TRM Labs has revealed new analysis tracing cryptocurrency bills to Virtualine, a internet hosting supplier whose web page area the FBI seized on October 27. The October 28 document hyperlinks bills to wallets TRM buddies with a drug market, ransomware teams, and different prison products and services.
Drug market bills outweighed ransomware
Consistent with TRM’s analysis, a Russian drug market accounted for roughly 44% of Virtualine’s direct cryptocurrency inflows, whilst ransomware teams have been about 5%.
A big sextortion scheme accounted for kind of 17%, whilst a cryptocurrency mixer, a carrier used to difficult to understand transaction trails, contributed round 13%.
TRM additionally recognized bills from StealC, malware designed to scouse borrow data, and some other internet hosting supplier known as Volhav.
TRM primarily based its breakdown on bills won via Bitcoin addresses it buddies with Virtualine. The aim of person transfers used to be now not specified.
TRM mentioned Virtualine won extra worth attributed to illicit resources in 2026 than every other bulletproof internet hosting supplier it labels!
A internet hosting carrier that promised to withstand court cases
So-called “bulletproof” hosts hire servers and web page infrastructure whilst promising shoppers resistance to abuse court cases and legislation enforcement requests.
The Justice Department mentioned government bought court docket approval to take hold of virtualine.internet. Prosecutors allege the supplier marketed to criminals, authorized direct Bitcoin bills, and laundered buyer budget.
In addition they allege that Virtualine endured to host a discussion board that disbursed kid sexual abuse subject material and nonconsensual intimate photographs, and this used to be regardless of repeated warnings.
The FBI’s Washington Box Administrative center, the German, Dutch, and British government, and private-sector companions have been all a part of the investigation.
The cost path stays after the seizure
The DOJ announcement disclosed no cryptocurrency seizure quantity and introduced no arrests or prison fees.
TRM mentioned the supplier’s identified blockchain addresses can be utilized to trace next bills and actions to different hosts. This might lend a hand researchers to evaluate whether or not shoppers migrate or proceed paying current addresses.
For now, the showed enforcement step is the area seizure, however what occurs to Virtualine’s operations isn’t but identified.
Ultimate Abstract
- The FBI seized Virtualine’s area on October 27 in a global operation.
- TRM attributed 44% of direct inflows to a drug market, as opposed to 5% to ransomware teams.