Loading story…
German authorities arrested Owe Martin Andresen, a 49-year-old German national, on May 7 as U.S. and German prosecutors accused him of being "Speedstepper," a senior administrator and suspected main operator of the now-defunct dark web marketplace Dream Market. Prosecutors allege Andresen controlled commission proceeds from the Tor-based marketplace, which operated from 2013 to 2019 and became one of the largest darknet bazaars for narcotics and other illicit goods after the takedowns of AlphaBay and Hansa.
Investigators said they tied Andresen to Dream Market through cryptocurrency wallet activity, including the reactivation and consolidation of dormant marketplace funds in 2022 and the later conversion of proceeds into gold bars allegedly shipped to his home in Germany. U.S. authorities allege he laundered more than $2 million between 2023 and April 2025, while coordinated searches at three locations reportedly seized about $1.7 million in gold bars, more than $23,000 in cash, bank accounts, crypto assets, and records linked to an additional roughly $1.2 million in suspected proceeds.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
By 2026-05-13 and 2026-05-14, U.S. and German authorities publicly disclosed charges against Andresen for alleged money laundering and his suspected role as a key Dream Market administrator. The case identified him as the long-unidentified "Speedstepper."
Authorities searched three locations tied to Andresen after his arrest and seized assets including about $1.7 million in gold bars, more than $23,000 in cash, bank accounts, crypto assets, and records tied to roughly $1.2 million in additional suspected proceeds.
On 2026-05-07, German authorities arrested Andresen in a coordinated U.S.-German operation. He was accused of being the Dream Market administrator known as "Speedstepper" and of laundering proceeds tied to the marketplace.
U.S. prosecutors allege Andresen laundered more than $2 million in proceeds tied to Dream Market between 2023 and April 2025. The alleged laundering involved commission proceeds from the defunct darknet marketplace.
In 2023, prosecutors allege Andresen converted part of the suspected Dream Market proceeds into gold bars. The bars were reportedly shipped directly to his home in Germany and became part of the evidence cited by investigators.
According to prosecutors, dormant commission wallets tied to Dream Market were consolidated and moved in late 2022. Investigators later used this cryptocurrency activity to help link the funds to Owe Martin Andresen, allegedly known as "Speedstepper."
Dream Market ceased operations in 2019 after years of activity as a major darknet marketplace. By that time it had become especially prominent following the takedowns of AlphaBay and Hansa.
Dream Market launched in 2013 as a Tor-based darknet marketplace using cryptocurrency payments. It later became one of the largest illicit online markets for narcotics and other illegal goods and services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetheregister.com
Open sourcejustice.gov
Open sourcedarkwebinformer.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Jun 29, 2026
German and Spanish authorities dismantled the relaunched **Crimenetwork** criminal marketplace and arrested its suspected operator in Mallorca, according to Germany’s Federal Criminal Police Office (BKA) and subsequent reporting. Investigators identified the suspect as a 35-year-old German national accused of rebuilding the platform shortly after the original Crimenetwork was shut down in December 2024, then operating it as a major German-speaking underground market for stolen data, narcotics, forged documents, and other illicit services. Authorities said the platform had more than **22,000 users** and over **100 vendors**, processed payments in cryptocurrencies including **Bitcoin**, **Litecoin**, and **Monero**, and generated more than **€3.6 million** in revenue. The operation was led by the **BKA**, the Frankfurt am Main Public Prosecutor’s Office’s **ZIT**, and the Spanish National Police; investigators also preliminarily seized about **€194,000** in assets and obtained user and transaction data that is expected to support follow-on investigations into vendors, buyers, and related criminal activity.
Jun 29, 2026
**Empire Market** co-creator **Raheim Hamilton** (aka “Sydney”/“Zero Angel”) pleaded guilty in U.S. federal court in Chicago to a **drug conspiracy** charge tied to operating the dark web marketplace from 2018–2020. Prosecutors said the Tor-hidden service facilitated **over 4 million transactions** totaling **more than $430 million**, primarily **illegal drug sales (~$375 million)**, and also enabled sales of **stolen credentials, personal data, counterfeit currency, and hacking tools**; Hamilton admitted the platform was designed to evade law enforcement and launder proceeds via **cryptocurrency-only** payments. Hamilton and co-defendant **Thomas Pavey** (aka “Dopenugget”) were previously charged for running the market and allegedly had earlier involvement selling counterfeit currency on **AlphaBay** before launching Empire Market. Reporting indicates law enforcement conducted **undercover purchases** (including heroin and methamphetamine), and the investigation resulted in significant cryptocurrency seizures (reported at **~$75 million**) and forfeiture commitments including **Bitcoin, Ether, and property**; Hamilton faces a **mandatory minimum of 10 years** and up to **life** in prison, with sentencing scheduled for **June 17, 2026**.
Jun 29, 2026