Crypto exchanges enabled online child sex-abuse profiteer

Researcher Chainalysis, used by U.S. government agencies to track illegal flows, estimates that child abuse sites’ annual revenue in crypto leapt from around $250,000 in 2017 to almost $1 million in 2020.

Reuters reviewed Chainalysis data
relating to transactions through Dark Scandals’ digital wallets. These data show that the site’s customers used 47 exchanges, of which the three most popular were Coinbase, Finland-based LocalBitcoins and Binance. Crypto worth a total of $22,000 moved through Coinbase and LocalBitcoins between 2013 and 2019. Some trade shifted to Binance and to another exchange called ShapeShift as other platforms tightened their identity checks. Binance and ShapeShift together processed about $3,400 until Dark Scandals closed in 2020, according to the data.

The sums of money involved fail to capture the gravity of the harm being done, according to the Internet Watch Foundation, a British child sexual abuse hotline which collects data worldwide.

The IWF says the annual number of webpages it has confirmed contain such images rose over four-fold from 2016 to over 250,000 last year. During that same period, the IWF found the number of commercial  sites selling abuse imagery for virtual currency exploded to 1,014 from just 41. These sites often included links for users to pay via crypto exchanges, the IWF told Reuters, declining to name companies.

“For those people looking to make money from child sexual abuse, crypto has lowered the barrier,” said Dan Sexton, the IWF’s chief technology officer.

Coinbase’s vice president of global intelligence, John Kothanek, told Reuters that the exchange works closely with law enforcement on child abuse cases, alerts authorities to potential illicit activity and closes down accounts. Coinbase has “dedicated, around-the-clock compliance and investigative teams, access to sophisticated blockchain analysis tools, and a best-in-class process for identifying criminals,” he said in a statement, adding that crypto is easier to track than traditional currency.

“We will find you and hold you accountable — this has been the case since day one at Coinbase,” Kothanek said.

Binance’s global head of intelligence and investigations, Tigran Gambaryan, is a former U.S. Internal Revenue Service agent who was involved in the Dark Scandals case. He said Binance and other exchanges provided records to the investigation team. “If not for crypto and the cooperation Binance provided, the individual behind the website would not have been identified,” Gambaryan said. LocalBitcoins and ShapeShift did not respond to requests to comment.

“Gap in the market”

Mohammad lived a double life.

In public, he appeared a normal young man, posting Instagram photos of himself at music festivals and dining out with friends. An ex-girlfriend, in an interview with investigators, knew him as “quiet and gentle.” On LinkedIn, he said he ran a marketing business called National Network that produced videos for corporate clients.

The company was a fiction, however. It was registered as the owner of DarkScandals.com, which Mohammad ran from the suburban town of Barendrecht, outside Rotterdam. He stored the site’s material – which ended up amounting to over 3,600 videos and images – on computers and hard drives at his small apartment.

Until U.S. investigators alerted the Dutch to the site, his work remained a secret, even to his friends, the judge said at his trial.

Mohammad had lived in the area since 2006, when he returned to the Netherlands after almost a decade in Suriname. Born in Amsterdam, he testified at the trial that as a child his parents died violently. Following several years at an orphanage, he moved to the former Dutch colony to live with an uncle.

Back in the Netherlands, he said he accumulated debts while studying to become a social worker, though the judge noted he rarely attended class. In mid-2012, he saw a “gap in the market” and set up Dark Scandals. He hoped it would improve his “bad financial situation,” he testified.

Once launched, its homepage advertised “real blackmail, rape and forced videos of girls,” along with “sex videos of real schoolgirls” and “passed out teens.” The Dutch national prosecutor, Brechtje Lijnse, told the court the images were “aimed at the total humiliation of women.” She cited videos depicting underage girls being extorted into sexually abusing themselves and the rape of a child under the age of two.

“I have seen these images and they never let me go,” said Lijnse, who has spent a decade investigating child sexual abuse.

Mohammad curated this material into packages that users could download in return for a new video or a payment priced in bitcoin. The U.S. indictment related how in December 2013 he rejected one uploaded clip, telling the provider in an email it was “just acted, we don’t accept video’s like that.” Mohammad signed the message, which was obtained by investigators, with the moniker “Dark.”

On the site’s forum, users praised his collection, referring to the girls and women it featured as “sluts” and “whores.” “Great stuff!” wrote one user in a 2012 thread about videos showing women being tortured.

PayPal cracked down on his customers’ payments, however, blocking Dark Scandals around a year after its launch, according to the Dutch court’s written judgement. PayPal did not respond to requests for comment.

PayPal and other financial firms had been working for years with nonprofit groups such as the U.S. National Center for Missing & Exploited Children to disrupt offenders’ attempts to use the firms to buy imagery. John Shehan, senior vice president of NCMEC’s exploited children division, told Reuters that as a result the financial industry largely “snuffed out” such activity on their platforms. Crypto, Shehan said, offered a new avenue.

While banks and payment platforms demanded more details from online merchants, many crypto exchanges for years requested little or no information from clients. Touting crypto as a tool to free people from government control of the financial system, some supporters rejected the idea that exchanges should collect substantial data on users.

Binance’s CEO Changpeng Zhao told staff in a 2020 video call that “people should have privacy (as) part of financial freedom.” The same year, Coinbase’s CEO Brian Armstrong said he expected so-called “privacy coins,” which are designed to be untraceable, to gain mainstream adoption as “it doesn’t make sense in most cases to broadcast every payment you make.” Erik Voorhees, founder of the ShapeShift exchange, wrote in a blog post last year, “Surveillance of all people cannot be our standard.”

Asked at his trial for his opinion of crypto, Mohammad noted, “Privacy is something that a lot of users value.”

Barred by PayPal, his clients began transferring bitcoin and another virtual token, ether, to him via four digital wallets. In the early years of the site, blockchain data show that many of these customers used the crypto exchanges Coinbase and LocalBitcoins to make their transfers. LocalBitcoins didn’t require customer identification until 2019. Once Binance launched in mid-2017, allowing customers to trade anonymously, it was used, too, along with ShapeShift. Mohammad traded the funds he received for euros at a Dutch crypto broker named Bitonic, he testified.

Bitonic said that while it couldn’t comment on an individual case “we can reassure you that if we have any indication that transactions are linked to crimes like trading child sexual abuse material, we immediately block these transactions, conduct further investigation and alert the authorities when appropriate.” Bitonic added that sometimes authorities may ask it to keep an account functioning in order to gather evidence “with the end goal that the suspect can be successfully convicted.”

Lijnse, the Dutch prosecutor, told the court that Mohammad’s shift to crypto marked the “professionalisation of his crimes” as he sought to build his client base off the radar. By mid-2014, the site was already drawing over 13,000 unique visitors a week, she said.

On Reddit, a user gushed about Dark Scandals in a discussion about where to find child-abuse videos. “We real customers love that site!” the user wrote, linking to Dark Scandals’ darknet address.

One customer was a British man called Dale Lutkin, who lived in the northern English town of Hornsea with his wife and foster daughter.

For several years, Lutkin downloaded several thousand child abuse images from Dark Scandals and other sites, including a video of a 10-month-old infant being abused, court records show. Tipped off about Lutkin’s activity, British police officers visited his seaside home in 2018 and searched his laptop and hard drive.

As well as the downloads, officers discovered a video of Lutkin’s foster daughter covertly taken by a camera placed in a smoke detector in her bedroom, according to sentencing records. The footage showed the 14-year-old undressing and changing out of her school uniform.

Lutkin pleaded guilty and admitted to filming her for “sexual gratification,” the judge said in 2019 when sentencing him to a year and a half in jail. Social workers removed the girl from the home. Reuters was unable to reach Lutkin.

“Pieces of the puzzle”

In early 2018, U.S. law enforcement officials from the Internal Revenue Service and Department of Homeland Security were tracing crypto payments made to another child abuse website called Welcome To Video. The owner, a South Korean man, was jailed for 18 months by a Seoul court for violating child protection laws and then sentenced to a further two years for concealing the site’s proceeds from authorities. He admitted the allegations.

Investigators spotted that one of Welcome To Video’s clients had sent crypto to a digital wallet linked to a darknet site unknown to them: Dark Scandals. Chris Janczewski, then a special agent at the IRS’s cyber crimes unit, was shocked to see that Dark Scandals was selling videos of actual rapes.

“It just seemed unreal to realise that was a thing,” Janczewski told Reuters.

That February, undercover officers made a payment worth $25 in bitcoin to one of the Dark Scandals wallets and received a download link by email. The content they downloaded included two videos depicting minors being sexually abused, according to the U.S. indictment.

Law enforcement then located and accessed Mohammad’s email account, which contained messages about payments to the site’s service providers. These providers were paid using a financial account in Mohammad’s name, the indictment said.

“[The video] was seen all through the city where I live. And I was very bullied because of this. I was harassed and called a whore because everyone thought I was doing it voluntarily and no one believed me anymore. Now I still suffer badly from flashbacks.”

The investigators tracked payments made to Dark Scandals to more than 300 accounts at eight unnamed exchanges, the U.S. prosecutor, Faruqui, said in a later request to recover funds these accounts held. Many customers used the accounts, opened with either no documents or “patently false” details between 2013 and 2020, solely to pay Mohammad, he wrote.

Janczewski, the former IRS agent, said the exchanges cooperated in turning over whatever information they held. A Coinbase spokesperson said the exchange worked with U.S. authorities on the case, reporting around 300 users and closing their accounts. Binance too said it cooperated. Gambaryan, its investigations head, added that the “blockchain provides unparalleled transparency into illicit money flows.”

After the Americans alerted Dutch authorities to Dark Scandals, a police unit in The Hague began an investigation. While police monitored Mohammad, he continued to earn money: On February 8, 2020, a client used Binance to send him $200 in bitcoin, blockchain data shows.

A month later, police raided his home in Barendrecht and arrested him, seizing his computers, hard drives and iPhone. Lijnse, the prosecutor, got a call several days afterwards from officers who had been scouring his devices. Until then, investigators knew only that Mohammad had been soliciting child abuse material from others, Lijnse recalled in an interview. Now, police told her they also had found that Mohammad was sexually abusing underage girls.

On a hard drive, Mohammad stored 50 videos that recorded his chat and video calls with several dozen Dutch girls on Snapchat, WhatsApp and Instagram, his judgement said. Police found photos and videos of the same victims either posing naked or performing sex acts on themselves. Other videos, taken by a spy camera, showed him committing rape at his home.

Jacqueline Beauchere,
global head of platform safety at Snapchat owner Snap, said the firm works with police, experts and industry partners to combat sexual abuse of children. “If we proactively detect or are made aware of any sexual content exploiting minors, we immediately remove it, lock the account, and report the offender to authorities,” she said. WhatsApp and Instagram owner Meta directed Reuters to a blog post detailing its policies on protecting teenagers from online harm.

Investigators identified 12 of the girls, aged between 11 and 15, from the videos. For each victim, they saw that Mohammad’s method was the same, Lijnse later told the court, reading from the messages and displaying some of the recordings.

Pretending to be a confident Dutch teenager called Rose, Mohammad befriended the girls on social media. After several months chatting, Rose messaged to say a boy was threatening to expose explicit photos of her or rape her. She told them she was so distressed that she was thinking about hurting herself. Rose said her aggressor would leave her alone if the girls did “an assignment,” typically by first sending the boy a semi-nude photo.

The girls agreed. They were desperate to help someone they thought was a friend in need, several later testified.

Once they sent the picture, Mohammad, often using the online alias SavageBoys, began making escalating requests, including that they penetrate themselves with objects in front of a webcam, Lijnse said. If the girls refused, he threatened to share images with their schools and families, or even kill them.

Mohammad abused many of his victims daily, and over several years. On recordings, they were heard crying and pleading. Mohammad was heard laughing. Lijnse said Mohammad forced two of the victims to repeatedly visit his home to rape them.

He recorded all his interactions with his victims, Lijnse told the court. He had “commercial plans with this material,” she said, though her investigators could not confirm how widely he had distributed it. “He turned women into disposable items as objects of lust,” she said.

Two months after Mohammad’s arrest, a Dutch mother of two living in The Hague received a phone call from police. It concerned her daughter, officers told the woman, inviting her to the station. It was this daughter who would later stand before the Dutch court as her lawyer read her victim statement.

She had known for months that something was wrong with her child. “I couldn’t put my finger on it,” she told Reuters, identified here only by her second initial, “S,” to protect her family’s privacy.

Her daughter’s behaviour had changed drastically, though S put it down to teenage hormones and troubles at school. The teen regularly told S that she didn’t want to live any more, without saying why. S said she was afraid to come home and find her daughter dead.

At the police station, officers told S that Mohammad had started abusing her daughter two years earlier, when she was 14. After first contacting her on Instagram as his alter-ego Rose, Mohammad blackmailed her into making hundreds of videos, police said. On hearing this, S said she stopped breathing and felt the world come to a standstill.

“The pieces of the puzzle fell into place for me,” she said.

“The other side”

On May 2, S and her daughter travelled to Dordrecht, across the river from Barendrecht, to attend Mohammad’s trial.

They sat in the audience, along with other victims and their parents, separated from Mohammad by a glass wall. It was the first time the girl saw him in person. Each time he glanced toward the teen, she panicked and felt sick, S said. Her daughter and another victim held hands while the judge described the charges against Mohammad.

Mohammad told the court he set up Dark Scandals because he didn’t believe selling videos of sexual abuse was illegal. He considered it a “grey area” and an “opportunity to make money.” He denied the rape allegations, claiming video and audio evidence did not identify him.

“There was a video of the rape because there were cameras in the house … I was not allowed to go to the police. And you visited every time in a different car. You did that on purpose. I became more and more afraid.”

His lawyer, Sjoerd van Berge Henegouwen, portrayed Mohammad as a victim. The attorney complained that Mohammad was upset that photos of himself, taken from his social media accounts, had been spread online before the trial. “The personal damage to my client is enormous,” the lawyer said. While a court sketch artist worked, Mohammad tried to conceal his face with a sheet of paper.

On the second day, victims and parents testified about the impact of Mohammad’s operation. S’s daughter entered the courtroom with her lawyer, Priya Soekhai. In a statement read by Soekhai, the teen said she hardly dared to sleep any more because of the nightmares she suffered. She was eating almost nothing. She couldn’t trust men, and struggled even to look at them.

“I’ll never be the same person I used to be,” she said. “I hope you never dare do this to girls and women again.”

The teenage victim sitting next to her spoke next. After one of the videos she sent Mohammad circulated on Instagram, she said she was harassed and “called a whore” because people thought she made it voluntarily. “No one believed me,” she said. She often thought about taking her own life during the abuse, which began when she was 14. “I couldn’t do it because of my family who I would leave behind,” she said.

A month later, the court reconvened for the verdict. The chief judge, Paul Putters, ordered Mohammad to spend a mandatory period of psychiatric treatment and secure confinement after a 10-year jail term. Mohammad walked out without a word. S’s daughter and the other victim hugged each other.

Afterwards, in an interview alongside her daughter, S said the teenager, now 18, wanted to put the case behind her and focus on school. She planned to train to become a police officer to investigate abuse cases like her own.

S, however, doesn’t see the case as closed. Her greatest fear, she said, is that her daughter’s footage had been resold and would appear again, restarting the nightmare. She wants police to identify the Dark Scandals customers who used cryptocurrency to pay for the abuse videos. Lijnse told Reuters her team is looking into this.

Law enforcement officials and researchers told Reuters that crypto exchanges remain a vital payment tool. The IWF received more reports last year of websites selling child abuse imagery for crypto than any year prior. Though most major exchanges now proactively help authorities to track down suspects, the IWF’s Sexton said offenders are always looking for the weak spot and simply hop to platforms with looser controls.

“People think bitcoin is just a fun way to make money,” S said. “They don’t know the other side.”