That legal request took weeks to bear fruit. Finally, one evening in the early weeks of January 2017, Ali was in the middle of a law school night class when she got a call from the Sacramento-based FBI agent with the news: The subpoena results had come back.
The agent told her the name on the exchange account tied to the Tunafish address. It was Alexandre Cazes.
Over the next months, Ali and Erin continued to trace more high-value addresses out of the AlphaBay cluster into one cryptocurrency exchange after another. They came to recognize what seemed to be Cazes’ identifying tells, even in his bitcoin-laundering habits; in some cases, his attempts to obscure his ownership of the bitcoins became, themselves, a kind of fingerprint.
In total, the two analysts traced Cazes’ commissions to a dozen cryptocurrency exchanges. The prosecutors then subpoenaed these one by one, finding accounts registered in both Cazes’ and his wife’s names. And as those results came in, a yearslong pattern emerged: Cazes would open an account with an exchange and attempt to use it to cash out a chunk of AlphaBay’s profits. At some point—often within months of his cash-out transactions—the exchange would grow suspicious about the origin of these massive cryptocurrency trades and ask for more know-your-customer information from him.
Cazes would send a note explaining that he was merely an early investor in Bitcoin. In some cases the AlphaBay founder claimed to have bought thousands of coins from the defunct exchange Mt. Gox in 2011 or 2012—knowing it would be difficult to check the records, given that Mt. Gox had declared bankruptcy in 2014. In others, Cazes claimed to have bought them from a private seller at the exchange rate of a dollar each. “Since then, I’ve been pretty much juggling the coins like stocks, buying and selling, but never cashing out,” he wrote in one emailed explanation to an exchange.
By 2017, however, legitimate Bitcoin businesses had learned to be wary of these unverifiable stories. In most cases they closed or froze Cazes’ account, forcing him to move onto another exchange. Ali and Erin, meanwhile, could see the true source of Cazes’ wealth traced out in strand after strand of the blockchain’s connections.
For years to come, the investigators involved in the AlphaBay case would debate whether their cryptocurrency tracing alone would have cracked the case even if they had never gotten the Pimp_alex_91 tip. Would the appearance of Cazes’ name on those exchange accounts have been enough to put them onto his trail, or would they have treated it as just another vague lead that they were too busy to chase down?
Coming as it did, however, in the immediate wake of the tip sent to Miller about Alpha02, the two FBI analysts’ blockchain work nailed to the wall a theory that would have otherwise hung by only a few threads. Every exchange subpoena and its results drew another line between Cazes and AlphaBay’s fortune.
“When we saw millions of dollars in crypto flowing to him from what appeared to be AlphaBay-associated wallets, I was fairly confident that we had the right person,” Rabenn says. “When you hit that point, you start gearing up to indict.”
Continued next week: When investigators find Cazes’ online alter ego on a pickup artist forum, they also discover a new challenge to catching him red-handed—and hatch a plan for the most ambitious sting in dark-web history.
This story is excerpted from the forthcoming book Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency, available November 15, 2022, from Doubleday.
If you buy something using links in our stories, we may earn a commission. This helps support our journalism. Learn more.
Chapter Illustrations: Reymundo Perez III
Photo source: Getty Images
This article appears in the November 2022 issue. Subscribe now.
Let us know what you think about this article. Submit a letter to the editor at mail@wired.com.