BerlinUS prosecutors spent 7 years identifying who ran Dream Market before charging Owe Martin Andresen.
Germany has arrested him; the marketplace operated 2013–2019 as one of the dark web’s largest criminal drug exchanges.
No court date has been set.
Sources: The Record
WHAT TOR ACTUALLY DOES
Tor routes traffic through three volunteer relays, each peeling one layer of encryption. The entry node sees you but not your destination; the exit node sees the destination but not you. Onion services skip the exit node entirely — both ends stay inside the network, which is why marketplaces use them.
THE SILK ROAD PRECEDENT
Ross Ulbricht launched Silk Road in 2011 and ran it until 2013, when the FBI seized the servers and arrested him in a San Francisco library mid-login — to preserve his unencrypted laptop session. He got two life sentences without parole. The case set the template: patient years of attribution work, then a physical arrest timed to catch the operator logged in.
THE EXIT SCAM PATTERN
Dark markets rarely get shut down cleanly. The dominant ending is the exit scam: admins freeze withdrawals, drain user escrow wallets, and vanish. Evolution (2015) walked off with ~$12m in bitcoin. AlphaBay's admin allegedly died in a Thai jail in 2017 after a coordinated takedown. Dream Market is unusual in that its admin was identified and arrested years after the site closed.
HOW ATTRIBUTION ACTUALLY WORKS
Tor protects the network layer, not operational security. Admins are caught through reused usernames across forums, bitcoin transaction graph analysis (chain analysis firms cluster wallets by behavior), seized servers from co-conspirators, and basic mistakes — logging into the marketplace from a home IP, ordering pizza to a safe house. The crypto is rarely the weak link; the human is.
WHY GERMANY
Germany has become the operational hub for dark web takedowns. Frankfurt hosts major internet exchange points; the BKA's cybercrime unit runs joint operations with the FBI, DEA, and Dutch police. The 2017 Hansa takedown — German police ran the marketplace covertly for a month, harvesting buyer addresses — and the 2022 Hydra seizure were both German-led.
THE MONERO PIVOT
Bitcoin's public ledger is what burned most early admins — every transaction is permanently traceable, and firms like Chainalysis specialize in clustering wallets to real identities. Modern markets push users toward Monero, whose ring signatures and stealth addresses break the transaction graph. The 7-year gap between Dream Market's closure and this arrest is partly a bitcoin forensics story.