How Did Investigators Trace the Silk Road Dark Web Market to Ross Ulbricht? - Example Timeline | Boromlia
Silk Road, the dark web market Ross Ulbricht ran as Dread Pirate Roberts, was traced through a forum post from 2011 that carried his own Gmail address. Two federal agents on the case went to prison too.
A User Called Altoid Recommends a Website Nobody Had Heard Of
Prosecutors in the Southern District of New York later put the creation of Silk Road at around January 2011. On 27 January a user calling himself Altoid posted on the mushroom-growing forum Shroomery: I came across this website called Silk Road. Two days later Altoid asked much the same question on the Bitcoin Talk forum, calling it an anonymous version of Amazon. Both posts were the owner advertising his own shop to the two communities most likely to use it, in the voice of a curious stranger.
Gawker Names the Site and the Senate Demands It Close
Adrian Chen published a piece on Gawker on 1 June 2011 describing what Silk Road was and how to reach it. Within days Senators Chuck Schumer and Joe Manchin wrote to the DEA and the Justice Department demanding the site be shut down, naming Bitcoin as the currency that made it work. Traffic to the market rose sharply after the coverage. The site stayed open for another twenty-eight months.
Altoid Posts Again, This Time With an Email Address Attached
On 11 October 2011 the Altoid account returned to Bitcoin Talk looking for an IT pro in the Bitcoin community to join what the post called a venture-backed Bitcoin startup. Interested parties were told to write to rossulbricht@gmail.com. The post stayed up in public for nearly two years. It was eventually found by IRS Criminal Investigation agent Gary Alford, who was reading old forum threads and searching for early mentions of the site. No specialist tooling was involved. The identifying evidence in the biggest dark web case of the decade was sitting on a public message board the whole time.
Sixty Undercover Buys
Between November 2011 and September 2013 agents made more than sixty undercover purchases of controlled substances from Silk Road vendors, filled from over ten countries. The buys proved the market worked. They identified nobody.
The Chat About Two People Who Thought He Had Sold the Site
In a Tor chat on 9 December 2011, quoted at trial and again in the Second Circuit's opinion, Ulbricht was asked whether anyone knew of his involvement. He answered that two did, but they think I sold the site and got out and they are quite convinced of it. Shortly after that conversation his correspondent suggested he change his online name to Dread Pirate Roberts, after the character in The Princess Bride whose identity is handed from one man to the next. Prosecutors argued the name was chosen to make a cover story easier to run. The defence would later argue the opposite, that the handle really did change hands.
A Programming Question Asked Under His Own Name
In March 2012 someone posted a question on Stack Overflow: how to connect to a Tor hidden service using cURL in PHP. The account was in Ross Ulbricht's real name. Under a minute later the username was changed to frosty, and weeks after that the address on the account became frosty@frosty.com. The cURL code in that question matched code recovered from a Silk Road server. The encryption key on that server ended in frosty@frosty, and frosty was the only user directory on Ulbricht's laptop. Reporting on this gives the month and not the day, so the date shown here is the first of March.
Baltimore Takes Over an Administrator Account, and an Agent Empties Wallets With It
A separate investigation was running out of the U.S. Attorney's Office for the District of Maryland. Its usual method was to find a low-level Silk Road administrator, obtain cooperation, then take over the account and talk to Dread Pirate Roberts through it. In January 2013 the Baltimore task force searched and arrested a Silk Road customer support representative in Utah. Secret Service Special Agent Shaun Bridges then used that account access to reset user passwords and move about 20,000 bitcoin, worth roughly $350,000 at the time, into a wallet he controlled. He later admitted this in a guilty plea. According to the Justice Department, Ulbricht cut off the representative's access and tried to have him killed in retaliation for the theft the agent had committed.
An Agent Blackmails the Suspect and Names the Wrong Man
Carl Force, the DEA agent leading undercover contact with Dread Pirate Roberts, ran an extra account that his own agency knew nothing about. On 16 April 2013, writing as DeathFromAbove, he told DPR that he knew his real identity was Anand Athavale and demanded $250,000 for silence. DPR called the approach bogus and paid nothing. Athavale was wrong. So was the other leading candidate. The Maryland office spent months on Athavale and on Mark Karpelès, then ran the Mt. Gox exchange, and abandoned both. The Second Circuit set this out plainly: Maryland investigated and later dropped the theory that either man was DPR. The account did not surface until Ulbricht's own defence team found it during the trial.
The Second Persona That Nobody Had Authorised
Force's admitted conduct, set out in his 2015 plea agreement, went further. Using his authorised undercover persona Nob he sold DPR fraudulent identity documents for $40,000 in bitcoin and took a further $50,000 for supposed inside information about the investigation, claiming access to a corrupt official who did not exist. He kept both payments and filed false reports. He then invented a second seller, French Maid, offering the same commodity, and collected about $100,000 more. In March 2014, still a serving DEA agent, he signed a contract with Twentieth Century Fox worth up to $240,000 for a film about the investigation he was corrupting. He also sent an unauthorised Justice Department subpoena to Venmo to unfreeze his own personal account.
A Server in Reykjavík Gives Up Its Own Address
In June 2013 FBI agents in New York said they noticed the true IP address of the Silk Road server leaking in traffic from the site's own front page, which they attributed to a configuration error. They passed it to the Reykjavík Metropolitan Police, who confirmed a high volume of Tor traffic to the machine. Icelandic officers imaged its contents and sent the FBI a thumb drive. This account is contested. Ulbricht's lawyers and several outside technical experts argued the described leak was implausible. Prosecutors responded that even if agents had reached the server by other means it would have been lawful, given what the site was. The courts never resolved the technical question, because they held that Ulbricht had no reasonable expectation of privacy in a server he had not claimed as his.
Nine Counterfeit Licences in One Package From Canada
On 10 July 2013 U.S. Customs and Border Protection opened a package coming in from Canada. Inside were nine counterfeit identity documents. Each carried different details and each carried the same photograph, and all nine were addressed to a flat on 15th Street in San Francisco. Homeland Security Investigations agents went to the address later that month. The man who answered matched the photograph. He said he knew nothing about Silk Road and would not discuss the documents, and he was not arrested. The visit told investigators where he lived, which is what the next stage of the case ran on.
Five Pen Register Orders on a Home Wi-Fi Router
With Ulbricht now a primary suspect, the government obtained five pen register and trap and trace orders in September 2013 under 18 U.S.C. sections 3121 to 3127. These captured the IP addresses of traffic going to and from his home wireless router and the devices attached to it, though never the contents of anything. That routing data let agents line up the hours he was online with the hours Dread Pirate Roberts was active. Ulbricht argued on appeal that collecting it without a warrant breached the Fourth Amendment. Both the district court and the Second Circuit disagreed, on the ground that an IP address disclosed to a service provider is not private in the way the contents of a message are.
Arrest in the Glen Park Branch Library, Mid-Conversation
The problem with arresting Dread Pirate Roberts was proving he was Dread Pirate Roberts at the moment of the arrest. An encrypted laptop that closes is a laptop nobody can read. Agents watched Ulbricht cross Diamond Street to the Glen Park branch of San Francisco Public Library on the afternoon of 1 October 2013. Minutes later DPR came online in the Silk Road staff chat. Special Agent Jared Der-Yeghiayan, posing as an administrator called Cirrus, asked DPR to go and look at some flagged user messages, which forced him to log in through the marketplace as well as the chat. Once Der-Yeghiayan saw DPR reach the flagged page he signalled the arrest team. The laptop was seized open. On the screen was the chat with Cirrus, and Ulbricht had reached it through the Mastermind page, which only Dread Pirate Roberts could open.
Handwritten Notes in a Bedroom Bin
The search of his flat turned up two USB drives and, crumpled in the bedroom rubbish, handwritten notes on improving Silk Road's vendor rating system. DPR had posted that same idea on the site's forum days earlier.
The Site Goes Dark and the Numbers Come Out
Silk Road was seized on 2 October 2013 and the complaint was unsealed. As of 23 September 2013 the site had carried nearly 13,000 listings for controlled substances. It also held 801 listings under digital goods and 169 under forgeries. Another 159 sat under services, most of them offers to hack into somebody's accounts. The government put total sales across the site's life at roughly $183 million, with Ulbricht taking over $13 million in commission. Agents recovered around $18 million in bitcoin from the wallet on his laptop, and blockchain analysis indicated about 89 per cent of it had come from the Iceland servers.
Guilty on All Seven Counts After a Three-Week Trial
The trial ran before Judge Katherine Forrest at the Daniel Patrick Moynihan courthouse in Manhattan from 13 January 2015. Ulbricht's counsel conceded in his opening statement that Ulbricht had built Silk Road, then argued he sold it in 2011 and was lured back at the end to take the blame. On 4 February the jury convicted him on all seven counts, including continuing criminal enterprise. Ulbricht did not testify. The court had barred him from putting Carl Force's corruption before the jury, because the grand jury investigation into Force was still live, and he did not learn what Shaun Bridges had done until the complaint against both agents was unsealed after his conviction.
Life Without Parole, and a Forfeiture Order of $183,961,921
Judge Forrest sentenced Ulbricht on 29 May 2015 to life imprisonment without the possibility of parole, and ordered forfeiture of $183,961,921. He was thirty-one. Sentencing took account of conduct he was never tried for. Evidence at trial showed DPR had commissioned five killings, paying $150,000 in bitcoin for one and $500,000 for four more. The government stated in open court that it found no evidence any of the killings happened, and theorised the recipient had simply taken the money. No murder charge was ever put to a jury.
The DEA Agent Gets 78 Months
Carl Force pleaded guilty on 1 July 2015 to money laundering, obstruction of justice and extortion under colour of official right. On 19 October Judge Richard Seeborg sentenced him to 78 months and ordered $340,000 in restitution. He had been a DEA special agent for fifteen years. The IRS agent in charge noted that the case against Force was built the same way the case against Silk Road was, by tracing bitcoin through the blockchain and comparing it against the seized server data.
The Secret Service Agent Gets 71 Months
Shaun Bridges was sentenced on 7 December 2015 to 71 months for money laundering and obstruction, and ordered to forfeit $651,000. He had converted the stolen bitcoin through Mt. Gox and moved $820,000 into a personal investment account.
The Second Circuit Affirms and Says What It Thinks of the Agents
A unanimous panel of the U.S. Court of Appeals for the Second Circuit affirmed both the conviction and the life sentence on 31 May 2017. It rejected the argument that the pen register orders needed a warrant, and rejected the claim that the exclusion of the Force material had denied Ulbricht a fair trial. The court did not soften its view of the agents. It described the shocking personal corruption of these two government agents as a disgrace to the agencies they worked for, while holding that it had no bearing on whether Ulbricht ran Silk Road.
Bridges Is Sentenced a Second Time, for a Theft Committed After His Conviction
Before reporting to prison on the first sentence, Bridges used a private key to drain about 1,600 bitcoin out of a wallet belonging to the U.S. government. On 7 November 2017 Judge Seeborg gave him 24 further months, consecutive to the 71 he was already serving, and ordered forfeiture of roughly 1,500 bitcoin, then valued at about $10.4 million.
The Supreme Court Declines
On 28 June 2018 the Supreme Court denied certiorari. The petition had asked whether warrantless collection of a person's internet routing data breaches the Fourth Amendment. The life sentence stood.
Maryland Drops the Murder-for-Hire Indictment It Filed in 2013
The Baltimore case had never gone to trial. On 20 July 2018 U.S. Attorney Robert Hur moved to dismiss the three-count 2013 indictment, which included a murder-for-hire count, citing the affirmed New York conviction and the better use of his office's resources. The court granted it the following month. So the allegation that shaped a great deal of the public account of this case was tested by no jury anywhere. It was heard at sentencing, and it was withdrawn without a verdict.
69,370 Bitcoin Arrive From Someone the Government Will Not Name
In 2020 IRS Criminal Investigation used a commercial blockchain attribution firm to re-examine Silk Road's transactions and found 54 that had gone unnoticed, representing coins taken from the site in about 2012 and 2013. The trail led to a wallet holding 69,370 bitcoin. On 3 November 2020 a person the forfeiture complaint calls only Individual X signed a consent agreement handing the coins over. It was the largest cryptocurrency seizure in the Justice Department's history at the time, valued then at over $1 billion. Individual X has never been publicly identified and was not charged.
A Full and Unconditional Pardon After Eleven Years
On the evening of 21 January 2025 President Donald Trump signed a full and unconditional pardon for Ross Ulbricht, who was then forty and had served more than eleven years. He was released from the federal penitentiary at Tucson the next day. The pardon wiped out the $183,961,921 forfeiture along with the sentence. The convictions of Carl Force and Shaun Bridges are untouched by it. Neither the Iceland server question nor the identity of Individual X was ever resolved on the record. Built this run from Justice Department press releases in the Southern District of New York and the Northern District of California, plus the Second Circuit's 2017 opinion in United States v. Ulbricht. Contemporaneous reporting supplied the forum posts and the border interception. Photographs here are freely licensed pictures of the places involved. None of them show the events themselves.