COVID-19 fraud domain seized from seller who attempted to sell it using bitcoin


U.S. Immigration Customs and Enforcement’s (ICE) Homeland Security Investigations (HSI) and United States Attorney’s Office for the District of Columbia obtained a warrant Friday authorizing seizure of coronaprevention.org following an HSI Philadelphia investigation in support of Operation Stolen Promise.

HSI recently launched Operation Stolen Promise to protect the homeland and global supply-chain from the increasing and evolving threat posed by COVID-19-related fraud and criminal activity by combining HSI’s expertise in global trade investigations, financial fraud, and cyber investigations with robust private and public partnerships.

“Sadly, criminals are using the current pandemic as an opportunity to generate proceeds while so many Americans are suffering,” said William S. Walker, acting HSI Philadelphia special agent in charge. “Homeland Security Investigations and our partners will continue to aggressively pursue those who attempt to illegally capitalize on this crisis through illicit money-making schemes.”

The seizure warrant alleges that the owner of the domain name, coronaprevention.org, posted it for sale on a hackers forum.

The post appeared the day after the president declared a national emergency due to the COVID-19 pandemic. The seller stated on the forum that this domain would be an effective way to sell “high markup in demand products.”

The seller exponentially marked up the price of the domain. The seller asked for the payment to be made via bitcoin.

The warrant further alleges that the seller engaged in conversations with an undercover agent from HSI about the sale of the domain. The seller stated that it was “genius” to sell “fake testing kits” using this domain.

The seller further stated that the seller “wanted to do that but I couldn’t get enough cash to bulk buy them from Alibaba [a Chinese e-commerce site].” The seller recommended directed the undercover agent on how to set up a new website on the domain using a foreign-based service, so as to prevent U.S. authorities from being able to shut it down in the future.

“We will not tolerate exploitation of this national emergency for personal gain,” said U.S. Attorney Tim Shea. “This office will not allow fraudsters to use anonymous online spaces and cryptocurrency to hide their harmful activities and prey on victims.”

The charges in the warrant are merely allegations, and civil forfeiture proceedings will commence in which any interested party may make a claim to ownership of the seized property.

The enforcement action against the owner of a fraudulent website follows Attorney General William Barr’s recent direction for the department to prioritize the detection, investigation, and prosecution of illegal conduct related to the pandemic.

The case is being handled by Assistant U.S. Attorney Zia M. Faruqui, Paralegal Specialist Brian Rickers, and Legal Assistant Jessica McCormick of the U.S. Attorney’s Office for the District of Columbia.

As part of Operation Stolen Promise, HSI is partnering with U.S. Customs and Border Protection (CBP), the Food and Drug Administration, the U.S. Postal Inspection Service, the U.S. Secret Service, the Internal Revenue Service, the Federal Bureau of Investigation, and the Five Eyes Law Enforcement Working Group. Additionally, efforts span multiple HSI components including the National Intellectual Property Rights Coordination Center, HSI International Operations, the Illicit Finance and Proceeds of Crime Unit, and the Cyber Crimes Center.

As of April 23, 2020, HSI special agents have opened over 232 cases initiated, 376 total seizures, 329 leads sent, 70 disruptions, seized over three million dollars in illicit proceeds; made six arrests; executed 12 search warrants; sinkholed over 11,000 COVID-19 domain names and worked alongside CBP to seize over 225 shipments of mislabeled, fraudulent, unauthorized or prohibited COVID-19 test kits, treatment kits, homeopathic remedies, purported anti-viral products and personal protective equipment.

The launch of the operation is in direct response to a significant increase in criminal activity.

To report suspected illicit criminal activity or fraudulent schemes related to the COVID-19 pandemic, email Covid19Fraud@dhs.gov.

ICE.gov (April 2020)COVID-19 fraud domain seized from seller who attempted to sell it using bitcoin

Ohio Resident Charged with Operating Darknet-Based Bitcoin “Mixer,” which Laundered Over $300 Million

An Ohio man was arrested for his operation of Helix, a Darknet-based cryptocurrency laundering service.


“Helix” Laundered Bitcoin From Numerous Darknet Markets

An Ohio man was arrested for his operation of Helix, a Darknet-based cryptocurrency laundering service. 

In the three-count indictment unsealed Feb. 11 in the District of Columbia, Larry Harmon, 36, of Akron, Ohio, was charged with money laundering conspiracy, operating an unlicensed money transmitting business and conducting money transmission without a D.C. license.

According to the indictment, Harmon operated Helix from 2014 to 2017.  Helix functioned as a bitcoin “mixer” or “tumbler,” allowing customers, for a fee, to send bitcoin to designated recipients in a manner that was designed to conceal the source or owner of the bitcoin.  Helix was linked to and associated with “Grams,” a Darknet search engine also run by Harmon. 

Harmon advertised Helix to customers on the Darknet as a way to conceal transactions from law enforcement. 

Shop Amazon Gift Cards. Any Occasion. No Expiration.

“Helix allegedly laundered hundreds of millions of dollars of illicit narcotics proceeds and other criminal profits for Darknet users around the globe,” said Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division.  “This indictment underscores that seeking to obscure virtual currency transactions in this way is a crime, and that the Department can and will ensure that such crime doesn’t pay.”

“For those who seek to use Darknet-based cryptocurrency tumblers, these charges should serve as a reminder that law enforcement, through its partnerships and collaboration, will uncover illegal activity and charge those responsible for unlawful acts,” said U.S. Attorney Timothy J. Shea of the District of Columbia.

“The brazenness with which Helix operated should be the most appalling aspect of this operation to every day citizens.  There are bad actors and then there are criminals who facilitate hundreds of other crimes,” said Don Fort, Chief, IRS Criminal Investigation.  “The sole purpose of Harmon’s operation was to conceal criminal transactions from law enforcement on the Darknet, and because of our growing expertise in this area, he could not make good on that promise.  Working in tandem with other sites, he sought to be the ‘go-to’ money launderer on the Darknet, but our investigators once again played the role of criminal disrupters, unraveling the interlinked web from one tentacle to another.  We thank the Belizean authorities and other law enforcement agencies for their assistance on this case.”

Cell Phones and Accessories

“The perceived anonymity of cryptocurrency and the Darknet may appeal to criminals as a refuge to hide their illicit activity,” said Special Agent in Charge Timothy M. Dunham of the Criminal Division of the FBI Washington Field Office.  “However, as this arrest demonstrates, the FBI and our law enforcement partners are committed to bringing the illegal practices of money launderers and other financial criminals to light and to justice, regardless of whether they are using new technological means to carry out their schemes.”

The indictment alleges that Helix moved over 350,000 bitcoin – valued at over $300 million at the time of the transactions – on behalf of customers, with the largest volume coming from Darknet markets.  Helix partnered with the Darknet market AlphaBay to provide bitcoin laundering services for AlphaBay customers.  AlphaBay was one of the largest Darknet marketplaces in operation at the time that it was seized by law enforcement in July 2017.

The charges in the indictment are merely allegations, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law. 

The investigation was led by the IRS-CI and the FBI’s Washington Field Office with assistance from the Financial Crimes Enforcement Network.  The Department of Justice’s Office of International Affairs of the Criminal Division, the U.S. Attorney’s Office for the Northern District of Ohio, IRS Field Offices of Washington, D.C.; Cincinnati, Ohio; and Oakland, California; and the FBI’s Criminal Investigative Division and Field Offices of Cleveland, Ohio — Akron Resident Agency; Newark, New Jersey; and San Francisco, California — San Jose Resident Agency and the Department of State’s Diplomatic Security Service provided essential support for the operation.   

Internationally, the Belize Ministry of the Attorney General and the Belize National Police Department simultaneously executed a search warrant of a residence allegedly leased by Harmon in Belize as U.S. authorities executed warrants in the United States.  U.S. law enforcement agencies, coordinated by U.S. Embassy Belmopan, assisted in the Belize action.  “These actions underscore the vital importance of working closely with our law enforcement partners in Belize to make both of our countries safer and secure,” said U.S. Chargé d’Affaires, a.i. Keith Gilges.

Trial Attorneys S. Riane Harper and C. Alden Pelker of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Christopher B. Brown of the U.S. Attorney’s Office for the District of Columbia are prosecuting the case.  Additional assistance has been provided by Trial Attorneys Emily Siedell and Brian Nicholson of the Criminal Division’s Office of International Affairs, former CCIPS Trial Attorney W. Joss Nichols and Assistant U.S. Attorney Daniel Riedl of the Northern District of Ohio. 

Justice.gov (February, 2020) Ohio Resident Charged with Operating Darknet-Based Bitcoin “Mixer,” which Laundered Over $300 Million