TRM Labs has printed new analysis tracing cryptocurrency payments to Virtualine, a internet hosting supplier whose web site domain the FBI seized on October 27. The October 28 report hyperlinks payments to wallets TRM associates with a drug market, ransomware teams, and different criminal providers.
Drug market payments outweighed ransomware
According to TRM’s analysis, a Russian drug market accounted for about 44% of Virtualine’s direct cryptocurrency inflows, whereas ransomware teams have been about 5%.
A big sextortion scheme accounted for roughly 17%, whereas a cryptocurrency mixer, a service used to obscure transaction trails, contributed round 13%.
TRM additionally recognized payments from StealC, malware designed to steal data, and one other internet hosting supplier known as Volhav.
TRM primarily based its breakdown on payments obtained by Bitcoin addresses it associates with Virtualine. The objective of particular person transfers was not specified.
TRM stated Virtualine obtained extra worth attributed to illicit sources in 2026 than another bulletproof internet hosting supplier it labels!
A internet hosting service that promised to withstand complaints
So-called “bulletproof” hosts hire servers and web site infrastructure whereas promising prospects resistance to abuse complaints and regulation enforcement requests.
The Justice Department stated authorities obtained court docket approval to grab virtualine.internet. Prosecutors allege the supplier marketed to criminals, accepted direct Bitcoin payments, and laundered buyer funds.
They additionally allege that Virtualine continued to host a discussion board that distributed little one sexual abuse materials and nonconsensual intimate photographs, and this was regardless of repeated warnings.
The FBI’s Washington Field Office, the German, Dutch, and British authorities, and private-sector companions have been all a part of the investigation.
The cost path stays after the seizure
The DOJ announcement disclosed no cryptocurrency seizure quantity and introduced no arrests or criminal fees.
TRM stated the supplier’s recognized blockchain addresses can be utilized to trace subsequent payments and actions to different hosts. This may assist researchers to evaluate whether or not prospects migrate or proceed paying current addresses.
For now, the confirmed enforcement step is the domain seizure, however what occurs to Virtualine’s operations is just not but recognized.
Final Summary
- The FBI seized Virtualine’s domain on October 27 in a world operation.
- TRM attributed 44% of direct inflows to a drug market, versus 5% to ransomware teams.
