that it had grown into one of the biggest repositories of child sexual abuse videos that law enforcement had ever encountered. As Gancheski and Gambarian analyzed the site's mechanics, they saw that users could obtain points not just by purchasing them, but also by uploading videos. The more those videos were subsequently downloaded by other users, the more points

• 32:35Speaker 00

  they would earn. "Do not upload adult porn," the upload page instructed, the last two words highlighted in red for emphasis. The page also warned that uploaded videos would be checked for uniqueness. Only new material would be accepted, a feature that, to the agents, seemed expressly designed to encourage more abuse of children. The element of the site that Gambarian found most unnerving of all, though, was a chat page, where users could post comments and reactions. It was filled with posts in all languages, offering a hint at the international reach of the site's network.

• 33:17Speaker 00

  Much of the discussion struck Gambarian as chillingly banal, the kind of casual commentary one might find on an ordinary YouTube channel. Gambarian had hunted criminals of all stripes for years now, from small-time fraudsters to corrupt federal law enforcement colleagues, to cybercriminal kingpins. He usually felt he could fundamentally understand his targets. Sometimes, he'd even felt sympathy for them. "I've known drug dealers who are probably better human beings than some white-collar tax evaders," he mused. "I could relate to some of these criminals. Their motivation is just greed."

• 33:58Speaker 00

  But now, he'd entered a world where people were committing atrocities that he didn't understand, driven by motivations that were entirely inaccessible to him. After a childhood in war-torn Armenia and post-Soviet Russia, and a career delving into the criminal underworld, he considered himself to be familiar with the worst that people were capable of. Now, he felt he had been naive. His first look at Welcome to Video exposed and destroyed a hidden remnant of his idealism about humanity. "It killed a little bit of me," Gambarian says.

• 34:37Speaker 00

  As soon as they had seen firsthand what Welcome to Video truly represented, Gambarian and Gancheski understood that the case warranted an urgency that went beyond that of even a normal dark web investigation. Every day the site spent online, it enabled more child abuse. Gambarian and Gancheski knew their best leads still lay in the blockchain. Crucially, the site didn't seem to have any mechanism for its customers to pull money out of their accounts. There was only an address to which they could pay for credits on the site. There didn't even seem to be a moderator to ask for a refund.

• 35:17Speaker 00

  That meant that all the money they could see flowing out of the site, more than $300,000 worth of Bitcoins at the time of the transactions, would almost certainly belong to the site's administrators. Gambarian began reaching out to his contacts in the Bitcoin community, looking for staff at exchanges who might know executives at the two Korean exchanges, Bitum and Coin1, into which most of Welcome to Video's money had been cashed out, as well as one US exchange that had received a small fraction of the funds. He found that the mere mention of child exploitation seemed to evaporate the cryptocurrency

• 36:01Speaker 00

  industry's usual resistance to government intervention. "As libertarian as you want to be," Gambarian says, "this is where everybody kind of drew the line."

• 36:13Speaker 00

  Even before he sent a formal legal request or subpoena, staff at all three exchanges were ready to help. They promised to get him account details for the addresses he had pulled from Reactor as soon as they could. In the meantime, Gambarian continued to investigate the Welcome to Video site itself. After registering an account on the site, he thought to try a certain basic check of its security. A long shot, he figured, but it wouldn't cost anything. He right-clicked on the page and chose "View Page Source" from the resulting menu. This would give him a look at the site's raw HTML before it was rendered by the Tor browser into a graphical webpage.

• 36:55Speaker 00

  Looking at a massive block of code, anyway, certainly beat staring at an infinite scroll of abject human depravity. He spotted what he was looking for almost instantly: an IP address. In fact, to Gambarian's surprise, every thumbnail image of the site seemed to display within the site's HTML, the IP address of the server where it was physically hosted. 121.185.153.64 He copied those 11 digits into his computer's command line and ran a basic traceroute function,

• 37:37Speaker 00

  following its path across the internet back to the location of that server. Incredibly, the results showed that this computer wasn't obscured by Tor's anonymizing network at all. Gambarian was looking at the actual unprotected address of a Welcome to Video server. Confirming Levin's initial hunch, the site was hosted on a residential connection of an internet service provider in South Korea, outside of Seoul.

• 38:07Speaker 00

  Welcome to Video's administrator seemed to have made a rookie mistake. The site itself was hosted on Tor, but the thumbnail images it assembled on its homepage appeared to be pulled from the same computer without routing the connection through Tor, perhaps in a misguided attempt to make the page load faster. Gambarian couldn't help it, sitting in front of his computer screen in his DC cubicle, staring at the revealed location of a website administrator whose arrest he could feel drawing closer. The agent started to laugh. Gancheski was at a firing range in Maryland, waiting his turn in a marksmanship exercise,

• 38:48Speaker 00

  when he got an email from the American cryptocurrency exchange his team had subpoenaed. It contained identifying information on the suspected Welcome to Video administrator who had cashed out the site's earnings there. The email's attachments showed a middle-aged Korean man with an address outside of Seoul, exactly corroborating the IP address Gambarian had found. The documents even included a photo of the man holding up his ID, apparently to prove his identity to the American exchange. For a moment, Gancheski felt as though he were looking at Welcome to Video's administrator face-to-face, but he remembers thinking that something was off.

• 39:34Speaker 00

  The man in the picture had noticeably dirty hands, with soil under his fingernails. He looked more like a farmworker than the hands-on keyboard type he'd expected to be running a site on the dark web. Over the next days, as the other exchanges fulfilled their subpoenas, the answer began to come into focus. One Korean exchange and then the other sent Gambarian documents on the men who controlled Welcome to Video's cash-out addresses. They named not just that one middle-aged man, but also a much younger male, 21 years old, named Son Jong Woo. The two men listed the same address and shared the same family name. Were they father and son?

• 40:20Speaker 00

  The agents believed they were closing in on the site's administrators, but they had come to understand that merely taking down the site or arresting its admins would hardly serve the interests of justice. The constellation of Bitcoin addresses that Welcome to Video had generated on the blockchain laid out a vast, bustling nexus of both consumers and, far more importantly, producers of child sexual abuse materials. By this point, Faruki had brought on a team of other prosecutors to help, including Lindsay Suttenberg, an assistant US attorney with expertise in child exploitation cases. She pointed out that even taking the site offline shouldn't necessarily be their first

• 41:05Speaker 00

  priority. "You cannot let a child be raped while you go and try to take down a server in South Korea," as Faruki summed up her argument. The team began to realize that, as simple as this slam dunk case had seemed at first, after the easy identification of the site's admins, it was actually overwhelming in its complexity. They would need to follow the money not to just one or two web administrators in Korea, but also from that central point to hundreds of potential suspects, both active abusers and their complicit audience of enablers, around the entire globe.

• 41:48Speaker 00

  Gambarian's right-click discovery of the site's IP address and the quick cooperation from crypto exchanges had been lucky breaks. The real work still lay ahead.

• 42:01Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions, it needs limits. Control AI with Zero Trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 42:30Speaker 02

  Host Thanksgiving with industry-leading quality standards from Whole Foods Market. There are no antibiotics in their meat department, ever, so carve up turkey and spiral-cut ham with peace of mind. Shop organic sides like stuffing mix and cranberry sauce from 365 brand. And guess what? All their delectable pies are made with no high-fructose corn syrup. Gourmet Thanksgiving flavors with the quality you want, only at Whole Foods Market.

• 43:00Speaker 03

  Done settling for close enough? DXL Big & Tall has the sizes, the fit, and the brands you already love, plus quality you can feel, at a price that makes sense. We're talking sizes XL to 8XL, waists 38 to 60, and over 75 brands, all in one place. Finally, no more settling, just clothes that actually fit Big & Tall guys right. Shop DXL.com or visit one of the 250 stores nationwide. DXL, wear what you want.

• 43:31Speaker 00

  Chapter 3: Octopus

• 43:35Speaker 00

  Just two weeks after Levin passed along his tip, the team of IRS, CI agents, and prosecutors knew almost exactly where Welcome to Video was hosted. But they also knew they'd need help to go further. They had neither connections to the Korean National Police Agency, which had a reputation for formality and impenetrable bureaucracy, nor the resources to arrest what could be hundreds of the site's users, an operation that would require far more personnel than the IRS could muster. Faruki suggested they bring Homeland Security investigations in on the case, partnering

• 44:16Speaker 00

  with a certain field office across the country, in Colorado Springs. He'd chosen that agency and its far-flung outpost because of a specific agent there whom he'd worked with in the past, an investigator named Thomas Tamsi. Faruki and Tamsi had together unraveled a North Korean arms-trading operation a year earlier, one that had sought to smuggle weapon components through South Korea and China. In the course of that investigation, they'd flown to Seoul to meet with the Korean National Police, where, after some introductions by an HSI liaison there, they spent an evening with Korean officers drinking and singing karaoke.

• 45:01Speaker 00

  At a particularly memorable point in the night, the Korean agents had been ribbing the US team for their alleged hot dog and hamburger diets. One agent mentioned senakji, a kind of small octopus that some Koreans eat not merely raw, but alive and writhing. Tamsi had gamely responded that he'd try it. A few minutes later, a couple of Korean agents had brought to the table a fist-sized, living octopus wrapped around a chopstick. Tamsi put the entire squirming cephalopod in his mouth, chewed and swallowed, even as its tentacles wriggled between his lips and black ink dripped from his face onto the table.

• 45:45Speaker 00

  "It was absolutely horrible," Tamsi says. The Koreans found this hilarious. Tamsi gained near legendary status within certain circles of the Korean National Police, where he was thereafter referred to as "Octopus Guy." Like most of their group, Tamsi had no experience in child exploitation cases. He had never even worked on a cryptocurrency investigation. But Faruki insisted that to make inroads in Korea, they needed "Octopus Guy." Not long afterward, Tamsi and a fellow HSI agent authorized for undercover operations flew to Washington DC.

• 46:26Speaker 00

  They rented a conference room in a hotel, and as Janchesky watched, the undercover agent logged on to Welcome to Video, paid a sum of Bitcoins, and began downloading gigabytes of videos. The strange choice of location, a hotel rather than a government office, was designed to better mask the agent's identity, in case Welcome to Video could somehow track its users despite Tor's protection, and also so that when it came time to prosecute, the DC Attorney's Office would be given jurisdiction. The HSI agent did at least use a Wi-Fi hotspot for his downloading, to avoid siphoning the web's most toxic content over the hotel's network.

• 47:10Speaker 00

  As soon as the undercover agent's work was complete, they shared the files with Janchesky, who, along with Lindsay Suttenberg, would spend the following weeks watching the videos, cataloging any clues they could find to the identities of the people involved, while also saturating their minds with enough images of child abuse to fill anyone's nightmares for the rest of their lives. Suttenberg's years as a child exploitation prosecutor had left her somewhat desensitized. She would find that other attorneys on the team couldn't stand to even hear her describe the contents of the videos, much less watch them. "They would ask me to stop talking, to put it in writing," she remembers, "and then

• 47:54Speaker 00

  they'd tell me that was even worse." Janchesky, as lead agent on the case, was tasked with putting together an affidavit that would be used in whatever charging document they might eventually bring to court. That meant watching dozens of videos, looking for ones that would represent the most egregious material on the site, and then writing technical descriptions of them for a jury or judge. He compares the experience to a scene from A Clockwork Orange, an unending montage from which he constantly wanted to avert his gaze but was required not to. He says watching those videos altered him, though in ways he could only describe in

• 48:37Speaker 00

  the abstract, ways even he's not sure he fully understands. "There's no going back," Janchesky says vaguely. "Once you know what you know, you can't unknow it, and everything that you see in the future comes in through that prism of what you now know." In the first weeks of fall 2017, the team investigating the Welcome to Video network began the painstaking process of tracing every possible user of the site on the blockchain and sending out hundreds of legal requests to exchanges around the world. To help analyze every tendril of Welcome to Video's cluster of Bitcoin addresses in

• 49:18Speaker 00

  Reactor, they brought on a chain analysis staffer named Aaron Ekbiikian, an Armenian-American former police officer from Fresno whom Gambarian knew from childhood and had recommended to Levin. Ekbiikian's job was to perform what he called "a cluster audit," squeezing every possible investigative clue out of the site's cryptocurrency trails. That meant manually tracing payments back from one prior address to another, until he found the exchange where a Welcome to Video customer had bought their Bitcoins and the identifying information that the exchange likely possessed.

• 50:00Speaker 00

  Plenty of Welcome to Video's users had made his job easy. "It was a beautiful clustering in Reactor," Ekbiikian says. "It was just so clear." In some cases, he would trace back chains of payments through several hops before the money arrived at an exchange, but for hundreds of users, he says, he could see wallet addresses receive money from exchanges and then put the funds directly into Welcome to Video's cluster. Transactions that had created, as Ekbiikian put it, "leads as clean as you could want." As responses from exchanges with those users' identity information began to pour in, the

• 50:41Speaker 00

  team started the process of assembling more complete profiles of their targets. They began to collect the names, faces, and photos of hundreds of men. They were almost all men, from all walks of life, everywhere in the world. Their descriptions crossed boundaries of race, age, class, and nationality. All these individuals seemed to have in common was their gender and their financial connection to a worldwide hidden haven of child abuse. By this time, the team felt they'd pinned down the site's Korean administrator with confidence. They'd gotten a search warrant for Sun Jong Woo's Gmail accounts and many of his exchange

• 51:23Speaker 00

  records, and they could see that he alone seemed to be receiving the cashed-out proceeds from the site, not his father, who increasingly seemed to the investigators like an unwitting participant, a man whose son had hijacked his identity through "Ocreate cryptocurrency accounts." In Sun Jong Woo's emails, they found photos of the younger man for the first time, selfies he'd taken to show friends where he'd chipped a tooth in a car accident, for instance. He was a thin, unremarkable-looking young Korean man with wide-set eyes and a beetles-esque mop-top of black hair. But as their portrait of this administrator took shape, so too did the profiles of the

• 52:07Speaker 00

  hundreds of other men who had used the site. A few immediately stuck out to the investigative team. One suspect, to the dismay of Thomas Tamsi and his Homeland Security colleagues, was an HSI agent in Texas. Another they saw with a different sort of dread was the assistant principal of a high school in Georgia. The school administrator had posted videos of himself on social media singing duets, karaoke-style, with teenage girls from his school. The videos might otherwise have been seen as innocent, but given what they knew about the man's Bitcoin payments, agents who had more experience with child exploitation warned Janchesky that they might reflect a form of grooming.

• 52:54Speaker 00

  These were men in privileged positions of power, with potential access to victims. The investigators could immediately see that. As they suspected, they would need to arrest some of Welcome to Video's users as quickly as possible, even before they could arrange the takedown of the site. Child exploitation experts had cautioned them that some offenders had systems in place to warn others if law enforcement had arrested or compromised them: code words, or dead man's switches, that sent out alerts if they were absent from their computer for a certain period of time. Still, the Welcome to Video investigation team felt they had little choice but to move quickly and take that risk.

• 53:40Speaker 00

  Another suspect around the same time came onto their radar for a different reason: he lived in Washington DC. The man's home, in fact, was just down the street from the US Attorney's Office, near the Capitol's Gallery Place neighborhood. He happened to live in the very same apartment building that one of the prosecutors had only recently moved out of. That location, they realized, might be useful to them. Janczewski and Gambarian could easily search the man's home and his computers as a test case. If that proved the man was a Welcome to Video customer, they would be able to charge the entire case in DC's judicial district, overcoming a key legal hurdle. As they dug deeper, though,

• 54:24Speaker 00

  they found that the man was a former congressional staffer and held a high-level job at a prestigious environmental organization. Would arresting or searching the home of a target with that sort of profile cause him to make a public outcry, sinking their case? Just as they trained their sites on this subject in their midst, however, they found that he had gone strangely quiet on social media. Someone on the team had the idea to pull his travel records. They found that he had flown to the Philippines and was about to fly back to DC via Detroit. This discovery led the agents and prosecutors to two thoughts: first, the Philippines was a notorious destination for sex tourism,

• 55:09Speaker 00

  often the kind that preyed on children. The HSI office in Manila constantly had its hands full with child exploitation cases. Second, when the man flew back to the US, Customs and Border Protection could legally detain him and demand access to his devices to search for evidence. A bizarre and controversial carve-out in Americans' constitutional protections that, in this case, might come in handy. Would their DC-based suspect sound the alarm and tear the lid off their investigation just as it was getting started? "Yes. This all had the potential to blow up our case," Janczewski says. "But we had to act." In late October,

• 55:53Speaker 00

  Customs and Border Protection at the Detroit Metropolitan Airport stopped a man disembarking from a plane from the Philippines on his way back to Washington DC, asking him to step aside and taking him into a secondary screening room. Despite his vehement protests, the border agents insisted on taking his computer and phone before allowing him to leave. A few days later, on October 25, the prosecutor who had lived in the same DC apartment block as the suspect saw an email from her old building's management. She'd remained on the distribution list despite having moved out. The email noted that the parking garage ramp in an alley at the back of the tower would be closed that morning.

• 56:37Speaker 00

  "An unnamed resident," it explained, "had landed there after jumping to their death from the balcony of their apartment." The prosecutor put two and two together: the jumper was their Welcome to Video test case. Janczewski and Gambarian immediately drove to the apartment tower and confirmed with management: the very first target of their investigation had just killed himself. Later that day, the two IRS CI agents returned to the scene of the man's death with a search warrant. They rode the elevator up to the 11th floor with the building's manager, who was deeply puzzled as to why the IRS was involved, but wordlessly unlocked the door for them. Inside,

• 57:22Speaker 00

  they found an upscale, moderately messy apartment with high ceilings. There were suitcases still not fully unpacked from a trip. The man had ordered a pizza the night before, and part of it remained uneaten on the table.

• 57:37Speaker 00

  Janczewski remembers feeling the somber stillness of the man's empty home as he imagined the desperate choice he had faced the night before. Looking down 11 floors from the balcony, the agent could see the spot in the alleyway below where the pavement had recently been hosed off. DC's Metropolitan Police offered to show the agents a security cam video of the man falling to his death. They politely declined. The Customs and Border Protection Office in Detroit, meanwhile, confirmed that they had searched the computers seized from the man at the airport. Some of its storage was encrypted, but other parts were not,

• 58:17Speaker 00

  and found child exploitation videos along with surreptitiously-recorded videos of adult sex. Their decision to target the man had served its purpose. Their test case had come back positive. The prosecutors in DC paused their work briefly to meet and acknowledge the surreal shock of the man's death. Their investigation of a site hosted halfway around the world had already led someone to kill themselves, just blocks away. "It was just a reminder of how serious what we were investigating was," Faruki says. Still, the group agreed. They couldn't let suicide distract them from their work. "We've got to focus on the victims here," Faruki remembers them telling each other.

• 59:02Speaker 00

  "That provides clarity." Janczewski says he would have much preferred that the man be arrested and charged, but he had, by this point, been forced to watch hour after hour of child sexual abuse videos. He had put aside his emotions early on in the case, and he had few sympathies to spare for an apparent customer of those materials. "If he felt anything," he admits, "it was relief, given the time that the suicide had saved him." They still had hundreds more Welcome to Video customers to pursue. Next on their list was the high school assistant principal. Just days later,

• 59:41Speaker 00

  Janczewski flew down to Georgia and joined a tactical team of HSI agents as they carried out their search. For the first time, he came face-to-face with an alleged Welcome to Video client in his own home. In spite of his stoicism, this second test case affected Janczewski more than the DC target had: the tidy, well-kept brick two-story house, the parents, questioned in separate rooms, the kids, the same age as Janczewski's own, watching Mickey Mouse Clubhouse. As he stood in the entryway of that house outside of Atlanta, the full toll of the investigation hit him: the fact that every name on their list was a person with human connections,

• 1:00:26Speaker 00

  and, in many cases, a family. That even accusing suspects of such an unforgivable crime had an irreversible impact on their lives, that it was a scarlet letter for someone that just cannot be undone, as he put it. Janczewski and the HSI agents stayed at the home long enough to search it, to question the man, and to seize his devices for analysis. In addition to the evidence of the man's payments for material on Welcome to Video, Faruki says that the man also admitted to "inappropriately touching" students at his school. The man would later be charged with sexual assault of minors, though he would plead not guilty.

• 1:01:12Speaker 00

  For Janczewski, at least, any last doubts he had felt after his first confrontation with a suspect based on cryptocurrency tracing alone were dispelled in a matter of hours. "At the end of the day, I felt more confident," he says. "We were correct." The blockchain had not lied. The team was steadily working their way through their short list of high-priority Welcome to Video targets and test cases, but in December 2017, they came upon a different sort of lead, one that would scramble their priorities yet again.

• 1:01:52Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions. It needs limits. Control AI with zero trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R.com/wired.

• 1:02:21Speaker 02

  Host Thanksgiving with industry-leading quality standards from Whole Foods Market. There are no antibiotics in their meat department ever, so carve up turkey and spiral cut ham with peace of mind. Shop organic sides like stuffing mix and cranberry sauce from 365 brand. And guess what? All their delectable pies are made with no high-fructose corn syrup. Gourmet Thanksgiving flavors with the quality you want, only at Whole Foods Market.

• 1:02:51Speaker 03

  Done settling for close enough? DXL Big & Tall has the sizes, the fit, and the brands you already love, plus quality you can feel at a price that makes sense. We're talking sizes XL to 8XL, waists 38 to 60, and over 75 brands all in one place. Finally, no more settling. Just clothes that actually fit Big & Tall guys right. Shop DXL.com or visit one of the 250 stores nationwide. DXL: Wear what you want.

• 1:03:22Speaker 00

  As they followed Welcome to Video's financial trials, investigators had been careful to record the full contents of the site's chat page, where users were still posting a steady stream of comments against a backdrop of spam and trolling, typical of any anonymous web forum. The site seemed to be entirely unmoderated. There was not so much as an admin email or help contact visible anywhere, but Jancheski began to notice repeated messages from one account that seemed to offer the closest thing the site had to that missing help desk contact. "Contact the admins," the messages read. "If you want assistance in fixing error." It included an address on Torbox,

• 1:04:07Speaker 00

  a privacy-focused Tor-based email service. Was this an actual moderator on the site? Or even the administrator himself? The owner of the site, who they now believed to be San Zhang Wu? As Jancheski tried to decipher who was behind those messages, he checked the username before the at symbol in the Torbox address, a unique-looking string of six characters, to see if it matched a user on Welcome to Video. Sure enough, he found that someone with that same handle had uploaded more than 100 videos. Exegence Aaron Bice had the idea to run this Torbox email address against a database seized from BTC-E

• 1:04:51Speaker 00

  during IRSCI's probe of the crypto exchange to search for clues in its treasure trove of criminal underworld user data. Bice found a match. One account on BTC-E had been registered with an email address that included the same unique string of six characters. It wasn't the Torbox email address, but one from a different, privacy-focused email service called Segaint. Jancheski knew that Torbox and Segaint, both dark web services themselves, wouldn't respond to legal requests for their users' information. But the BTC-E data included IP addresses

• 1:05:33Speaker 00

  for 10 past logins on the exchange by the same user. In nine out of 10, the IP address was obscured with a VPN on Tor. But in one single visit to BTC-E, the user had slipped up. They had left their actual home IP address exposed. "That opened the whole door," says Jancheski. A trace route showed that the IP address led to a residential internet connection. Not in Korea this time, but in Texas. Was there a second Welcome to Video admin? This one based in the US? Jancheski and Bice continued pulling the thread with increasing urgency, subpoenaing the user's account information

• 1:06:17Speaker 00

  from their internet service provider. It was a Friday morning in early December, and Jancheski was drinking coffee at his desk in the IRSCI office when he got back the results of that subpoena. He opened the email to find a name and a home address. The man was an American in his 30s, who lived in a town outside of San Antonio, an unlikely collaborator for a 21-year-old Korean managing a child exploitation site from 15 time zones away. But the man's employment, when Jancheski looked it up, was even more jarring. He was another Department of Homeland Security staffer. This time, a Border Patrol agent.

• 1:07:02Speaker 00

  Jancheski quickly began to assemble public information about the agent from his social media accounts. He first found a Facebook page for the man's wife, and later, an account for the man himself, with his name written backwards to obscure it. Bice dug up his Amazon page too, where he seemed to have left reviews on hundreds of products and put others on a wish list, including external storage devices that could hold terabytes of videos, hidden cameras, and other cameras designed to be snaked through small spaces, like holes drilled in a wall. Finally, with a creeping sense of dread, Jancheski saw that the Border Patrol agent's wife had a young daughter,

• 1:07:46Speaker 00

  and that he had created a crowdfunding page on GoFundMe to raise money to legally adopt the girl as his stepdaughter. "Fuck," Jancheski thought to himself. Did he upload videos of the daughter? Jancheski looked back at Welcome to Video and saw that some of the thumbnails of the videos uploaded by the person with this username showed the sexual assault of a young girl about the daughter's age. He realized he now had a duty to separate this Border Patrol agent from his victim as swiftly as possible. For the next 10 days, Jancheski barely left his desk. He'd drive home, eat dinner quickly with his family

• 1:08:30Speaker 00

  in their small Arlington, Virginia townhouse, and then drive back to the office to work late, often calling Bice and Faruki well into the night. "You are rarely in a situation where your time is zero-sum," Faruki says. "Every moment we were not working on that case, a little girl could be getting raped." Jancheski asked their undercover HSI agent to download the videos that had been uploaded by the Texas agent, and he began the grueling process of watching them one by one. A few videos in, he spotted something that jolted the pattern-matching subroutines of his brain. At one point in the recording, the girl in the video

• 1:09:13Speaker 00

  had a red flannel shirt tied around her waist. He looked back at a photo of the girl posted on the GoFundMe page and saw it. She was wearing the same red flannel. Was this Border Patrol agent an admin on Welcome to Video? A moderator? It hardly mattered. Jancheski now believed he had found the identity of an active child rapist who lived with his victim and had been recording and sharing his crimes with thousands of other users. The Texas man had earned a place at the very top of their target list. Two weeks before Christmas, on the 10th day after he'd identified the Border Patrol agent, Jancheski flew to southern Texas,

• 1:09:58Speaker 00

  along with HSI's Thomas Tamsi and his team's child exploitation-focused prosecutor, Lindsay Suttonberg. On a cool, dry evening about 100 miles from the Mexican border, Tamsi and a group of Texas state police officers tailed their target as he drove home from work and pulled him over. Together with a group of FBI agents, they took the man to a nearby hotel for questioning. Meanwhile, Jancheski and a group of local Homeland Security investigators entered the man's house and began to search for evidence. The two-story home was rundown and messy, Jancheski remembers, with the exception of the man's well-organized home office on the second floor,

• 1:10:43Speaker 00

  where they found his computer. Down the hall from that office, he came to the girl's bedroom and immediately recognized it as the scene where the videos uploaded by the man had been filmed. On the wall, he noticed a poster he'd seen in the recordings and momentarily felt as though he'd fallen through the screen of his own computer into the set of a horror film. The IRS agent and prosecutor had brought with them an FBI interviewer with child exploitation experience, who separated the girl from the agent searching her home and took her to a safer location. The girl eventually detailed to the interviewer the abuse she'd endured. Shortly after the search of the Border Patrol agent's home,

• 1:11:26Speaker 00

  Janszky arrived at the hotel room where other agents were questioning their subject. He saw, for the first time, the target of his last week-and-a-half's obsession. The man was tall and burly, still in his uniform, with thinning hair. He initially refused to talk about any physical abuse he might have committed, Janszky says, but he eventually confessed to possessing, sharing, and finally, making child sexual abuse videos. Janszky was struck by the dispassionate, almost clinical, way the man described his actions. He gave his interrogators the password to his home computer,

• 1:12:08Speaker 00

  and an agent still at the house began pulling evidence from the machine and sending it to Janszky. It included detailed spreadsheets of every child sexual exploitation video the man had both amassed on his hard drives and, by all appearances, filmed in his own home. Another spreadsheet from the man's computer contained a long list of other Welcome to Video users' login credentials. Under questioning, the man explained his scheme. He would pose as an administrator in messages he posted to the site's chat page, then ask users who took the bait to send him their usernames and passwords, which he'd use to log into their accounts and access their videos.

• 1:12:53Speaker 00

  The Border Patrol agent had never been a Welcome to Video administrator or moderator at all, only a particularly devious visitor to the site, willing to scam his fellow users to support his own appetites. After an intense 10 days, they'd identified and arrested another alleged child abuser, even rescued his victim. But as he flew back to DC, Janszky knew that Welcome to Video's vastly larger network of abuse remained very much intact. And until they took the site itself down, it would continue to serve its videos, including the very ones the Border Patrol agent had uploaded from his Texas home office

• 1:13:37Speaker 00

  to an anonymous throng of consumers just like him. Chapter 4: Korea. In early January of 2018, the DC investigators got word from Thomas Tamsi that he and the team had arrested the other federal law enforcement customer of Welcome to Video, the HSI agent who'd shown up early in their blockchain tracing and subpoenas. Though seemingly unconnected to the Border Patrol agent case, this second agent had been based in Texas, too, less than an hour away from the home of the man they had just raided. Aside from that grim coincidence, the news of the HSI agent's arrest

• 1:14:19Speaker 00

  also meant that DC team's initial list of high-priority suspects was finally checked off. They could move on to their primary target, Sun Jong Woo and the Welcome to Video server under his control. By February, that Korea-focused operation was coming together.

• 1:14:39Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions, it needs limits. Control AI with zero trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 1:15:09Speaker 02

  Host Thanksgiving with industry-leading quality standards from Whole Foods Market. There are no antibiotics in their meat department, ever, so carve up turkey and spiral-cut ham with peace of mind. Shop organic sides like stuffing mix and cranberry sauce from 365 Brand. And guess what? All their delectable pies are made with no high-fructose corn syrup. Gourmet Thanksgiving flavors with the quality you want, only at Whole Foods Market.

• 1:15:39Speaker 03

  Done settling for close enough? DXL Big & Tall has the sizes, the fit, and the brands you already love, plus quality you can feel at a price that makes sense. We're talking sizes XL to 8XL, waists 38 to 60, and over 75 brands, all in one place. Finally, no more settling. Just clothes that actually fit Big & Tall guys right. Shop DXL.com or visit one of the 250 stores nationwide. DXL: Wear what you want.

• 1:16:09Speaker 00

  Before the Texas arrests, Janszky, Gambarian, Faruki, and Tamsi had flown to Seoul to meet the Korean National Police Agency. At a dinner set up by the local HSI attaché, the director of the KNPA himself told Tamsi, whose octopus-eating reputation preceded him, that the Americans would have the help of his best team. Soon, they had Sun Jong Woo under constant surveillance as he came and went from his home, an apartment two-and-a-half hours south of Seoul, in the province of South Cheongchung. Now in the depths of winter on the Korean Peninsula, just a week after Korea had hosted the Olympics in Pyeongchang,

• 1:16:54Speaker 00

  the American agents arrived in Seoul again. Gambarian had to stay behind for a badly timed conference where the agency's director had volunteered him to speak. But Janszky and Faruki brought with them Aaron Biese and Yuli Lee, a Korean-American computer crime prosecutor on their team. By this point, too, a growing international force had assembled around the case. The UK's National Crime Agency, which had launched its own investigation into Welcome to Video just after Levin's London visit, sent two agents to Seoul, and the German federal police also joined the coalition. It turned out the Germans had been pursuing the site's administrators independently,

• 1:17:37Speaker 00

  even before they'd learned about the IRS's investigation. But they'd never been able to secure the cooperation of the Korean National Police. At one point, Faruki remembers a German official asking him as they stood in the cold outside the Seoul hotel where they were staying, how the Americans had gotten the Koreans on board so quickly. "Oh, Octopus Guy," Faruki had explained. "You don't have Octopus Guy, we have Octopus Guy." For their first days in Seoul, the takedown team met repeatedly in the Korean National Police offices to talk through their plans. Their tracing of the IP address, based on Gambarian's fortuitous right-click, seemed to show that the site server was located,

• 1:18:22Speaker 00

  bizarrely, not in any web hosting firm's data center, but in Sun Jong Woo's own apartment, the evidentiary hub of a massive child sexual abuse network, sitting right in his home. That made things simple. They would arrest him, tear his site offline, and use that evidence to convict him. The team made a plan to grab him in his apartment early on a Monday morning. Then, on the Friday before, Janszky got a cold. He spent much of the weekend with prosecutor Yuli Lee, dazedly wandering between markets and stores in Seoul, trying to pronounce "gasupki," the Korean word for humidifier. On Sunday evening, he took a dose of what he hoped

• 1:19:07Speaker 00

  was a Korean equivalent of NyQuil. He couldn't read the label, with the intention of getting some sleep and recovering in time to be at full strength for the arrest. That's when the KNPA alerted the team that the plan had changed. Sun had unexpectedly driven into Seoul for the weekend. Now the team, following his whereabouts, believed he had begun a late-night drive back to his home south of the city. If the police could drive down to Sun's home that night and stake it out, perhaps, they could be there when he returned, ready to arrest him at his door. That way, he couldn't destroy evidence, or, another looming concern after the death of their Washington, DC target,

• 1:19:51Speaker 00

  commit suicide. "We had to scramble," Janszky says. That evening, Faruki insisted the group put their hands in for a "go-team" cheer in their hotel lobby. Then he and Lee went up to their rooms to go to bed. Janszky, sick, half-asleep from cold medication, and clutching a pillow from his hotel room, walked out into the pouring rain and got in a car with the HSI liaison to start the long night drive south. The HSI agent had begged Janszky to take the wheel of another car in the caravan instead of an elderly Korean man on his team who was, the agent said, "a notoriously bad driver." But Janszky insisted

• 1:20:35Speaker 00

  he was far too medicated to navigate the dark, wet highways of a country 7,000 miles from his home. A few hours later, the team arrived in the parking lot of Sun's apartment, a 10-story tower with a few small buildings on one side and a vast, empty rural landscape on the other, to begin their long stakeout in the rain. It was well past midnight when they saw Sun's car finally pull into the parking garage of the complex. A group of Korean agents had been waiting there for him. One particularly imposing officer, whom the HSI agents referred to as "Smiley," because he never smiled, led a team of plainclothes police,

• 1:21:18Speaker 00

  sliding into the elevator next to Sun as he got inside. The agents silently rode the elevator up to Sun's floor with him and stepped out when he did. They arrested him, without resistance, just as he reached his front door. Throughout that arrest and the hours-long search of Sun's apartment that followed, Janszky and the other foreigners remained stuck in their cars in the rain-drenched parking lot. Only the National Police had authorization to lay hands on Sun or enter his home. When the Korean officers had the young Welcome to Video admin handcuffed, they asked him if he'd consent to letting Janszky or any of the Americans come in as well. Sun, unsurprisingly, said no.

• 1:22:05Speaker 00

  So Janczewski was limited to a tour via FaceTime of the small and unremarkable apartment that Son shared with his divorced father. The man with the soiled hands in the first photo they had examined, as the Korean agent scoured it for evidence and seized his devices. The Korean agent showing Janczewski around eventually pointed the phone's camera at a desktop computer on the floor of Son's bedroom. A cheap-looking, tower-style PC, with its case open on one side. The computer's guts revealed the hard drives that Son seemed to have added, one by one, as each drive had filled up with terabytes of child exploitation videos.

• 1:22:47Speaker 00

  This was the Welcome to Video server. "I was expecting some kind of glowing, ominous thing," Janczewski remembers. "And it was just this dumpy computer. It was just so strange. This dumpy computer, that had caused so much havoc around the world, was sitting on this kid's floor." On the return trip, Janczewski learned exactly why the HSI liaison had wanted him to drive the other car. The elderly HSI staffer behind the wheel of the other vehicle in their caravan was somehow so disoriented after a sleepless night that he turned the wrong way down a highway exit

• 1:23:29Speaker 00

  ramp, narrowly avoiding a high-speed collision and terrifying his passenger, Aaron Bice. After barely averting that disaster, as the sun began to rise and the rain let up, the group pulled over at a truck stop along the highway to have a breakfast of gas station instant ramen. Janczewski, still sick and utterly exhausted, was struck by how anticlimactic it all seemed. His team had located and extricated both the administrator and the machine at the epicenter of the malevolent global network they were investigating. He had been anticipating this moment for more than six months, but he felt no elation.

• 1:24:14Speaker 00

  There were no high-fives, no celebrations. The agents got back in their cars to continue the long drive back to Seoul. The next day, after finally getting some sleep, Janczewski began to see past the dreariness of the previous night's operation to understand just how lucky they had been. He had learned from the forensic analysts, who had examined Son Jong Woo's computers, that Son hadn't encrypted his server. Everything was there: all of Welcome to Video's content, its user database, and the wallets that had handled all of its Bitcoin transactions. The scale of the video collection, now that they could see it in its entirety, was staggering.

• 1:24:56Speaker 00

  There were more than 250,000 videos on the server, more content by volume than in any child sexual abuse materials case history. When they later shared the collection with the National Center for Missing and Exploited Children, NCMEC, which helps to catalog, identify, and take down CSAM materials across the internet, NCMEC found that it had never seen 45% of the videos before. Welcome to Video's uniqueness check and incentive system for fresh content appeared to have served its purpose: motivating countless new cases of recorded child abuse. The real prize for the investigators, however, was the site's user information.

• 1:25:41Speaker 00

  The Korean National Police gave the US team a copy of Welcome to Video's databases, and they got to work, in a US embassy building in Seoul, reconstructing those data collections on their own machine. Meanwhile, to avoid tipping off the site's users to the takedown, they very quickly set up a look-alike Welcome to Video homepage on their own server, using the private key pulled from the real server to take over its dark web address. When users visited the site, it now displayed only a message that it was under construction and would be back soon with "upgrades," complete with typos to mimic Son's shoddy English spelling.

• 1:26:23Speaker 00

  Bice spent two days with his head down, rebuilding the site's user data in a form they could easily query, with Janczewski and Faruki standing behind him, pestering him to see if the system was ready yet. When Bice finished, the US team had a full directory of the site's pseudonymous users, listed by their Welcome to Video usernames. They could now link every Bitcoin payment they had initially mapped out on the blockchain with those usernames and look up exactly what content each of those users had uploaded or downloaded. By the time the Americans were ready to go home at the end of February, they had integrated

• 1:27:03Speaker 00

  the de-anonymized identities from their cryptocurrency exchange subpoenas into a searchable database. It mapped out the entire Welcome to Video network, complete with users' real-world names, photos, and, for those who had paid into the site, the record of those payments and the exact child abuse videos those customers had bought access to. "You could see the whole picture," Janczewski says. "It was like a dictionary, thesaurus, and Wikipedia, all put together." They had, arrayed before them, the fully-revealed structure of Welcome to Video's global child exploitation ring.

• 1:27:45Speaker 00

  Hundreds of exquisitely detailed profiles of consumers, collectors, sharers, producers, and hands-on abusers alike. Now, the final phase of the case could begin. Over the weeks that followed, Thomas Tamsi's team in Colorado began sending their Welcome to Video dossiers to HSI agents, local police, and foreign police agencies around the world. These targeting packages included descriptions of the suspects, the record of their transactions, any other evidence they'd assembled about them, and, given that they were being sent out to law enforcement agents who had in some cases never been involved in a cryptocurrency-related

• 1:28:28Speaker 00

  investigation, short primers on how Bitcoin and its blockchain worked. There would be no coordinated global takedown, no attempt to create shock and awe with simultaneous arrests. The case's defendants were far too distributed and international for that kind of synchronized operation. Instead, searches, arrests, and interviews began to roll out across the globe, prioritized by those they'd learned might be active abusers, then uploaders, and finally, downloaders. Slowly, as Welcome to Video's users were confronted, one by one, the DC team began

• 1:29:10Speaker 00

  to hear back about the results of their work, with harrowing, sometimes gratifying, often tragic, outcomes. A Kansas IT worker whose arrests they'd prioritized when they found that his wife ran an at-home daycare for infants and toddlers had deleted all of his child abuse videos from his computer before the agents arrived. Prosecutors say he later confessed when remnants of the files in the computer's storage matched their records from the Welcome to Video server. When the agents came for a 20-something man in New York, his father blocked the door of their apartment, thinking at first that it was a break-in. But when agents explained what their warrant was for, he turned on his son and let them

• 1:29:55Speaker 00

  in. The son, it later turned out, had sexually assaulted the daughter of a family friend and surreptitiously recorded another young girl through her webcam, according to prosecutors. A repeat offender in Washington DC tried to commit suicide when the HSI team entered his home. He hid in his bathroom and slit his own throat. One of the arresting agents happened to have training as an army medic. He managed to slow the bleeding and keep the man alive. They later found 450,000 hours of child abuse videos on his computers, including recordings of the girl in Texas that had been uploaded by the Border Patrol agent.

• 1:30:37Speaker 00

  As months passed, the stories continued to pile up, a mix of the sordid, sad, and appalling. An elderly man in his 70s, who had uploaded more than 80 child abuse videos. A man in his early 20s with traumatic brain damage, whose medication had heightened his sexual appetites and reduced his impulse control, and who was deemed to have the same level of cognitive development as the preteens, whose abuse he'd watched. A New Jersey man whose communications, when they were revealed through a search warrant, seemed to show his negotiations to purchase a child for his own sexual exploitation.

• 1:31:19Speaker 00

  Thomas Tamsi, as the lead HSI agent on the case, coordinated more Welcome to Video arrests than anyone else. More than 50, by his count, and was present for enough of them that they became a blur in which only the most jarring moments remained distinct in his mind. The mostly nude defendant he found in a basement. The suspect who told him he had been involved in the Boy Scouts and that children had always been attracted to him. Parents of victims who vehemently denied that a family friend could have done the things Tamsi described and whose faces then went white as he slid printouts of redacted screenshots across the table.

• 1:32:03Speaker 00

  The cases spanned the globe, well beyond the US. Dozens of Welcome to Video users were arrested in the Czech Republic, Spain, Brazil, Ireland, France, and Canada. In England, where the entire case had started with an agent's tip to Levin, the country's National Crime Agency arrested one 26-year-old who had allegedly abused two children, one of whom they found naked on a bed in his home and uploaded more than 6,000 files to the site. In another international case, a Hungarian ambassador to Peru who downloaded content from Welcome to Video

• 1:32:44Speaker 00

  was found to have more than 19,000 CSAM images on his computer. He was quietly removed from his South American post, taken to Hungary, and charged. He pleaded guilty. For the DC team, many of the international cases fell into a kind of black hole. One Saudi Arabian Welcome to Video user returned to his home country and was captured by that country's own law enforcement. Farouki and Czanszki say they never heard what happened to the man. He was left to the Saudis' own justice system, which sentences some sex criminals to the Sharia-based punishments of whipping or even beheading. When agents searched the car of a Chinese national living near Seattle

• 1:33:28Speaker 00

  with a job at Amazon, they found a teddy bear along with a map of playgrounds in the area, despite the man having no children of his own. The man subsequently fled to China and, as far as prosecutors know, was never located again. In each of the hundreds of intelligence packets that the team sent out, Chris Czanszki's contact was listed as the number to call with any questions. Czanszki found himself explaining the blockchain and its central role in the case again and again to HSI agents and local police officers around the US and the world, many of whom had never even heard of Bitcoin or the dark web.

• 1:34:13Speaker 00

  "You get this lead sent to you that says, 'Here's this website and this funny internet money,'" Czanszki says, imagining how those on the receiving end of the intelligence packets must have seen it. "And now you need to go arrest this guy because some nerd accountant says so." In total, Czanszki traveled to six countries and spoke to more than 50 different people to help explain the case, often multiple times each, including one US prosecutor and agent team, with whom he had more than 20 conversations. "Some were a little more high maintenance, respectfully, than others," he says. Bice, who oversaw the reconstructed server data, says he spoke to even more agents and officers,

• 1:34:57Speaker 00

  well over 100, by his count. Ultimately, from the beginning of the case through the year and a half that followed the server seizure, global law enforcement would arrest no fewer than 337 people for their involvement with Welcome to Video. They also removed 23 children from sexually exploitative situations. Those 337 arrests still represented only a small fraction of Welcome to Video's total registered users. When the US team examined their copy of the server data in Korea, they had found thousands of accounts on the site. But the vast majority of them had never paid any Bitcoins into the site's wallets. With no money to follow,

• 1:35:41Speaker 00

  the investigators' trail usually went cold. If not for cryptocurrency, in other words, and the years-long trap set by its purported untraceability, the majority of the 337 pedophiles arrested in the Welcome to Video case and their rescued victims likely never would have been found.

• 1:36:03Speaker 01

  AI tools can write code, access files, connect to the internet, and execute commands at a speed no human can match. That productivity is powerful, but it also means one bad instruction or compromised tool can quickly become a security incident. Threat Locker helps organizations use AI without losing control. Put zero-trust guardrails around tools like Claude Code and control exactly what they can execute, access, and connect to. Set clear boundaries around the applications, files, systems, and online destinations your AI tools are permitted to use. Because a proven AI tool should not mean giving it unrestricted access to your environment. Control what runs, control what it can do, control what it connects to. Learn how Threat Locker can help you safely embrace AI at threatlocker.com/wired.

• 1:36:47Speaker 01

  That's T-H-R-E-A-T-L-O-C-K-E-R.com/wired.

• 1:36:53Speaker 05

  Traditional home security only alerts you after a break-in, and that's too late. SimpliSafe is changing that.

• 1:36:59Speaker 04

  Stop. This is SimpliSafe. Police are on the way.

• 1:37:02Speaker 05

  We don't just alert. We help stop crime before it starts. Plans starting around $1 a day. Right now, get 70% off your new system with professional monitoring at simplisafe.com/spotify. SimpliSafe: Ahead of Crime in Real Time.

• 1:37:17Speaker 04

  Outdoor deterrence plans start at $49.99 a month. Visit simplisafe.com/licenses for alarm license information.

• 1:37:26Speaker 06

  Still wearing those old cargo shorts? If your wardrobe's due for an upgrade, but you don't know where to start, you need Stitch Fix. Your stylist learns your size, your style, and your budget then sends a box pick just for you. They always nail the fit. No store, no hassle, no subscription required. Get started today at stitchfix.com. That's stitchfix.com.

• 1:37:55Speaker 00

  Chapter 5. Coda. The IRS and the US Attorney's Office in DC had taken an unprecedented approach, treating a massive child sexual abuse materials case as a financial investigation. And it had succeeded. Amidst all their detective work, it had been Bitcoin's blockchain that served as their true load star, leading them through a landmark case. Without crypto tracing, Farouki argues, they would never have managed to map out and identify so many of the site's users. "That was the only path through this darkness," he says. "The darker the dark net gets, the way that you shine the light is following the money."

• 1:38:40Speaker 00

  Throwing money laundering investigators into the deep end of the internet's CSAM cesspool, however, had taken its toll. Almost every member of the team had children of their own, and almost all of them say they became far more protective of those children as a result of their work, to the degree that their trust in the people around their family has been significantly damaged. Czanszki, who after the case moved from DC to Grand Rapids, Michigan, won't let his children ride their bikes to school on their own, as he himself did as a child. Even seemingly innocent interactions, like another friendly parent who offers to watch his kids at the other end of a swimming pool, now trigger red alerts in his mind.

• 1:39:25Speaker 00

  Yuli Lee says she won't allow her 9- and 12-year-old children to go into public bathrooms by themselves, nor will she allow them to play at a friend's house unless the friend's parents have top-secret security clearances, an admittedly arbitrary rule, but one, she says, ensures the parents have at least had a background check. Farouki says the 15 or so videos he watched as part of the investigation remain indelibly seared into his brain and have permanently heightened his sense of the dangers the world presents to his children. He and his wife argue, he says, about his overprotective tendencies. "You always see the worst of humanity, and so you've lost perspective,"

• 1:40:10Speaker 00

  he quotes his wife telling him. "And I say, 'You lack perspective because you don't know what's out there.'" Gambarian's wife Yuki says the Welcome to Video case was the only time her hard-shelled Soviet-born husband ever discussed a case with her and confessed that it had gotten to him, that he was struggling with it emotionally. Gambarian says that it was, in particular, the sheer breadth of the cross-section of society that participated in the site's abuse that still haunts him. "I saw that everybody's capable of this. Doctors, principals, law enforcement," he reflected.

• 1:40:54Speaker 00

  "Whatever you want to call it, evil, or whatever it is, it's in everybody. Or it can be in anybody."

• 1:41:06Speaker 00

  In early July of 2020, Son Jong Woo walked out of a Seoul penitentiary wearing a black long-sleeve t-shirt and carrying a green plastic bag of his belongings. He had spent, due to Korea's lenient laws on child sexual abuse, just 18 months in prison. U.S. prosecutors, including Faruqi, had argued he should be extradited to the United States to face charges in the American justice system, but Korea had denied their request. Welcome to Video's convicted creator and administrator was free. The D.C.-based team that worked the Welcome to Video case remains deeply dissatisfied with Son's

• 1:41:48Speaker 00

  mystifyingly light sentence for running, by some measures, the biggest child sexual abuse materials website in history. But Janczewski says he's comforted by the outcry in Korean society over the case. The country's social media exploded in anger over Son's quick release. More than 400,000 people signed a petition to prevent the judge in the case from being considered for a seat on the country's Supreme Court. One Korean lawmaker put forward a bill to allow appeals to extradition judgments. And the country's National Assembly introduced new legislation to strengthen punishments for sexual abuse online

• 1:42:30Speaker 00

  and downloading child sexual abuse materials. In the U.S., meanwhile, the ripple effects of the case continued for years. Janczewski, Bice, and Suttonberg say that they still get calls from law enforcement officials following the leads they assembled. On the computer of the D.C. investigator's very first test case, the former congressional staffer who committed suicide, they found evidence in a cryptocurrency exchange account that he'd also paid into a different source of dark web sexual materials. They followed those payments to a site called Dark Scandals, which turned out to be a smaller but equally disturbing

• 1:43:12Speaker 00

  dark web repository of sexual abuse recordings. Janczewski, Gambarian, and the same group of prosecutors pursued that Dark Scandals case in parallel with the tail end of the Welcome to Video investigation. Similarly, following blockchain leads to trace the site's cash outs. With the help of the Dutch National Police, they arrested the site's alleged administrator in the Netherlands, a man named Michael Rahim Mohammed, who went by the online handle Mr. Dark. He faces criminal charges in the U.S., and his case is ongoing. From the perspective of Welcome to Video's money laundering-focused agents and prosecutors, perhaps the most interesting

• 1:43:56Speaker 00

  of the ripple effects of the case stemmed from the fate of the HSI agent they had arrested in Texas just before their trip to carry out the site takedown in Korea. The Texan man had taken a rare approach to his legal defense. He'd pleaded guilty to possession of child sexual abuse materials, but he also appealed his conviction. He argued that his case should be thrown out because IRS agents had identified him by tracking his Bitcoin payments without a warrant, which he claimed violated his Fourth Amendment right to privacy and represented an unconstitutional search. A panel of appellate judges considered the argument and rejected it.

• 1:44:41Speaker 00

  In a nine-page opinion, they explained their ruling, setting down a precedent that spelled out in glaring terms exactly how far from private they determined Bitcoin's transactions to be. "Every Bitcoin user has access to the public Bitcoin blockchain and can see every Bitcoin address and its respective transfers. Due to this publicity, it is possible to determine the identities of Bitcoin address owners by analyzing the blockchain," the ruling read. "There is no intrusion into a constitutionally protected area because there is no constitutional privacy interest in the information on the blockchain." "A search only requires a warrant,"

• 1:45:24Speaker 00

  the American judicial system has long held, "if that search enters into a domain where the defendant has a reasonable expectation of privacy." The judge's ruling argued that no such expectation should have existed here. The HSI agent wasn't caught in the Welcome to Video dragnet because IRS agents had violated his privacy. He was caught, the judges concluded, because he had mistakenly believed his Bitcoin transactions to have ever been private in the first place. Chris Janczewski says the full impact of the Welcome to Video case didn't hit him until the day in October 2019, when it was finally announced in public

• 1:46:08Speaker 00

  and a seizure notice was posted to the site's homepage. That morning, Janczewski received an unexpected call from the IRS commissioner himself, Charles Reddick. Reddick told Janczewski that the case was this generation's Al Capone, perhaps the highest compliment that can be bestowed within IRS CI, where the story of Capone's takedown for tax evasion holds almost mythical status. That same day, the Justice Department held a press conference to announce the investigation's results. U.S. Attorney Jesse Liu gave a speech to a crowd of reporters about what the case represented, how following the money had allowed agents to score a victory

• 1:46:53Speaker 00

  against one of the worst forms of evil imaginable. Chainalysis's Jonathan Levin sat in the audience. Afterward, an IRS official named Greg Monahan, who had supervised Gambarian and Janczewski, came over to thank Levin for his role in the case. It had all started, after all, with Levin's trip to two bored IRS agents in the Bangkok airport. Monahan told Levin that it was the most important investigation of his career, that he could now retire, knowing he had worked on something truly worthwhile. Levin shook the IRS CI supervisor's hand. Neither he nor Monahan could know, at that time,

• 1:47:38Speaker 00

  of the cases still to come, that IRS CI and Chainalysis would together go on to disrupt North Korean hackers, terrorism financing campaigns, and two of the largest Bitcoin laundering services in the world, or that they would track down close to 70,000 Bitcoins stolen from the Silk Road and another 120,000 stolen from the exchange Bitfinex, totaling to a value of more than $7.5 billion at today's exchange rates, the largest financial seizures, crypto or otherwise, in the Department of Justice's history. But as he answered Monahan, Levin thought again of the blockchain's bounty of evidence,

• 1:48:23Speaker 00

  the countless cases left to crack, the millions of cryptocurrency transactions eternally preserved in amber, and the golden age of criminal forensics it presented to any investigator ready to excavate them. "There's so much more to do," Levin said. "We're just getting started." If you or someone you know needs help, call 1-800-273-8255 for free. 24-hour support from the National Suicide Prevention Lifeline. You can also text HOME to 741741 for the crisis text line. Outside the U.S., visit the International Association for Suicide Prevention

• 1:49:07Speaker 00

  for crisis centers around the world.

• 1:49:16Speaker 00

  Thank you for listening to The Big Story from Wired. For more of our journalism, visit wired.com or subscribe to the magazine. We'll be back every Wednesday, Friday, and Sunday with new stories for you to listen to. This story was narrated by me, Christian Titus. The producer was Rose Kirchner. Fran Bandy was our mixing and mastering engineer, and our senior features editor is Jason Kay. Special thanks to Wired's Global Editorial Director Katie Drummond, Executive Director of Features and Special Projects, Rehan Hamansy, and Executive Director of Global Audio, Nico Steele. This series was developed by Michelle O'Brien.

• 1:50:07Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions. It needs limits. Control AI with zero trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 1:50:37Speaker 03

  Done settling for close enough? DXL Big & Tall has the sizes, the fit, and the brands you already love, plus quality you can feel at a price that makes sense. We're talking sizes XL to 8XL, waists 38 to 60, and over 75 brands, all in one place. Finally, no more settling. Just clothes that actually fit Big & Tall guys right. Shop DXL.com or visit one of the 250 stores nationwide. DXL: Wear what you want.

• 1:51:07Speaker 07

  Starting a business can seem like a daunting task, unless you have a partner like Shopify. They have the tools you need to start and grow your business. From designing a website to marketing to selling and beyond, Shopify can help with everything you need. There's a reason millions of companies like Mattel, Heinz, and Allbirds continue to trust and use them. With Shopify on your side, turn your big business idea into... Sign up for your $1 per month trial at Shopify.com/specialoffer.