US Law Enforcement Traces Bitcoin Transfers to Nab ‘Largest’ Child Porn Site

A U.S. federal grand jury indicted a South Korean citizen for operating the largest child porn site by volume, where visitors spent millions of dollars worth of bitcoin to pay for the illegal content.

Jong Woo Son, 23, the owner of the Welcome to Video (WTV) site has also been charged and convicted in South Korea and is currently in custody serving his sentence there, the Department of Justice said.

The DOJ said 337 site users from 22 U.S. states and 11 countries around the world were also arrested.

The operation resulted in searches of residences and businesses of 92 individuals in the U.S. The investigation has also led to the rescue of at least 23 minor victims residing in the U.S., Spain and the U.K., who were actively being abused by the users of the site.

WTV offered these videos for sale using bitcoin, rather than simply sharing the videos and images over a chat forum. According to the indictment, the site claimed more than a million downloads of child exploitation videos by its users.

Each user received a unique bitcoin address to create an account on the website. An analysis of the server revealed that the website had more than one million bitcoin addresses, signifying that the website had capacity for at least one million users.

A forfeiture complaint was also unsealed today.  Law enforcement was able to trace payments of bitcoin to the Darknet site by following the flow of funds on the blockchain. Separately, Chainalysis said it was their Chainalysis Reactor software used to analyze the blockchain transactions.

The virtual currency accounts identified in the complaint were allegedly used by 24 individuals in five countries to fund the website and promote the exploitation of children.  The forfeiture complaint seeks to recover these funds and, ultimately through the restoration process, return the illicit funds to victims of the crime.

Chainalysis Reactor transaction activity graph showing the flow of funds in and out of the WTV address.

Chainalysis said that with the site’s listed bitcoin address, IRS Criminal Investigation and Homeland Security Investigations were able to use Chainalysis Reactor to analyze transaction activity and build a graph showing the flow of funds in and out of the WTV address.

Know Your Customer (KYC) processes enabled many of the exchanges involved to provide investigators copies of identification, addresses, and other relevant transactions associated with those accounts. In cases where that was insufficient, account information combined with open source intelligence and standard investigative techniques were enough to identify users.

Chainalysis said in a statement:

“We want to enable an entire economy powered by cryptocurrency, but sites like WTV destroy the public’s faith in the technology and slow down adoption in the legitimate economy. Fighting against them is a step in the right direction.”

Brian Benczkowski, assistant attorney general of the Justice Department’s Criminal Division, said:

“Darknet sites that profit from the sexual exploitation of children are among the most vile and reprehensible forms of criminal behavior. This Administration will not allow child predators to use lawless online spaces as a shield.”

On March 5, 2018, agents from the U.K., and Korean National Police in South Korea arrested Son and seized the server that he used to operate a Darknet market that exclusively advertised child sexual exploitation videos available for download by members of the site.

The operation resulted in the seizure of approximately eight terabytes of child sexual exploitation videos, which is one of the largest seizures of its kind. The images contained over 250,000 unique videos, and 45 percent of the videos currently analyzed contain new images that have not been previously known to exist.

The website is among the first of its kind to monetize child exploitation videos using bitcoin.

Image via DOJ