Stating ‘We love anonymity’ on Dark Scandals’ homepage, Michael Mohammad used crypto to build the site into one of the largest known marketplaces for illegal sexual imagery of children.
DORDRECHT, NETHERLANDS: In the eight years he ran an online market selling images of violent child sexual abuse, Michael Mohammad made the equivalent of more than 100,000 euros. At his trial in May, while some of his victims listened, he told the judge: “It was purely business.”
The Dutch court sentenced Mohammad to 10 years in jail after convicting him of a litany of crimes. They included distributing thousands of photos and videos of child abuse, rape and bestiality via his website, Dark Scandals. He forced a dozen girls under the age of 16 to penetrate themselves and record it. He raped two of them and filmed it.
A new breed of company enabled his business: cryptocurrency exchanges. Mohammad’s customers used these platforms to buy digital tokens with dollars and euros, and spend them with relative anonymity. These tokens were the currency of Mohammad’s abuse. In all, transaction data reviewed by Reuters show, Dark Scandals’ customers used almost 50 different exchanges, including industry leaders Coinbase and Binance.
Coinbase told Reuters the exchange “is the wrong place to go if you’re trying to get away with a crime. We have a zero tolerance policy for anyone engaging in illicit activity like child sexual abuse material.” Binance said it cooperated with law enforcement to help take down Dark Scandals.
As a 26-year-old student, Mohammad turned to bitcoin in 2013 after PayPal blocked his newly launched website from its payment network. According to the judge, the payment provider objected to the website’s pornographic content. PayPal did not respond to requests for comment.
Stating “We love anonymity” on Dark Scandals’ homepage, Mohammad used crypto to build the site into one of the largest known marketplaces for illegal sexual imagery. He drew in customers on the “darknet” of illicit websites that are hidden from mainstream browsers.
Mohammad charged clients crypto worth up to 200 euros ($205) to download video “packs” made up of hundreds of clips. He also traded access to his collection for new videos – requiring that the bartered material depict acts that his website said were “forced against will.” He earned 115,000 euros in cryptocurrency from his clients, the court found, joining the growing numbers of criminals who facilitate and profit from online sexual abuse.
Mohammad was arrested in 2020 after an international investigation involving U.S. and Dutch law enforcement. Authorities were able to track the crypto flows to Dark Scandals on the blockchain, the software that underpins cryptocurrencies by publicly recording the dates, value and digital wallet addresses of customer transactions.
However, users could still transfer funds to the site without detection if exchanges did not require them to provide any personal details. Many of the accounts Mohammad’s customers opened at eight different exchanges held either no personal details or fake ones, an assistant U.S. attorney testified in a court submission.
“This anonymity promoted the success of the Dark Scandals sites,” wrote the assistant U.S. attorney, Zia Faruqui, who helped oversee the investigation that led to Mohammad’s capture in the Netherlands. Faruqui didn’t identify the exchanges.
For this article, Reuters interviewed a dozen experts on sexual violence, current and former law enforcement officials involved in investigating child abuse, and several victims’ parents. To research Dark Scandals, which offers a rare window into offenders’ use of crypto, Reuters attended Mohammad’s four-day trial at a district court in the city of Dordrecht, where he and his victims gave hours of testimony.
“You have destroyed my life and ruined all the beauty I saw in it,” testified one girl he abused from the age of 14. Her statement was read out by her lawyer as the victim, now 18, stood alongside. “I will never forgive you for what you did.”
Naming him as “Michael M.,” the court sentenced Mohammad in June to 10 years in jail for producing and distributing child abuse images, and for sexually assaulting and raping underage girls. The U.S. Justice Department identified Mohammad fully in 2020 when it unsealed an indictment against him. In an email to Reuters, his lawyer said Mohammad was wrongly convicted and would appeal, declining further comment.
“Every day I was locked up with Michael felt like a nightmare. Every day I thought about suicide. I felt empty. I couldn't function normally. I suffered physical and mental pain.”
An anonymous victim of Mohammad, in a statement read in court by her lawyer
Exchanges are key conduits in the roughly $1 trillion crypto industry, processing billions of dollars of transactions each day and earning revenue from trading fees, typically set around one percent. Their rapid growth has drawn scrutiny from regulators and law enforcement.
The U.S. Justice Department, in a report this September, said many crypto exchanges still “make little or no effort to comply” with know-your-customer requirements. Europol, the European Union’s police force, warned in January that unregulated exchanges’ often “loose” client checks had helped digital currencies become the “payment of choice” for criminals operating online, including those selling child abuse material.
Coinbase let users transfer cryptocurrencies between digital wallets without submitting identification for at least two years after its 2012 launch, according to a 2014 investor presentation. Coinbase now requires all customers to verify their identities to open accounts. At Binance, which launched in 2017, clients could open accounts with just an email until mid-2021.
The sums involved in buying and selling images of sexual abuse remain small compared to other criminal activities, such as the drugs trade. But the figures are increasing. While in the past offenders typically traded child abuse imagery among themselves in small communities, the darknet has become a breeding ground for sites like Dark Scandals that charge in crypto. And the damage is far-reaching.
Researcher Chainalysis, used by U.S. government agencies to track illegal flows, estimates that child abuse sites’ annual revenue in crypto leapt from around $250,000 in 2017 to almost $1 million in 2020.
Reuters reviewed Chainalysis data relating to transactions through Dark Scandals’ digital wallets. These data show that the site’s customers used 47 exchanges, of which the three most popular were Coinbase, Finland-based LocalBitcoins and Binance. Crypto worth a total of $22,000 moved through Coinbase and LocalBitcoins between 2013 and 2019. Some trade shifted to Binance and to another exchange called ShapeShift as other platforms tightened their identity checks. Binance and ShapeShift together processed about $3,400 until Dark Scandals closed in 2020, according to the data.
The sums of money involved fail to capture the gravity of the harm being done, according to the Internet Watch Foundation, a British child sexual abuse hotline which collects data worldwide.
The IWF says the annual number of webpages it has confirmed contain such images rose over four-fold from 2016 to over 250,000 last year. During that same period, the IWF found the number of commercial sites selling abuse imagery for virtual currency exploded to 1,014 from just 41. These sites often included links for users to pay via crypto exchanges, the IWF told Reuters, declining to name companies.
“For those people looking to make money from child sexual abuse, crypto has lowered the barrier,” said Dan Sexton, the IWF’s chief technology officer.
Coinbase’s vice president of global intelligence, John Kothanek, told Reuters that the exchange works closely with law enforcement on child abuse cases, alerts authorities to potential illicit activity and closes down accounts. Coinbase has “dedicated, around-the-clock compliance and investigative teams, access to sophisticated blockchain analysis tools, and a best-in-class process for identifying criminals,” he said in a statement, adding that crypto is easier to track than traditional currency.
“We will find you and hold you accountable — this has been the case since day one at Coinbase,” Kothanek said.
Binance’s global head of intelligence and investigations, Tigran Gambaryan, is a former U.S. Internal Revenue Service agent who was involved in the Dark Scandals case. He said Binance and other exchanges provided records to the investigation team. “If not for crypto and the cooperation Binance provided, the individual behind the website would not have been identified,” Gambaryan said. LocalBitcoins and ShapeShift did not respond to requests to comment.