In the eight years that he ran an online market selling images of child sexual abuse, Michael Mohammad earned the equivalent of more than 100,000 euros. At his May trial, as some of his victims listened, he told the judge, “It was purely business.”
The Dutch court sentenced Mohammad to ten years in prison after convicting him of a series of crimes. They included distributing thousands of photos and videos of child abuse, rape and bestiality through his website, Dark Scandals.
A new type of company made Dark Scandals possible: cryptocurrency platforms. Mohammad’s clients used these platforms to buy digital assets with dollars and euros and spend them with relative anonymity. These assets were Mohammad’s bargaining chip. In all, transaction data analyzed by Reuters shows, Dark Scandals customers used nearly 50 different cryptocurrency platforms, including industry leaders: Coinbase and Binance.
Coinbase told Reuters that the exchange “is the wrong place to go if you’re trying to get away with a crime. We have a zero-tolerance policy for anyone involved in illicit activity, such as child sexual abuse material.”
Binance said it cooperated with law enforcement to help take down Dark Scandals.
The 26-year-old Mohammad turned to bitcoin in 2013 after PayPal blocked his newly launched website from accessing the payments network.
With the slogan “we love anonymity”, Mohammad used cryptocurrencies to transform the site into one of the best known marketplaces for sexual abuse images.
Mohammad charged cryptocurrency customers up to 200 euros to release access to “packages” consisting of hundreds of videos. He also negotiated access to his collection for new videos, demanding that the negotiated material depict acts that his website could later say were “forced” acts. He received €115,000 worth of cryptocurrency from his clients, the court concluded, joining the growing number of criminals who facilitate and profit from sexual abuse.
Mohammad was arrested in 2020 following an international investigation involving US and Dutch authorities. Authorities were able to trace cryptocurrency flows to the website on the blockchain, the infrastructure upon which cryptocurrencies are based. Police officers obtained data on dates, amounts and digital wallet addresses of customer transactions.
However, Dark Scandals users could still transfer money to the site if digital currency exchanges did not require them to provide personal data. Many of Mohammad’s clients’ accounts were opened at eight different brokerages without personal details or using falsified data, a US deputy prosecutor told the court.
“This anonymity has fostered the success of the Dark Scandals sites,” wrote Assistant US Attorney Zia Faruqui, who helped oversee the investigation that led to Mohammad’s capture in the Netherlands. Faruqui did not identify the brokers.
In an email to Reuters, Mohammad’s lawyer said he had been wrongfully convicted and would appeal the 10-year prison sentence handed down in June.
The US Department of Justice, in a September report, stated that many cryptocurrency exchanges still make “little or no effort” to comply with customer knowledge rules. Europol, the European Union’s police force, warned in January that unregulated digital currency exchanges had become the “payment option” for online criminals, including those selling child pornography.
Coinbase allowed users to transfer cryptocurrencies between digital wallets without needing to show identification for at least two years after its launch in 2012, according to a 2014 investor presentation. The company now requires all customers to verify their identities before opening bills. On Binance, launched in 2017, customers could open accounts with just an email until mid-2021.
The amounts involved in buying and selling sexual abuse remain small compared to other criminal activities such as drug trafficking. But the numbers are increasing. While in the past abusers often traded pedophile images among themselves in small communities, the darknet has become a breeding ground for sites like Dark Scandals, which charge in cryptocurrencies, with far-reaching damage.
Cryptocurrency market research firm Chainalysis, which is used by US government agencies to track illegal flows, estimates that annual cryptocurrency revenue from child pornography sites has jumped from around $250,000 in 2017 to nearly $1. million in 2020.
Reuters evaluated Chainalysis data related to transfers made by wallets linked to Dark Scandals. The data shows that the site’s customers used 47 exchanges, of which the three most popular were Coinbase, Finland’s LocalBitcoins and Binance. Cryptocurrencies worth a total of $22,000 were transacted by Coinbase and LocalBitcoins between 2013 and 2019. Some trading shifted to Binance and another exchange called ShapeShift as other platforms tightened customer identity checks. Binance and ShapeShift together processed around $3,400 by the close of the Dark Scandals in 2020, according to the data.
The amounts of money involved do not capture the seriousness of the damage caused, according to the IWF (Internet Watch Foundation), a British entity that acts against pedophilia and collects data around the world.
The IWF says the annual number of web pages confirmed to contain such images has increased more than fourfold from 2016, to more than 250,000 last year. During the same period, the organization found that the number of commercial websites selling sexual abuse images through cryptocurrency exploded from just 41 to 1,014. These sites often include links for users to pay through cryptocurrency exchanges, the IWF told Reuters, declining to name the companies.
“For those people looking to make money from child sexual abuse, digital assets have lowered the barrier,” said Dan Sexton, chief technology officer of the IWF.
Coinbase Vice President of Global Intelligence John Kothanek told Reuters that the exchange works closely with law enforcement on child abuse cases, alerts authorities of potential illicit activities and closes accounts. Coinbase has “dedicated 24/7 investigation and compliance teams, access to sophisticated blockchain analysis tools and a first-class process for identifying criminals,” he said in a statement, adding that cryptocurrencies are easier to track than the traditional money.
Binance Global Head of Intelligence and Investigations Tigran Gambaryan is a former US Internal Revenue Service agent who was involved in the Dark Scandals case. He said Binance and other exchanges provided records to the investigation team. “Had it not been for cryptocurrencies and the cooperation provided by Binance, the individual behind the site would not have been identified,” said Gambaryan. LocalBitcoins and ShapeShift did not respond to requests for comment.
‘PUZZLE PIECES’
In early 2018, IRS and Department of Homeland Security agents were tracking cryptocurrency payments made to another child pornography site called Welcome To Video. The owner, a South Korean man, was jailed for 18 months by a Seoul court for violating child protection laws and then sentenced to two more years for hiding the website’s recipes from authorities.
Investigators discovered that one of Welcome To Video’s customers had sent cryptocurrencies to a digital wallet linked to a darknet site unknown to them: Dark Scandals. Chris Janczewski, then a special agent with the IRS’s electronic crime unit, was shocked to learn that Dark Scandals was selling actual rape videos.
In February of that year, undercover officers made a payment worth $25 in bitcoin to one of Dark Scandals’ wallets and received a download link via email. The content they downloaded included two videos depicting minors being sexually abused, according to the US indictment.
Authorities then located and accessed Mohammad’s email account, which contained messages about payments to the site’s service providers. Those providers were paid using a financial account in his name, according to the indictment.
Investigators tracked payments made to Dark Scandals through more than 300 accounts at eight unidentified brokerages, US Attorney Faruqui said in a later request to recover funds from those accounts. Many customers used the accounts, opened without documents or with false details between 2013 and 2020, just to pay Mohammad, he wrote.
Janczewski, the former IRS agent, said the platforms cooperated in handing over whatever information they had. A Coinbase spokesperson said the exchange worked with US authorities on the case, reporting about 300 users and closing their accounts. Binance also said it cooperated. Gambaryan, its head of investigations, added that “the blockchain provides unparalleled transparency into illicit cash flows.”
After the Americans alerted Dutch authorities to the crimes, a police unit in The Hague launched an investigation. As the police monitored Mohammad, he continued to make money: On Feb. 8, 2020, a customer used Binance to send him $200 worth of bitcoin, blockchain data shows.
A month later, police raided his home in Barendrecht and arrested him, seizing his computers, hard drives and mobile phone. On one of the drives, Mohammad stored 50 videos that recorded his chat and video calls with several dozen Dutch girls on Snapchat, WhatsApp and Instagram, according to the court.
“You destroyed my life and ruined everything beautiful I saw in it,” testified a girl abused by Mohammad at age 14. Her statement was read by her lawyer. The victim is now 18 years old. “I will never forgive you for what you did.”
Jacqueline Beauchere, global head of security at Snap, which owns the messaging app Snapchat, said the company works with law enforcement, experts and industry partners to fight child sexual abuse.
“If we detect or become aware of any sexual content that exploits minors, we immediately remove it, block the account and report the offender to the authorities,” she said. Meta, which owns WhatsApp and Instagram, sent Reuters a post detailing its policies protecting teenagers from online harm.
‘THE OTHER SIDE’
Mohammad told the court that he set up Dark Scandals because he did not believe that selling sexual abuse videos was illegal. He considered it a “grey area” and a “money-making opportunity”. He denied the rape allegations, claiming that video and audio evidence failed to identify him.
Law enforcement authorities and researchers told Reuters that cryptocurrency exchanges remain a vital payment tool for criminals. The IWF received more reports last year of child pornography image sites charging cryptocurrencies than in any previous year. While most major exchanges now proactively help authorities track down suspects, the IWF’s Sexton said criminals are always looking for the soft spot and simply jump to platforms with looser controls.
“People think bitcoin is just a fun way to make money,” said the mother of one of the victims, “They don’t know the other side.”
I have over 10 years of experience working in the news industry. I have worked for several different news organizations, including a large news website like News Bulletin 247. I am an expert in the field of economics and have written several books on the subject. I am a highly skilled writer and editor, and have a strong knowledge of social media. I am a highly respected member of the news industry, and my work has been featured in many major publications.
