Bitcoin drug deals could haunt people for years | Hacker News Reader

Bitcoin drug deals could haunt people for years

wired.com

64 pointsHHend71 comments

> You might already regret that decision, for any number of reasons. After all, the four bitcoins you spent on that bag of hallucinogenic mushrooms would now be worth about as much as an Alfa Romeo.

It's not like they just happened to have some bitcoins and realized they could buy drugs with them. They only bought the bitcoins so they could buy drugs.

Plus, the dollars the author had in their wallet could also have been used for buying Bitcoins which would now be worth an Alfa Romeo, so everyone can regret their purchasing decisions, not just people who already held Bitcoins.

Why not circular causality - the losses made with buying drugs with bitcoins, drove them to take drugs in the first place..

> ... the evidence of that drug deal may still be hanging around in plain view of law enforcement, even years after the Silk Road was torn off the dark web.

How about your delivery address being in the merchant's raided servers?

Plausible deniability.

Seriously, I've never heard of anyone getting arrested from some home address on a server or bitcoin data. At the very minimum the police would need to do what's called a "controlled delivery" to the persons house and confirm the recipient identity and confirm they are receiving the package. Then they'll have a warrant prearranged and verify they opened the package upon entry into the house.

Alternatively, they'll nab someone as they pick up a package at a post office and driving home.

Even in that advanced scenario the people still have a significant degree of plausible deniability, as anyone can send anyone else a letter. So there better be some good proof the person was also the person who bought the Bitcoin and good proof that it was sent to some dealer/drug site.

Plus most of those sites required the user PGP encrypt their address when sending it via the web app, so it's not necessarily accessible on the server even if they have the raw DB.

This article is spreading complete FUD.

You don't seriously think people order drugs to their own addresses, right?

Where else? If I order drugs to somebody else's address, they'll get the drugs and not me.

Well, most people just put a fake name, or name of a previous tenant.

Houses change ownership, people make mistakes.

This is in fact the last thing you should do according to every single buyer guide. Postal service would assume there is something fishy going on.

It is, yet I still routinely receive mail for two previous tenants of the house we now own. If you're a regular purchaser then yes it will be weird is suddenly a previous tenant starts receiving packages every few weeks on a regular interval and they're not getting returned.

But the real reason you shouldn't do it is that you don't actually get any deniability. John Doe who used to live at my address is not going to order drugs and ship them to my address. Especially if he's moved any reasonable distance, or is dead, or incarcerated, etc. It's no less obvious than just shipping them to yourself.

I'm still getting the occasional piece of mail for previous tenants and I've owned my house since 2004. Of course rampant package theft means anything sent to my house is stolen within minutes, so all you're doing is buying free stuff for thieves. I've long ago switched to a post office box.

Is package theft really that bad/fast where you live?

It's entirely anecdotal of course but my wife bought a one-of-a-kind dress (trunk show sample) and it was stolen out of our mailbox. We found the packaging for another dress that came separately but couldn't find her $1,000 dress.

That was three or four years ago and I've had a PO Box ever since. So I thought my neighbors on nextdoor were exaggerating and then I was forced to have a package delivered because Google uses FedEx Ground for their slowest and cheapest option.

It was less than an hour between email notification of package delivery and my checking to find it gone. So add some buffer time in case the driver was slow to update the package status but still I'd say an hour to an an hour and a half was rotten luck or people are actively searching for packages. Probably both to be honest. I'm sure there's lots of confirmation bias there.

That sucks. I am in the suburbs of a fairly small city along the gulf coast, we mainly have issues with package theft in November/December. People just follow the UPS truck.

Rarely in the UK people pay for a redirect. Other than that the Postal Seervice don't really know who lives where. If your getting post for an ex tenant, that redirect isn't in place.

But the postman who delivers the post will notice that he's delivering the odd bit of post for somebody who doesn't live there.

I get at least 2 or 3 letters a week for previous residents of my house (and I've owned it for 10 years). Probably 1 or 2 packages a year too.

(Yes I follow the recommended process for dealing with it.)

UK: https://personal.help.royalmail.com/app/answers/detail/a_id/...

" It's my address but someone else's name

We deliver to addresses rather than names so our advice here would be to put a cross through the address and write on the item 'Not known at this address' or, 'No longer lives here' and post the item at your convenience - you won't need to apply any postage. Where applicable we will return the item to the sender hopefully allowing them to update their records. "

And even then it won't all stop. The direct marketers don't care and some financial companies are bound by law to keep sending the letters if they don't have an updated address for the old residents.

After we started doing this we got a couple of letters from the likes of Zurich Ltd addressed "to the householder" explaining that they'd love to stop sending us junk, but they have to, and if we could give them any details about where the old residents might be, that would be great. I wished them luck and told them the best we knew they'd moved abroad, permanently, possibly to Turkey.

Mildly off topic but I was a postman for a few years and the advice you linked to will get you almost all the way. Next time you get a letter that isn't for you put a big circle around the label, then put a cross through the circle. Don't write anything on it, but next time you see the postman give it directly to him/her/them and ask them to put it in with the blind letters. That will work. Probably.

I frequently receive mail for people who haven't lived in this house for a decade, so I challenge your assumption. The postman isn't paid enough to care.

Why? What if I have a guest coming over.

Also postman doesnt give a fuck.

Interesting. My experience is from central europe, or essentially the 3 german countries where people are heavily advised to use their real names.

In the countries you mention, individual apartments don't have numbers, but are rather identified entirely by the name(s) of the occupants. If the parcel is not addressed with your name you won't receive it.

That's actually a red flag, and heavily discouraged by the community in question, so 'most' definitely don't do that.

Send it to a friend of yours that doesn't do drugs but will give it to you.

Edit: reason I wrote that, is that I remember one time, some dude found weed on the street, and since he didn't smoke he gave it to hit friend. So the same here. (But it's a joke cause mail+drugs+address+police no bueno)

That's not a way to treat a friend. You would let the Fed's bust their house?

Nice friend, incriminating your friend like that. Order it to yourself, say you didn't order it and threw it away.

Why would your friends think that is a good idea?

I'm sure a lot of people did. Getting caught using a fake address, stealing mail etc. is clear evidence of a crime.

Getting mail at your house? Not something you can prevent and it would likely be easy to claim ignorance of the contents.

The guides on places like /r/DarkNetMarkets do actually recommend shipping to your own address, under your own name.

The theory is that if the post office contacts the police, the police will have the post office confirm the delivery, which you could then deny. There was a Cleveland Indians player a few years that had a big package of pot delivered to his house and his downfall was signing for the package.

Consider this:

People order pills online on an anonymous site designed for people to be untrackable, using anonymous methods of payment, and then ingest the aforementioned pills they received in the mail from China without a second thought.

I would say compared to getting poisoned with unknown substances, trouble with the law seems like a distant secondary issue.

This is certainly a concern, but I'm not convinced it's all that rampant. You can't make much money if you 1) poison your customers, or 2) are a brand new seller (e.g. if you make a new account after every sale to avoid stacking negative community ratings).

And if the buyer isn't testing their drugs before doing them, that's on the buyer. That's the reality of that market.

I'm sure poisoning customers is bad for business, but the stakes are as high as it gets (pun intended).

Statistically speaking I'm sure a very low percentage of people that do drugs get in trouble with law enforcement as well.

Still, it speaks volumes about the buyers' risk aversion which was the original point.

That being said you have a good point about testing. Personally I'm not a consumer so I don't know how widespread testing is.

If you live in a civilized country and the police is not known to shoot random people i would say its a fair risk to take for some.

SWIM told them he doesnt know about this package and showed them how his address is public for anyone due to owning domains. SWIM only paid a low fee for the little weed they found at his home and was at work in time.

That’s exactly what people do.

I would not be surprised if, despite publicly harping about solid OPSEC, many users get tired and negligent.

This true for almost everyone. Most people are not nearly as careful and clever as they think they are. Many criminals, including Ross Ulbricht, get caught due to some small mistake or oversight. In reality it's very hard to maintain perfect security discipline forever.

Probably most of them are casual users, not addicts.

Drug users are not always known for stellar opsec...

I know a few, and lets say... you would be suprised. Some deals with shady characters also need a certain kind of opsec btw.

This isn't a "drug" problem, this is a "government" problem.

What happens if the US federal government goes authoritarian right-wing, and you get raided because you donated some bitcoin to WikiLeaks in 2012?

What happens is they go authoritarian left-wing, and you get raided because you donated to WikiLeaks in 2016?

Having permanently-visible transactions is a huge liability; we don't know what the future holds.

I read in a different article that the creator of another darknet market ran their entire operation on a WooCommerce store with a nice MySQL database...of course carefully „preserving“ that precious customer data.

You're missing a big part of how these Bitcoin markets work. People would use PGP encryption when sending their addresses through the web app to the dealer/vendor, the vendors PGP public key.

So even if law enforcement got access to the database they wouldn't necessarily have any customer addresses, except for the minority of people who got lazy.

Did I misread the article or does they're entire hack consist solely of scraping the internet for places you may have posted your public address? This is the oldest trick in the book.

I think you need to read the story differently: even when using only such a low bar, you can find lots of evidence. As the article mentions, there are other known ways to find suspicious Bitcoin wallets and their owners on top of that.

That's how I interpreted it: even using the simplest and easiest methods, they were able to tie transactions to individuals.

I doubt prosecutors in the us at least are gonna care that you ordered shrooms from the Silk Road ten years ago. Might come up if they want to get a security clearance or run for office, though.

You never know how their orders may change, however. We’re seeing people deported for minor crimes committed decades ago, before they were legal adults, and most people would have said that wouldn’t happen until the last year or two.

Another, in some ways more important, point is the reminder that all of the people who spent years spamming forums about how bitcoin is secure & anonymous are not good sources of advice or analysis and whatever they’re promoting now should be treated very skeptically. You can still find people recommending that people in countries with oppressive governments should make blackmarket transactions in a public ledger!

> We're seeing people deported for minor crimes committed decades ago, before they were legal adults

    [citation needed]

Not that I don't believe you but I honestly haven't heard of this.

The DACA "Dreamers" are all potentially in this category.

There's also this case: https://www.washingtonpost.com/news/morning-mix/wp/2018/01/2...

> According to his “notice to appear” from the Department of Homeland Security, Niec’s detention stems from two misdemeanor convictions from 26 years ago. In January 1992, Niec was convicted of malicious destruction of property under $100. In April of that year, he was convicted of receiving and concealing stolen property over $100 and a financial transaction device... Both of the offenses took place when he was a teenager.

That was the most recent example I had in mind. Also things like https://www.cnn.com/2017/04/05/us/undocumented-husband-depor... which are both heartless and pointless.

I doubt prosecutors in the us at least are gonna care that you ordered shrooms from the Silk Road ten years ago.

Unless it is an election year or they don't like you. This last case is especially true if you live in a small town. Or you get in trouble years later for something unrelated and they want to portray you as a lifelong criminal.

I know a dude that got in trouble as a minor. But generally got his life together afterwards. Worked, paid his parents back the money he (they) were charged, went to school, and wanted to join the military. They wanted his record expunged (sealed in a way that it never happened). The prosecutor decided he hadn't paid enough for his crime. Had he done any of this stuff and they could prove it, he'd have had to go to court over it, I'm pretty sure. Luckily the judge didn't agree and the dude got his wish (though never joined the military).

That type of petty shit is pretty rampant.

It doesn't matter who might care. If someone does care in the future they won't have much trouble depending on how careful you were.

Perhaps not but you could buy more than drugs on Silk Road - counterfeit currency, fake ids, etc.

The press might

Anything for a clickbait headline to drive ad revenue.

Skimming the paper it seems that many of the people they identified were not exactly operational masterminds — they tweeted the addresses linked to their illicit transactions.

related podcast episode: https://gimletmedia.com/episode/115-bitcoin-hunter/

There was an similar post on bitcoincommerce.nl its written in Dutch though.

Ok, so just move to Monero. Or use a mixer. Mindblowing, I know.

Mixers are a bad idea. First, you have to trust that there's no collusion with any entities. Secondly, you have to hope that you don't get tainted coins in return.

A more thorough explanation:

https://moneroforcash.com/monero-vs-dash-vs-zcash-vs-bitcoin...

I'm sorry but you've been misinformed. This article is also factually incorrect in many regards. There are no "tainted" coins. For example this excerpt from your article is completely false:

"Not all Bitcoins are equal and have the same value. Some Bitcoins have been blacklisted and blocked by several entities, making those coins less valuable than the rest. If you receive Bitcoins that were used in the past for illegal purposes, then your Bitcoins could be blacklisted even though you had nothing to do with the illegal activity."

Bitcoins are interchangeable and indistinguishable; exactly alike. They are not physical objects and carry no identifying marks. Their only property is their amount.

> They are not physical objects and carry no identifying marks. Their only property is their amount.

True. It's not the "bitcoin" itself that's being tracked and tainted, it's the transactions between addresses that are being linked.

An amount of Bitcoin is just the balance of an address. However a property of Bitcoin is that transactions contain the plaintext address where an amount of Bitcoin was deducted and the plaintext address where the corresponding amount of Bitcoin was credited.

Thus you can track an amount of Bitcoin as it was held by different addresses.

While it's intangible, it is quantifiable and traceable.

Or Zcash perhaps, I guess?

Don't forget to use shielded addresses, though.

And only use shielded addresses:

http://jeffq.com/blog/on-the-linkability-of-zcash-transactio...

At least with Monero you don't have to worry about that because everything is private by default.

Because shielded transactions take a lot of CPU power many ZCash clients (especially exchanges) are refusing to send to private addresses. It really reduces the private pool and reduces the anonymity.

Yeah, Monero seems a bit more user friendly in that respect.

Or don't do drugs, drugs are bad, m'kay? I mean come on, go to a shady site, do shady business, know things are illegal.

Reply on news.ycombinator.com