Today, the Department of Justice announced the shutdown of the largest ever child pornography site by amount of material stored, along with the arrest of its owner and operator. More than 337 site users across 38 countries have also been arrested so far. Most importantly, as of today, at least 23 minors were identified and rescued from their abusers as a result of this investigation.
U.S. Attorney Jessie K. Liu put it best: “Children around the world are safer because of the actions taken by U.S. and foreign law enforcement to prosecute this case and recover funds for victims.”
Commenting on the investigation itself, IRS-Criminal Investigations Chief Don Fort mentioned the importance of the sophisticated tracing of bitcoin transactions in order to identify the administrator of the website.
We’re proud to say that Chainalysis products provided assistance in this area, helping investigators analyze the website’s cryptocurrency transactions that ultimately led to the arrests.
Welcome To Video: How the website worked
Welcome to Video (WTV) was a child pornography website that operated out of South Korea and allowed users to buy content with Bitcoin or to upload their own. Upon signing up for the site, users received a unique Bitcoin address where they could send funds to buy content to view.
When law enforcement shut down the site, they siezed over 8 terabytes of child pornography, making it one of the largest siezures of its kind. The site had 1.3 million Bitcoin addresses registered. Between 2015 and 2018, the site received nearly $353,000 worth of Bitcoin across thousands of individual transactions.
Taking down Welcome to Video
Cybercrime transcends national borders. Welcome to Video had a global customer and contributor base requiring cross-border collaboration among law enforcement agencies across the world. IRS-Criminal Investigations (IRS-CI), Homeland Security Investigations (HSI), and other agencies used Chainalysis software to analyze blockchain transactions and map out contributors and users of the site. This enabled them to disseminate the blockchain evidence to their partners in the United Kingdom, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil and Australia, and ultimately make arrests.
With the site’s listed Bitcoin address, IRS-CI and HSI used Chainalysis Reactor, our investigations product, to analyze transaction activity and build a graph showing the flow of funds in and out of the WTV address. Continue reading…