Darknet Markets in the Past: Dream Market

The narrative of Dream Market, probably one of the most successful darknet markets of all time, is shrouded in mystery and hearsay, with few people knowing what happened in its final two years. Though the market appeared to terminate gracefully, giving users more than a month’s notice to withdraw their funds before closing, conspiracy rumors abound over the fate of the site’s originator and administrator, SpeedStepper. Making matters even more confusing is the story of Gal Vallerius, a Dream merchant who went by the alias OxyMonster and is still imprisoned today.

Table of Contents

Dream Market debuted on November 15, 2013, with little excitement, sometimes eclipsed by the aftermath of the Silk Road collapse, the advent of Silk Road 2, and the rise of more popular markets. This was only a month and a half after the FBI confiscated Silk Road, and only 10 days after the launch of Silk Road 2. The market ran until April 30, 2019, despite much controversy, making it the longest-running English-speaking market of all time and the second-longest overall (after Hydra).

Dream Market had somewhat more than 122,000 listings at its peak, approximately 62,000 of which were for drugs. This made it a much larger operation than Silk Road, but much smaller than its main competition, which was AlphaBay for the majority of the time. Agora (12/2013 – 9/2015), Outlaw Market (12/2013 – 5/2017), Evolution (1/2014 – 3/2015), Diabolus/SR3 (10/2014 – 4/2016), Nucleus (10/2014 – 4/2016), and Crypto Market (2/2015 – 2/2017) were all big markets that came and departed during Dream’s lifespan.

Dream Market was aided in its introduction by a notification on DeepDotWeb, the clearweb’s pioneering and definitive darknet market link aggregator. However, the market was eclipsed at first by the opening of numerous flashier markets, all competing for the title of “the next Silk Road.” Dream received its first evaluations on DeepDotWeb in the second half of 2014; prior to that, it was reduced to the status of third or even fourth choice for many darknet market customers at the time.

Dream followed a stringent no-fentanyl policy for the second part of its life, which may have helped to its longevity. Aside than that, it had the standard darknet market categories for things now seen in today’s marketplaces, with the most popular being cannabis, stimulants, Ecstasy, opioids, digital goods, prescriptions, psychedelics, benzodiazepines, dissociates, and fraud-related items, in that order. The market employed various features that are common in today’s markets, such as 2-FA for login, PIN for purchases/withdrawals, and even briefly supported Monero.

Operation Bayonet

The original AlphaBay, which launched in December 2014 (more than a year after Dream), was by far the world’s largest darknet market at one point. It had over 200,000 members, 40,000 sellers, and 350,000 listings when it was seized in July 2017, when it was also at its pinnacle. To put things in context, this made the market more than 20 times larger than the initial Silk Road, which had roughly 14,000 postings before it was shut down.

The story of AlphaBay admin Alexandre Cazes, nicknamed Alpha02, who was arrested in Thailand as part of Operation Bayonet, a multi-national initiative led by the FBI, is well-known. Cazes famously committed suicide in his jail cell a week after his arrest, before being transferred to the United States and put on trial. Several blatant OpSec mistakes had led to his demise, most notably his use of a personal Hotmail account to receive AlphaBay support emails in 2014, at the market’s inception. He’d also been using the internet alias Alpha02 in several carding and tech forums since 2008.

After AlphaBay went offline, many customers fled to not only Dream, but also Hansa, a Dutch-based darknet market that had been hacked by Dutch law police weeks earlier. The market was working normally, with no discernible differences, except that all user data, including that of the freshly arrived AlphaBay refugees, was being collected to be used against them.

Law enforcement issued takedown letters for Hansa (left) and AlphaBay (right).

In order to acquire information on vendors, law enforcement deleted all product picture files, forcing businesses to re-upload photos that contained geographic data. They also invited vendors to download a recovery key in the form of a specially prepared Excel file that, when opened from the vendor’s computer, revealed their IP address. Based on the information supplied by these approaches, it is believed that at least 40 merchants were discovered and detained. On July 20, 2017, Hansa was shut down, and the scope of the disruption was revealed to the public.

The shutdown of the two markets had the effect of propelling Dream firmly into the position of the world’s largest darknet market, not only due to the loss of its two main competitors, but also due to activity by ex-users seeking a new market. The graph below is from the academic work Lost in the Dream? Measuring the effects of Operation Bayonet on merchants migrating to Dream Market, published by Delft University of Technology, depicts the influence that the closure of AlphaBay and Hansa had on the growth of Dream, allowing it to catapult to the top spot.

The university study also looked at vendor migration from AlphaBay and Hansa and discovered that 40% of 220 vendors who opened accounts on the market between July 1st and September 1st, 2017 had PGP keys related to AlphaBay, while only 2% had PGP keys linked to Hansa. According to a comparable survey, approximately 24% of vendors who arrived at Dream in the third quarter of 2017 kept the same name they had on earlier markets (mostly AlphaBay), while the rest did not.

According to these research, the majority of merchants from AlphaBay and Hansa elected to start over with a new identity, thinking that it was not worth the risk to continue using their former names. It also implies that more incoming suppliers were aware that Hansa was now under law enforcement control, which was the case for at least the last month of its existence.

Reddit post from the ‘Hansa and Alphabay busted megathread’ has been archived.

Operation Bayonet therefore signified a shift in how vendors would migrate to new markets, as it was discovered that the government could operate darknet platforms as “honeypots” in a covert manner. For seasoned sellers, it became a question of whether having an established reputation – which made it easier to acquire consumers – was worth the risk of knowing that law enforcement was actively watching their behavior.

The impact from Operation Onymous, which resulted in the removal of around 414 onion links pointing to 27 darknet sites on November 5th and 6th, 2014, aided the migration to Dream. While many of these sites were not markets per definition, but rather related to money laundering and strange “contraband,” the operation took down at least three darknet markets, the most noteworthy of which was Silk Road 2.0. This resulted in a user exodus to not only the Dream marketplace, but also the Agora and Evolution marketplaces.

Gal Vallerius, aka OxyMonster

OxyMonster began as a low-level seller on Dream, predominantly selling Oxycontin but also Ritalin, methamphetamine, cocaine, and heroin. He was good at his job – in the sense that he was skilled in taking and delivering orders – and after a few years worked his way up to the position of Senior Moderator of Dream Market, according to court documents.

OxyMonster was given special operating privileges on the market and allowed to continue his job as a seller as a moderator who was obviously held in high respect by the Dream administration. Instead of using the usual ordering and payment system, he received payments for orders via Bitcoin “tip jar” transactions — an address that was actively being followed by law enforcement authorities in the United States. The tip jar address was even included in OxyMonster’s market profile, making it extremely simple to connect to his account. 15 of 17 tip jar transactions were tracked back to a LocalBitcoins wallet operated by a French-Israeli individual named Gal Vallerius.

Vallerius was detained by US Customs after landing at Atlanta International Airport in late August 2017. cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval cheval chevalgültig cheval cheval cheval cheval cheval cheval cheval cheval cheval Despite not being arrested at the time, Vallerius handed over the laptop he was traveling with to federal officials, who were able to access his LocalBitcoins account. Agents linked an incoming transaction from the OxyMonster tip jar in the account, which was registered under his real name, leading to his arrest and eventual conviction.

OxyMonster’s legendary beard in all its splendour. The British Beard Club is the source of this information.

After pleading guilty in June 2018, Vallerius was convicted of money laundering and narcotics conspiracy offences. His sentence was later reduced from life in prison to 20 years as part of a plea bargain conditional on his willingness to operate undercover for US law enforcement. The disclosure of this material in the plea agreement fueled widespread speculation that Dream had been hacked. The market continued to operate for the next five months, albeit it was no longer the same by many accounts.

“After working with SpeedStepper for years and years at a humble pay, recently we noticed he had become corrupt, closing down vendor accounts and cashing them out without expressing any reasons,” a self-professed ex-moderator at Dream wrote in a Dread forum post. We requested a wage increase in response to the activities he has taken, but he has denied without hesitation. He’s as cheap as fuck now that OxyMonster is gone.”

Disappearance of SpeedStepper

Aside from the fact that it was the most likely target for law enforcement inquiry at the time, Speedstepper’s decision to close Dream was heavily influenced by a seven-week-long distributed denial-of-service (DDOS) attack. To ensure accessibility, the market had to add an excessive number of mirrors, totaling more than 600.

According to HugBunter, creator and co-admin of the Dread forum, the attack was carried out by a hacker who took advantage of a “quirk” in Tor that allowed it to carry out the attack cheaply. The hacker requested a $400,000 payment from the market to end the attack, which Dream admin SpeedStepper refused, saying it was more better to simply close shop.

Dream’s closure was further plagued by controversy, as any announcements were never signed via PGP by SpeedStepper. Many others believed that the market had been compromised much earlier, and that SpeedStepper was actually Gal Vallerius himself. According to one security blog, the admin was deanonymized as a Florida resident “based on the domain registrations for many surface websites,” however this information was never substantiated.

SpeedStepper, whomever he was, had a very different style and approach than Ross Ulbricht, the creator of Silk Road, the first true darknet market. In an April 2019 piece, a Vice contributor briefly highlighted the differences between the two administrators:

“Unlike Ulbricht, who is a political tech-savant, Speedsteppers (sic) is not a ranting libertarian.” Instead, they’re a sophisticated, tech-savvy, media-savvy digital drug lord. Speedsteppers (sic) has captained this criminal fleet with silent aplomb if loose mouths sink ships. His or her ideological objectives are unknown, except from the purchase of bitcoin via a % commission levied on each sale.” – Vice contributor Mike Power

Samsara Market

Dream eventually went offline in the first week of May 2019, with sales deactivated throughout its final month while customers withdrew their remaining monies, but not before a declaration that the market would continue in a new form, to be named as Samsara Market. However, because to the lack of signed communications from SpeedStepper and persistent worries about who would actually run the new market, most of the community was skeptical of this concept. Waterchain, a former Dream moderator, relayed the information on Dread, however it was poorly received:

The “new market” mentioned in the preceding statement, Samsara Market, was created on July 4th, 2019 – exactly two years after the FBI issued a seizure notice on AlphaBay. Though it appeared professional and provided a reasonably competent interface via which transactions could be performed, Samsara never caught on, and the market vanished in an exit fraud on November 14th, just more than four months later.

HugBunter chimed in on the topic of the closure, using an appeal to his authority to calm market customers and provide some explanation on what was actually a complex situation:

“I’m not responding to this to defend anything or anyone, but I can personally confirm that not only did Waterchain work closely with SpeedStepper, to the point of relaying and mediating some things between myself and Speed on numerous occasions, but I don’t really have any blame I can lay on him for the problems with Dream or Samsara.”

HugBunter added the following in a somewhat dramatic reveal in the same thread posted on Dread:

“I believe it’s probably time to openly disclose that SpeedStepper also ran Samsara, and he doesn’t deserve much credit for any amicable Dream shutdown.” His objective was to dissociate his identity by running the exact same market under a different name, erroneously believing it would rocket to the heights of Dream overnight while escaping the ongoing DoS attacks.

He realized he was mistaken, and rather than closing Samsara on a positive note, allowing users to withdraw their funds, he decided to simply disappear and take everything with him. While this is also strange given that he surely had many life-times worth of coin from over 5 years of running Dream, I don’t actually doubt that he simply decided to leave and steal what he could. From my conversations with him, it was clear that he had a level of avarice.” HugBunter, Dread’s originator and administrator.

Despite Samsara’s relative failure, the profits projected to have been produced by SpeedStepper and Dream market are enormous, potentially worth more than a billion dollars at today’s BTC rates. Dream charged a fixed 8% fee on every sale, including 4% from the vendor and 4% from the buyer. Profits from vendor bonds varied from $250 to $2000 per vendor, depending on when they joined up and the price of BTC at the time. These funds were amassed over a 5.5-year period.

Though it is unknown what happened to SpeedStepper, the narrative of Dream Market is one of the most intriguing yet less well-chronicled darknet market myths, muddied by a tangled mix of reality, rumor, heresy, and what is most certainly disinformation.