Dream Vendor “OxyMonster” to Enter a Guilty Plea in June

Gal Vallerius, the bearded Frenchman known on the darknet as “OxyMonster,” struggled for nearly a year to prevent the prosecution from using his seized laptop as evidence in a drug trafficking case in Florida. If a jury had found him guilty of the conspiracy or money laundering charges in his indictment, he could have spent the rest of his life in a federal prison in the United States. According to recent court documents, though, the prosecutor and defense attorney have constructed a plea agreement that takes life in prison off the table. At his upcoming hearing, the former darknet drug dealer will likely sign the plea agreement in exchange for a much shorter sentence.

After he landed at an airport in Atlanta, Georgia, the US Drug Enforcement Administration arrested Vallerius and seized his laptop. DEA special agent Lilita Infante had scoped out Vallerius during a recent operation that targeted darknet opioid vendors. Infante noted that the DEA needed the laptop in order to successfully prosecute a suspected drug dealer from another country. For reasons constantly questioned by darknet market users, Vallerius had travelled from France to the United States with a laptop that contained his darknet market vendor information, marketplace passwords, bitcoin wallets linked to the vendor accounts, and matching PGP keys.

The DEA claimed his laptop contained information that directly connected Vallerius to the OxyMonster moniker used on dozens of darknet markets. Assuming the Criminal Complaint contained accurate information, the existence of a single bitcoin address in one of Vallerius’ bitcoin wallets connected all the dots for investigators. On some of the darknet market vendor profiles, OxyMonster had a “tip jar” bitcoin address, court documents explained. Many vendors use tip jars to collect leftover cryptocurrency from appreciative customers. But very few list one of their own bitcoin addresses in their public profile; many simply create listings that allow the “tip jar” transaction to function no differently than any other transaction on a darknet marketplace.

Vallerius, according to law enforcement officers, had left a bitcoin address in cleartext on his profile on at least one marketplace. After they announced his arrest, Dream Market quickly removed his account and the other marketplaces he had worked at had already exit scammed. His TradeRoute profile lacked a bitcoin address. But even his TradeRoute profile mentioned that he had worked as a moderator for markets dating back to Evolution. He had been selling under both the OxyMonster and Vendeep usernames for the same length of time. For instance, in 2016, OxyMonster was on Acropolis Market’s list of vendors approved for FE transactions.

At one point, Vallerius’ bitcoin address became the focus of DEA investigators who tracked transactions and discovered that the majority of the money sent to the “tip jar” address passed through Vallerius’ LocaBitcoins account. Preventing the prosecution from using this information, along with other incriminating data from his laptop, was Vallerius’ public defender’s primary focus for the past 11 months. Since they failed at evidence suppression, Vallerius’ public defender struck a deal with prosecutor Tony Gonzalez. Vallerius will enter a guilty plea and serve a sentence of at least 20 years in federal prison. In exchange for the guilty plea, life sentence will likely be taken off the table.

The prosecutor’s office declined to comment on the deal.