TRM Labs has printed new analysis tracing cryptocurrency payments to Virtualine, a internet hosting supplier whose web site domain the FBI seized on October 27. The October 28 report hyperlinks payments to wallets TRM associates with a drug market, ransomware teams, and different criminal providers.
Drug market payments outweighed ransomware
According to TRM’s analysis, a Russian drug market accounted for about 44% of Virtualine’s direct cryptocurrency inflows, whereas ransomware teams have been about 5%.
A big sextortion scheme accounted for roughly 17%, whereas a cryptocurrency mixer, a service used to obscure transaction trails, contributed round 13%.
TRM additionally recognized payments from StealC, malware designed to steal info, and one other internet hosting supplier referred to as Volhav.
TRM primarily based its breakdown on payments acquired by Bitcoin addresses it associates with Virtualine. The goal of particular person transfers was not specified.
TRM stated Virtualine acquired extra worth attributed to illicit sources in 2026 than every other bulletproof internet hosting supplier it labels!
A internet hosting service that promised to withstand complaints
So-called “bulletproof” hosts hire servers and web site infrastructure whereas promising clients resistance to abuse complaints and legislation enforcement requests.
The Justice Department stated authorities obtained court docket approval to grab virtualine.web. Prosecutors allege the supplier marketed to criminals, accepted direct Bitcoin payments, and laundered buyer funds.
They additionally allege that Virtualine continued to host a discussion board that distributed baby sexual abuse materials and nonconsensual intimate photographs, and this was regardless of repeated warnings.
The FBI’s Washington Field Office, the German, Dutch, and British authorities, and private-sector companions have been all a part of the investigation.
The fee path stays after the seizure
The DOJ announcement disclosed no cryptocurrency seizure quantity and introduced no arrests or criminal costs.
TRM stated the supplier’s identified blockchain addresses can be utilized to trace subsequent payments and actions to different hosts. This might assist researchers to evaluate whether or not clients migrate or proceed paying current addresses.
For now, the confirmed enforcement step is the domain seizure, however what occurs to Virtualine’s operations isn’t but identified.
Final Summary
- The FBI seized Virtualine’s domain on October 27 in a global operation.
- TRM attributed 44% of direct inflows to a drug market, versus 5% to ransomware teams.
