An Undercover Agent Was Making $1000 a Week in Bitcoin as a Silk Road Admin

'Cirrus' was one of the Dread Pirate Roberts' trusted henchmen—or so DPR thought.

|
Jan 15 2015, 12:08am

​Ross Ulbricht. Image: ​Facebook

​A federal agent acting undercover was helping to run the digital black market Silk Road for a salary of about $1,000 a week in Bitcoin, according to testimony today in the ​trial of Ross Ulbricht, the man accused of running the infamous site.

Department of Homeland Security Agent Jared DerYeghiayan testified today that the US government monitored Silk Road for more than a year before bringing the site down. He elaborated on the months of investigation, describing in detail his three-month undercover operation as a site administrator named "Cirrus," and how he used that access to link the site's pseudonymous operator Dread Pirate Roberts to Ross Ulbricht.

DerYeghiayan said he began his undercover work after seizing the account of the site administrator "Cirrus" in July 2013. Posing as Cirrus, DerYeghiayan worked 10 to 12 hours a day resolving internal issues and flagging spam comments on the site's forums. The government seized the bitcoins he made as part of the investigation.

He explained to the jury how he would often correspond with the Dread Pirate Roberts over an encrypted chat service run on the anonymizing network Tor called StaffChat. Dread Pirate Roberts, or DPR, used the username "dread," while other administrators were named "inigo," "libertas," and "samesamebutdifferent."

DerYeghiayan also noted in the administrators' chatroom, "dread" was always based in the Pacific Time Zone. Ulbricht was living in San Francisco at the time.

DerYeghiayan said in September 2013, special agent with the US Internal Revenue Service Gary Alford brought up Ulbricht as a potential suspect. DerYeghiayan said he thought Ulbricht seemed like "a pretty good match" to the Dread Pirate Roberts. He and federal agents on the case then hatched a plan to link the two.

A warrant for Ulbricht's arrest was issued in late September, and DerYeghiayan flew to San Francisco to assist the New York-based FBI team.

We wanted to get his computer in an open, unencrypted state

"The plan for the arrest was to have the defendant in a public setting where he could connect to the internet, and I could initiate a chat with him," DerYeghiayan said. "If indeed DPR was Ulbricht, we wanted to get his computer in an open, unencrypted state."

DerYeghiayan had an ongoing chat conversation with DPR, and planned to wait for DPR to connect to it while staking out Ulbricht to connect the two players. He set up near Bello Coffee, a cafe near Ulbricht's home he was known to frequent, and waited.

DerYeghiayan logged onto the chat around 1 PM, and "dread" was online. At 2:47 PM, noting that "dread" had gone offline, DerYeghiayan alerted other agents that Ulbricht had likely left his house. DerYeghiayan, sitting on a bench down the block from Bello Coffee, said he saw Ulbricht walk into the cafe. After about 30 seconds, seeing the cafe was too crowded, Ulbricht left and opted for Glen Park Public Library, located right next door. 

Glen Park Public Library: Image: Google Maps.

Once Ulbricht was in the library, "dread" came back online around 3:08 PM. DerYeghiayan, acting as Cirrus, asked DPR to check a flagged post on one of the forums to ensure he would connect to Silk Road's master page.

"I was waiting for a sign," DerYeghiayan said. "As soon as he said, 'oh which post,' I knew he was on the page."

After that, DerYeghiayan told the plainclothes federal agents staking Ulbricht out in the library to close in and he was arrested. It was only then that DerYeghiayan disconnected, at 3:16 PM.

Tomorrow, defense attorney Joshua Dratel will cross-examine DerYeghiayan, which the attorney said, "could take all day." The prosecution said when Dratel is done with the cross examination, they will call their next witness: US Internal Revenue Service Special Agent Gary Alford.

Motherboard will be covering the trial as it unfolds, so check back here for the latest.