The United States Drug Enforcement Agency has arrested a Slovakian man on charges of running a darknet market, Fallen Kingdom. Officials claim that the man sold drugs and personal information and facilitated others to do the same. At the time of this announcement, the market has since closed with a site seizure notice showing.
Key Takeaways
- Kingdom Market, a darknet market selling drugs and personal information, was shut down by international law enforcement.
- Alan Bill, a Slovakian man believed to be the Darknet market administrator, was arrested and faces 10 felony charges in the US.
- The market had over 25,000 listings and used cryptocurrency for transactions at the time of the seizure
- Bill was captured through failed OpSec measures; cryptocurrency transactions, IP address links, and exchanges.
Alan Bill, 30, of Bratislava, was charged with 10 felonies by the U.S. District Court in St. Louis. He faces charges of conspiracy to distribute controlled substances, four counts of distribution of a controlled substance, conspiracy to commit identity theft and fraud related to identification documents, identity theft, aggravated identity theft, misuse of a passport, and money laundering conspiracy.
Bill, also known as “KingdomOfficial” and “Vend0r” is believed to have held an administrative role and operated the “Kingdom Market”, which had over 25,000 active listings. The darknet market began operating in March 2021 and sold narcotics, computer malware, stolen identities, counterfeit money, unlicensed pharmaceuticals, and fraudulent documents, including passports and driver’s licenses.
The Kingdom Market is alleged to have charged dark web vendors 500 euros as an initial fee, then also charged three percent on sales as a commission payment. All the market’s sales were conducted in cryptocurrencies such as Bitcoin, Monero, Litecoin, and Zcash.
An indictment order alleges that the dark web platform advised users of the platform with methods to conceal their transactions.
“The Kingdom Market darknet site allowed criminals to move dangerous drugs in and out of our communities and use the digital world to hide their illegal activities.”
Assistant Special Agent in Charge Melissa McFadden of IRS Criminal Investigation’s (CI) St. Louis Field Office said
German authorities allege in a BKA press release allege that “over 42,000 products were offered on the marketplace; of these, around 3,600 products come from Germany. Tens of thousands of customers and several hundred seller accounts were registered on the marketplace.”
Websites associated with Kingdom Market have also been seized by law enforcement. The charges set forth in Bill’s indictment order are merely accusations and do not constitute proof of guilt.
What We Know About The Seizure and Arrest
The Drug Enforcement Administration and several international law enforcement agencies in Switzerland, Moldova, Ukraine, and the German Federal Criminal Police (BKA) conducted an operation into the “Kingdom Market.”
On Dec 17th, Kingdom Market went offline, with little to no word being reported on it. One user went to Dread to complain about this, and it was met with slight criticism. The Darknet Market was cold for just 24 hours, but something had become clear. This wasn’t an exit scam, and the team weren’t aware of what was up.
“I don’t think they even know what’s going on, They don’t know whether it’s a DDoS or a Server Failure, I would be more concerned that the Drives are being Imaged right now.”
CodeIsLaw announces
One of Kingdom Market’s support admins did address the issue claiming “We want to apologize to you all, we are experiencing outage and we are working on fixing it. I stay online here, so will be answering eventual comments or question.” – /u/OhLongJohnson
A couple hours later co-admin /u/Papinian3 A reported
“Dear clients, we are still under ugly & sophisticated DoS attack. We are trying to repair it as soon as it’ll get. I know it is annoying for all of us exactly before X-mas & holiday period of the year. Thanks for your patience. The fault repair time approx. 24 hours. Rgds. P3”
/u/Papinian3 A
They then sent some alternative links to try, but it all proved futile and all admin and staff went silent. It had become clear the market was under an attack they had no control over. As you may guess this was the last statement to come through from Kingdom Market staff. A day later, u/Paris pointed out it was LE behind the scenes.
Papers filed in an U.S indicted order reveal that investigators used the dark web market to purchase methamphetamine, pills containing fentanyl, personally identifiable information belonging to numerous people, and a United States passport with cryptocurrency.
“Certain cryptocurrency transactions from a cluster or group of cryptocurrency addresses used by Kingdom were traced to cryptocurrency wallets held in the name of BILL. Based on the timing and amounts of these transactions, your affiliate believes these payments were made to an administrator of Kingdom.”
Court documents allege
Agents believe that a specific IP address used to access a “Kingdom” Reddit account was simultaneously used to access Bill’s email address to create centralized exchange accounts and to apply for an ESTA application. This could have been avoided by following simple OpSec guidelines.
An investigation into Bill’s finances between the period of November 2021 and April 2023 exposed countless deposits of Euros into his Slovakian bank account. The deposits total approximately €189,000, with the majority of them being made in cash.
Agents with the FBI and Homeland Security Investigations arrested Bill on December 15, at the Newark Liberty International Airport in New Jersey. German Federal Criminal Police, or Bundeskriminalamt, confirmed in a press release the seizure of the Kingdom Market.
BKA authorities said that investigations are underway to identify the people who operated the illegal market. Agents’ investigations into the dark web marketplace will now be aided by an analysis of the seized server infrastructure.
HSI Kansas City acting Special Agent in Charge Taekuk Cho said, “These darknet marketplaces present a significant danger to our communities here in the U.S. as well as those of our international partners.”
He further committed to continue to disrupt and dismantle transnational criminal organizations
“wherever we find them. Collaboration with our global law enforcement partners is the key to disrupting drug trafficking, money laundering and the other illicit activities that occur on the darknet.”
Taekuk Cho attributing Bill’s arrest and success of the operation
U.S. Attorney Sayler A. Fleming warned criminals operating on the dark web of law enforcement’s increasing presence. He said in a statement that “The use of darknet marketplaces and cryptocurrency will not protect dangerous criminals from law enforcement efforts to combat the flow of narcotics and other illegal activities.”
Rival Markets Jumping To Grab Vendors
Shortly before Kingdom Markets went offline, Dread admin u/Paris posted a message to inform the Darknet Community of an LE infiltration on the website. Titled “Kingdom Market has likely been seized by law enforcement“
Dread staff has received information from a trusted party that multiple individuals, which had sufficient server access to Kingdom’s infrastructure, have been arrested by law enforcement with their systems seized. We do not know, and probably won’t ever know, the extent of the compromise. It is a shame, but with the current information provided, the chances of Kingdom market returning is from being down is basically zero.
Dread Admin u/Paris
Paris went on to note that vendors and users shouldn’t panic, as this is clearly common on Darknet market. He explained that so long as OpSec was always followed while using markets, it’s unlikely LE can backtrace back to the users.
As is typical during a time like this, we’ve seen an increase in advertisements and posts from alternative market admins who are “refugeeing” all Kingdom vendors. Open Dread, and the first thing you’ll see is a Cypher Market pinned message on the front page. “📣 Cypher market welcomes all Kingdom refugees”
CodeIsLaw explained in his post that vendors could waive the fees through the following steps.
TO REQUEST A VENDOR WAIVER:
1.) Get the link to the market from the sidebar on /d/Cypher
2.) Signup and add your PGP key
3.) Submit a ticket requesting a vendor account and include your Kingdom username
4.) Once approved, start listing your products and enter your payout addresses under Settings -> Payout Addresses
This is just one of the top Darknet Markets offering refugee options for Kingdom users.
The Charges
A U.S. grand jury has charged Alan Bill with 10 felonies. He is presumed to be innocent until and unless proven guilty. Should Bill be found guilty of the charges he faces, the drug trafficking conspiracy charge carries a minimum sentence of five years in prison, with a maximum of 40, or a fine of up to $5 million.
Additionally, his identity theft charge carries a penalty of up to 15 years in prison, the misuse of a passport charge carries a penalty of up to 20 years, and money laundering conspiracy charge carries a penalty of up to 20 years in prison.
Hey there, I’m a dark web geek who’s been around for the last 8 years. More precisely, I’m livedarknet’s senior content writer who’s been writing about darknet marketplaces, tutorials, and cybersecurity stuff for educational purposes.