"After locating the bitcoin depository allegedly belonging to the user 'OxyMonster,' agents tracked several incoming payments and outgoing deposits from the tip jar to various 'wallets' controlled by Vallerius."

DEA agents soon found that Vallerius had Instagram and Twitter accounts. They compared the writing style of "OxyMonster" on the Dream Market forum to the writing style of Vallerius on his social media accounts. "Agents discovered many similarities in the use of words and punctuation, including: the word "cheers," double exclamation marks, frequent use of quotation marks, and intermittent French posts."

Last August, DEA special agent Lilita Infante contacted Homeland Security Investigations to find out whether Vallerius might be travelling to the United States. That agency said he was flying from Paris to Atlanta on August 31, 2017. Infante asked the Homeland Security's border officials to flag him and pull him aside for questioning at customs.

During a court hearing on the admissibility of certain evidence, Infante testified she did not know what Vallerius would be carrying with him but that in her experience, users of the Dark Web often conducted their business on laptop computers.

She said she hoped that a search of Vallerius' belongings, including his laptop, upon entering the United States might reveal additional links between him and his suspected Dream Market activities.

The DEA agent's hunch proved to be spot-on. Vallerius, who was with his wife, possessed a laptop computer, mobile phone and iPad tablet. A Homeland Security agent asked him for the passwords to the electronic devices as a "routine inspection" at the border.

DEA agents, waiting in a nearby room at customs, used the passwords to gain access to Vallerius' computer and search its contents. And that was how they directly linked Vallerius to the Dream Market.

AP