Historical Darknet Markets: Dream Market

The story of Dream Market – arguably one of the most successful darknet markets of all-time – remains rife with rumor and uncertainty, with very few people knowing what actually took place during its last two years. Though the market seemingly came to a graceful end, giving users a warning of over a month to withdraw their funds before closing, conspiracy theories abound as to the fate of the site’s founder and administrator, SpeedStepper. Making things more complicated is the story of Gal Vallerius, a Dream vendor who went by the name OxyMonster and remains in prison to this day.

Often overshadowed by the fallout of the Silk Road closure, the birth of Silk Road 2, and the rise of more popular markets, Dream Market launched without much fanfare on November 15, 2013. This was only a month and a half after Silk Road was seized by the FBI, and only 10 days after the opening of Silk Road 2. The market operated all the way until April 30, 2019 – though not without substantial controversy – which makes it the longest-running English-speaking market of all-time, and the second longest overall (after Hydra).

At its peak, Dream Market hosted slightly over 122,000 listings; about 62,000 of which were for drugs. This rendered it a several-fold larger operation than Silk Road, but smaller than its biggest competitor, which for most of the time was AlphaBay. Other major markets that came and went during Dream’s lifetime include Agora (12/2013 – 9/2015), Outlaw Market (12/2013 – 5/2017), Evolution (1/2014 – 3/2015), Diabolus/SR3 (10/2014 – 4/2016), Nucleus (10/2014 – 4/2016), and Crypto Market (2/2015 – 2/2017).

Dream Market was assisted in its launch by a notice on DeepDotWeb, the pioneering and definitive darknet market link aggregator on the clearweb. However, the market was initially overshadowed by the launch of several flashier markets, all vying to compete for the title of “the next Silk Road.” Dream’s first reviews did not appear on DeepDotWeb until the second half of 2014; before then it was relegated to the status of 3^rd or even 4^th choice for many darknet market users at the time.

For the second half of its existence, Dream employed a strict no-fentanyl policy which could have very well contributed to its longevity. Other than that, it contained the usual darknet market categories for items currently seen in today’s markets; the most popular of which were for cannabis, stimulants, Ecstasy, opioids, digital goods, prescriptions, psychedelics, benzodiazepines, dissociates, and fraud-related items, in that order. The market used several features that are standard in today’s markets, including 2-FA for login, PIN for purchases/withdrawals, and even supported Monero for a brief while.

Operation Bayonet

Launched in December 2014 (over a year after Dream), the original AlphaBay was at one point the world’s biggest darknet market by far. It had amassed over 200,000 users, 40,000 vendors and 350,000 listings by the time of its seizure in July 2017, which is also when it was at its peak. To put things in perspective, this rendered the market over 20 times bigger than the first Silk Road, founded by Ross Ulbricht, which had about 14,000 listings when it was shut down.

Well-known is the story of AlphaBay admin Alexandre Cazes, aka Alpha02, who was arrested in Thailand as part of Operation Bayonet, a multi-national effort spearheaded by the FBI. Cazes famously committed suicide in his jail cell a week after being arrested — before he could be extradited to the US and put on trial. Several glaring OpSec errors had led to his downfall; most notably his use of a personal Hotmail account to receive support emails for AlphaBay in 2014, at the market’s beginnings. He had also been using his online moniker, Alpha02, in different carding and tech forums since 2008.

After AlphaBay went offline, several users immediately flocked to not only Dream but also Hansa, a Netherlands-based darknet market which had been covertly infiltrated by Dutch law enforcement weeks earlier. The market had been operating per usual with non-noticeable differences, except that all user data was being collected to be used against them, including the data from the newly-arriving AlphaBay refugees.

*Takedown notices published by law enforcement for Hansa (left) and AlphaBay (right).*

In their efforts to gather information on vendors, law enforcement wiped all product image files, forcing vendors to re-upload images — some of which had geographic data embedded in them. They also encouraged vendors to download a recovery key in a specially-created Excel file that would reveal their IP address when opened from the vendor’s computer. It is estimated that at least 40 vendors were identified and arrested based on the information they had revealed of themselves from these methods. Hansa was then shut down on July 20, 2017, and the extent of the disruption was revealed to the public.

The effect the closure of the two markets had on Dream was to propel it firmly into the position of world’s biggest darknet market, not just by the disappearance of its two main competitors, but also by activity from ex-users seeking a new market. The below graph, from an academic paper titled Lost in the Dream? Measuring the effects of Operation Bayonet on vendors migrating to Dream Market published by Delft University of Technology, visualizes the impact that the closure of AlphaBay and Hansa had on the growth of Dream, which allowed it to catapult into its #1 position.

The university study also analyzed the migration of vendors from AlphaBay and Hansa and found that of 220 vendors who created accounts on the market between July 1^st and September 1^st in 2017, 40% had PGP keys linked to AlphaBay, while only 2% were linked to Hansa. A similar study found that about 24% of vendors that arrived at Dream in the 3^rd quarter of 2017 kept the same name as they had on previous markets (mainly AlphaBay) while the rest did not.

These studies suggest that the majority of vendors coming from AlphaBay and Hansa thus decided to start over with a new identity, deciding it not worth the risk to continue using their old names. It also suggests that more incoming vendors were aware that Hansa was now under the control of law enforcement, which was indeed the case for at least the last month of its existence.

*Archived* *Red*dit post from the ‘Hansa and Alphabay busted megathread’.

Operation Bayonet thus marked a shift in how vendors would migrate to new markets as it was realized that the government could operate darknet markets in a clandestine fashion as “honeypots.” For veteran vendors, it became a tradeoff of whether carrying an established reputation – thus making it easier to attract customers – was worth the risk that came with knowing that law enforcement was closely monitoring their activity.

Furthering the migration to Dream was the fallout of Operation Onymous, which culminated in about 414 onion links directed to 27 darknet sites being taken down on the 5^th and 6^th of November in 2014. While many of these sites were not markets per se – rather pertaining to money laundering and unusual “contraband” – at least three darknet markets were taken down by the operation; the most notable of which was Silk Road 2.0. This led to the exodus of users to not just Dream but Agora and Evolution marketplaces, as well.

Gal Vallerius, aka OxyMonster

By all available accounts, OxyMonster started as a low-level vendor on Dream who primarily sold Oxycontin but also Ritalin, methamphetamine, cocaine, and heroin. He was good at the job – from the perspective that he was competent in taking orders and delivering them – and after a couple of years worked his way up to the position of Senior Moderator of Dream Market, per court documents.

As a moderator who was apparently held in high regard by the Dream administration, OxyMonster was given special operational privileges on the market and allowed to continue his career as a vendor. Instead of going through the standard ordering and payment system, he received funds for orders via transactions to a Bitcoin “tip jar” address — an address that was actively being monitored by law enforcement investigators in the US. The tip jar address was even present in OxyMonster’s market profile, which made it especially easy to link to his account. Investigators traced 15 of 17 tip jar transactions to a LocalBitcoins wallet controlled by a French-Israeli man named Gal Vallerius.

In late August 2017, Vallerius was detained by US customs after landing at the airport in Atlanta, Georgia. He had come to the US to attend the World Beard and Mustache Championships in Austin, Texas. Though not under arrest at the time, Vallerius handed the laptop he had been traveling with over to federal agents who managed to access his LocalBitcoins account. In the account, which was registered under his real name, agents traced an incoming transaction from the OxyMonster tip jar, thus leading to his arrest and eventual conviction.

*OxyMonster’s fabled beard in its full glory. Source: The British Beard Club*

Vallerius was convicted of money laundering and drug conspiracy charges after pleading guilty in June 2018. His sentence was later reduced from possible life to 20 years as part of a plea deal that is contingent on his willingness to work undercover for US law enforcement. The report of this detail in the plea deal led to rampant speculation that Dream had been compromised. The market continued to operate for the next five months, though by many accounts it was no longer the same.

According to a Dread forum post of a self-professed ex-moderator at Dream, “After working with SpeedStepper for years and years for a humble salary, recently we realized he has become crooked, taking down vendor accounts and cashing them out without stating any reasons… We asked for a raise in our salary accordingly to these actions he’s been pulling but he has refused without second thinking. He’s cheap as fuck since OxyMonster is gone.”

Disappearance of SpeedStepper

Aside from the rationale that it was likely the biggest target for law enforcement investigation at the time, Speedstepper’s decision to close Dream was largely influenced by a prolonged distributed denial-of-service (DDOS) attack which went on for over seven weeks. This required the market to add an inordinate number of mirrors to maintain accessibility, exceeding 600 in all.

According to Dread forum founder and co-admin HugBunter, the attack was being carried out by a hacker exploiting a “quirk” in Tor that allowed it to perform the attack cheaply. The hacker demanded a payment of $400,000 from the market to stop the attack, which Dream admin SpeedStepper ignored, deciding it more prudent to simply close shop instead.

Dream’s closure itself was also marred by controversy as any sort of messages announcing such were never signed via PGP by SpeedStepper. This led many to believe that the market had been compromised much earlier, and many came to the conclusion that SpeedStepper was actually Gal Vallerius himself. One security blog in particular claims that the admin had been deanonymized as a Florida resident “based on the domain registrations for several surface websites,” but this information was never actually confirmed.

Whoever SpeedStepper was, he was markedly different in style and approach than Ross Ulbricht, architect of the first true darknet market, Silk Road. A Vice contributor succinctly summarized the difference between the two admins in an April 2019 article:

“Unlike Ulbricht, a politicized tech-savant, Speedsteppers (sic) is no ranting libertarian. Instead, they’re a smart, tech-literate, media-savvy digital drug kingpin. If loose lips sink ships, Speedsteppers (sic) has captained this outlaw fleet with silent aplomb. His or her ideological motivations remain a mystery, beyond the acquisition of bitcoin, gained through a percentage commission charged on each sale.” – Mike Power, Vice contributor

Samsara Market

With sales deactivated during its last month while users withdrew their remaining funds, Dream finally went offline in the first week of May 2019, though not before an announcement that the market would continue in a new form, to be known as Samsara Market. Much of the community was highly skeptical of this plan, however, due to the lack of signed messages from SpeedStepper and ongoing concerns about who would actually be in control of the new market. A former moderator from Dream named Waterchain communicated the information on Dread, though it was poorly received:

Samsara Market, the “new market” referenced in the above message, was launched on July 4^th, 2019 — exactly two years after the FBI put a seizure notice on AlphaBay. Though it looked professional and provided a seemingly competent interface through which business could be conducted, Samsara never caught on, and the market disappeared in an exit scam slightly over four months later, on November 14^th.

Providing his two cents on the matter of the closure was HugBunter, who used an appeal to his authority to calm market users and provide some clarity on what was truly a murky situation:

“I’m not responding to this defending anything or anyone, however I personally can confirm that not only did Waterchain operate closely with SpeedStepper, to the point of relaying and mediating some things between myself and Speed on many occasions, I don’t really have any blame I can put towards him regarding the problems with Dream or Samsara.”

In the same message posted on Dread, HugBunter added the following in a somewhat dramatic reveal:

“I think it’s probably time to publicly disclose that SpeedStepper ran Samsara also, and doesn’t deserve too much praise towards him for any amicable shut down of Dream. His intention was to separate his identity running the exact same market under another name and wrongly assuming it would jump to the heights of Dream overnight whilst avoiding the on-going DoS attacks.

He found he was very wrong and rather than then closing Samsara on a positive note, allowing users to withdraw their funds, he decided to just disappear and take everything with him, whilst this is also strange considering he surely had many life-times worth of coin from over 5 years of running Dream, I don’t actually doubt that he did simply decide to leave and steal what he could in the process. From my own discussions with him, he did make it apparent that he had a level of greed.” – HugBunter, Dread founder and admin.

Despite the relative failure of Samsara, the proceeds estimated to have been made by SpeedStepper and Dream market are huge, potentially worth over a billion dollars at today’s BTC prices. Dream charged 8% in commissions from every sale, including 4% from the vendor and 4% from the buyer, which ran flat across the board. Profits were also made from vendor bonds, which ranged from $250 to $2000 per vendor, depending on when they signed up and the price of BTC at the time. All these proceeds were accumulated over a 5.5-year period.

Though what ultimately became of SpeedStepper remains unknown, the story of Dream Market is one of the more intriguing yet less well-chronicled darknet market fables, muddled by a tangled mixture of fact, rumor, heresy, and what is likely to be disinformation.