Crime

Nabbed on way to beard-growing contest, 'OxyMonster' to plead to drug charge in Miami

Dark web’s Gal Vallerius, aka “OxyMonster”
Dark web’s Gal Vallerius, aka “OxyMonster” Twitter Account

His moniker on the dark web was "OxyMonster."

He played the role of moderator on the Dream Market, acting as a referee on an eBay-type site for online drug deals between buyers and sellers of cocaine, methamphetamine and oxycodone.

Now, Gal Vallerius, a Frenchman proud of his distinctive long beard, plans to plead guilty in Miami federal court to drug conspiracy and money laundering charges that could send him to prison for 20 years or more..

After his arrest last summer, Vallerius was facing up to life in prison on an indictment. His lawyer with the federal public defender's office tried to keep out the critical piece of evidence that agents took from him when he arrived in the U.S. — his laptop computer. When that failed, his lawyer, Anthony Natale, worked out a plea deal with prosecutor Tony Gonzalez to spare the 39-year-old Vallerius from spending the rest of his life in prison, according to court records.

Natale and the U.S. attorney's office declined to comment on the proposed deal, scheduled for a court hearing before U.S. District Judge Robert Scola on June 12.

Another factor that compelled Vallerius to cut the plea agreement was the prosecution's plan to bring in other trial evidence of his alleged dark web drug sales activities in addition to being an administrator for Dream Market. In a court filing, prosecutors asserted he sold Ritalin and Oxycontin on another illicit site, the Hansa Market, which was taken offline by the Netherlands national police last July. Prosecutors also claimed Vallerius was a member of several other dark web sites, including Silk Road, Pandora and Alpha Bay.

Ultimately, Vallerius' biggest mistake was traveling with his wife from their home in France to Texas, where he wanted to compete in the world beard-growing championship in Austin. After arriving on Aug. 31, 2017, in Atlanta, the brown-bearded Vallerius was detained for questioning about his laptop and then arrested by U.S. authorities.

Vallerius’ laptop contained the Tor browser, which allows users to conceal their true internet protocol addresses on that network; his log-in credential for Dream Market, the eBay-type marketplace for illegal narcotics and drug paraphernalia; and $500,000 worth of the digital currency bitcoin, according to a Drug Enforcement Administration affidavit.

Tracking down Vallerius — the biggest of a half-dozen dark web targets charged over the past two years in South Florida — was not easy. It involved the DEA, FBI, IRS, Homeland Security Investigations and the U.S. Postal Inspection Service.

Vallerius played the secret role of “moderator” on Dream Market, the dark web site that allows illicit drug sellers and buyers to make deals in Europe and the United States without revealing their true identities. The underground website is not only a marketplace, it provides technical assistance, resolves disputes and posts reviews of vendors. And, like eBay, Dream Market charges a commission on every transaction as a percentage of the sales price.

In January 2017, DEA agents logged into Dream Market’s home page and clicked a link called “Forum,” which allows sellers, buyers and moderators to discuss anything for sale on the dark web, according to the DEA affidavit. While browsing the forum, agents navigated to a topic called “Official Staff” under the “Announcements” tab. The first posting was written by “OxyMonster,” Vallerius’ alias, though agents had not made that connection yet. They clicked on “OxyMonster” and were taken to his profile, which said he was a senior moderator.

A joint law enforcement operation on March 28, 2018, in Cleveland was one of dozens around the country targeting those who buy illegal narcotics like fentanyl on the dark web.

Last summer, DEA agents also identified “OxyMonster” as a vendor on Dream Market who shipped from France to anywhere in Europe as well as to the United States, the affidavit said. Agents analyzed his posts on the Dream Market forum, including tips on how to stay anonymous on the dark web. Last August, agents learned that “OxyMonster” was using a certain bitcoin address for the sales transactions. They soon analyzed incoming and outgoing transactions from that bitcoin address and discovered that most of them went to Vallerius on Localbitcoins.com.

"In connection with his role as a 'senior moderator,' [Vallerius] also sold controlled substances to other members using the website, receiving payment for these sales through the use of a bitcoin 'tip jar,' or electronic depository," according to a magistrate judge's summary of the prosecution's case. "It was through this tip jar that law enforcement officials became aware of Vallerius' true identity.

"After locating the bitcoin depository allegedly belonging to the user 'OxyMonster,' agents tracked several incoming payments and outgoing deposits from the tip jar to various 'wallets' controlled by Vallerius."

DEA agents soon found that Vallerius had Instagram and Twitter accounts. They compared the writing style of “OxyMonster” on the Dream Market forum to the writing style of Vallerius on his social media accounts. “Agents discovered many similarities in the use of words and punctuation, including: the word “cheers,” double exclamation marks, frequent use of quotation marks, and intermittent French posts."

Last August, DEA special agent Lilita Infante contacted Homeland Security Investigations to find out whether Vallerius might be traveling to the United States. That agency said he was flying from Paris to Atlanta on Aug. 31, 2017. Infante asked the Homeland Security's border officials to flag him and pull him aside for questioning at customs.

During a court hearing on the admissibility of certain evidence, Infante testified she did not know what Vallerius would be carrying with him but that in her experience, users of the dark web often conducted their business on laptop computers. She said she hoped that a search of Vallerius' belongings, including his laptop, upon entering the United States might reveal additional links between him and his suspected Dream Market activities.

The DEA agent's hunch proved to be spot-on. Vallerius, who was with his wife, possessed a laptop computer, cellphone and iPad tablet. A Homeland Security agent asked him for the passwords to the electronic devices as a "routine inspection" at the border.

DEA agents, waiting in a nearby room at customs, used the passwords to gain access to Vallerius' computer and search its contents. And that was how they directly linked Vallerius to the Dream Market.

  Comments