torguide

thww

webpdeepmart

lo00torbuy

hacker

 

torscamlisttt

lo00webp0day

webptorlinks

lo00moneyt

empitemarket

logococq

An investigation by the Drug Enforcement Administration resulted in the arrest of the prolific cocaine vendor “Insta.”

Vincent Cuomo, Abraham Elliott, Paul Engstrom, and Joseph Krieger conspired to distribute large quantities of cocaine through the mail, according to a recent indictment. According to investigators, the defendants operated a vendor account with the username “Insta.”

Beginnings

In October 2020, according to a criminal complaint, the Drug Enforcement Administration (DEA) started investigating all four defendants for their involvement in a cocaine trafficking operation. At the time, the DEA had not associated the defendants with any darkweb vendor account. It is unclear what event triggered the investigation originally. The DEA noted that Engstrom, who seems to be the DEA’s primary target, had a previous conviction for distributing controlled substances in Nevada. Additionally, the phrasing in the complaint indicates that “large cryptocurrency for cash transactions” led the DEA to Engstrom.

Physical Surveillance

During physical surveillance of the defendants, the DEA learned their habits and followed the defendants to different destinations in Nevada, including a Walmart and a Post Office. During one surveillance session, the DEA watched Krieger and Elliott meet in a parking lot and transfer a container from Elliot’s vehicle to Krieger’s vehicle.

coca1The DEA then followed Krieger to the Post Office and watched him drop packages off at the Post Office. DEA investigators contacted the United States Postal Inspection Service (USPIS) and the North Las Vegas Police Department. Law enforcement recovered the packages from the bin and deployed a so-called “drug canine” to ensure they had probable cause to open the packages. Surprisingly, the canine hit on only four of the fifteen packages. Law enforcement officers opened the packages and discovered cocaine.

During this investigation, the DEA interdicted and photographed 242 USPS Priority Mail Envelopes believed to have originated from the group. Of the envelopes photographed, forty-four have been seized by DEA and the USPIS, and search warrants have been obtained to examine the contents. All 44 seized envelopes contained a white, powdery substance that field-tested and/or laboratory tested positive for the presence of cocaine. The cocaine seized in thirty-nine of the forty-four envelopes are consistent with amounts for personal use. Cocaine seized in five of the forty-four envelopes constitutes a distribution amount. The total amount of cocaine recovered during this investigation exceeded 5 kilograms.

USPIS Involvement

USPIS recognized the packages deposited by Krieger. In 2019, USPIS had identified an individual selling cocaine on the darkweb under the moniker “Insta” who was located in the Las Vegas area. The DEA started investigating Insta directly.

coca2On January 28, 2021, the DEA surveilled Engstrom leaving his stash house with a backpack, and drive directly to BitLiquid, Inc., a “Bitcoin liquidity and consulting service located in Hopkins, Minnesota.”

Outed by a Cryptocurrency Exchange

Investigators, through toll analysis on Engstrom’s phone, were able to see that Engstrom communicated with BitLiquid six times between 2:06 pm and 2:21 pm on that day. Further, investigators obtained Bit Liquid’s crypto wallet that utilizes the Ethereum platform. Investigators queried Bit Liquid’s wallet on etherscan.io (aka Etherscan) to search activity on the Ethereum Blockchain at approximately the time Engstrom was observed at BitLiquid. Based on the query, investigators found that on January 28, 2021, at 4:58 pm PST, 37,000 Paxos Standard, was sent from an unknown wallet to BitLiquid’s wallet. The transaction amount was valued at $37,000.00. Investigators further confirmed the financial transaction verifying that on January 29, 2021, BitLiquid, in accordance with their obligations as a Money Transmitting Business, filed a Currency Transaction Report (CTR) for the transaction. The report noted that on January 28, 2021, BitLiquid provided $36,900.00 cash to Engstrom in exchange for cryptocurrency

coca3During the financial investigation, the DEA was able to identify BitLiquid’s cryptocurrency wallet. By analyzing BitLiquid’s wallet with CTR’s filed by BitLiquid, EG3 was able to identify two of Engstrom cryptocurrency wallets. $1.8 million had transferred through one account and $1.2 million through the other.

coca4White House Market

In March 2021, the DEA located Insta on White House Market. In March 2021, the DEA made two purchases of seven grams of cocaine each from Insta, using an undercover identity and undercover mailing address. The DEA was unable to intercept the first package directly from the defendants. The undercover purchase arrived at the undercover address in a Priority envelope with the same return address label, packaging, and Priority postage stamp as other envelopes intercepted by the DEA. Investigators intercepted the second package by seizing all packages mailed by the defendants on a certain day. One of the seized packages was addressed to the address used in the undercover purchase.

coca6In one shipment alone, the DEA intercepted over 300 net grams of cocaine.

White House Market alone shows that “Insta” has made over 3,280 cocaine sales from February 1, 2020, until May 23, 2021. Based on the 2,310 buyer reviews from verified purchases on White House Market (as of May 23, 2021), and assuming the remaining 970 sales were each for the minimum purchase of 3.5 grams of cocaine, a conservative estimate is that “Insta” has sold over twenty kilograms of cocaine for more than $1.9 million in less than four months (ending May 23, 2021).

The Raid

In June 2021, the feds executed search warrants at properties controlled by the defendants.

When law enforcement officers entered the premises Engstrom, Cuomo, and Elliot were in the process of packaging cocaine for shipment. Engstrom fled to a back office, locked the door, and refused commands to exit the office. Cuomo and Elliot attempted to run out of the back door and were later found hiding under trucks in the garage. It also appeared that an unknown quantity of a white powdery substance had just been flushed down the toilet. There was a white powdery substance around the toilet bowl, two spoons in the toilet, and a metal tray with white powdery residue on the floor near the toilet. Law enforcement officers found multiple open plastic zipper bags on a television tray filled with a white powdery substance. There was a paper drinking cup filled with a white powdery substance next to two scales used for measuring quantities. Four pressed bricks of a white powdery substance with the embedded insignia “BMW” were recovered from the same office where Engstrom was trying to hide from law enforcement. In addition, two large black filing cabinets contained approximately one hundred Priority Mail Envelopes already packaged and sealed in containers labeled with various quantities that have been previously seized from this drug trafficking operation in US Priority Envelopes.

The DEA conducted four random field tests on the white powdery substance as a sample of the larger seizure. All four field tests tested positive for the presumptive presence of cocaine. In total, the DEA seized 6,800 grams of a white powdery substance that field-tested positive for the presumptive presence of cocaine.

All four defendants were charged with conspiracy to distribute cocaine. Engstrom faces an additional money laundering charge.

Complaint (pdf)

Indictment (pdf)