Back to Markets
Crypto▼ Bearish
Dormant Wallets Led DOJ to Alleged Dream Market Operator
DOJ says dormant wallet movements after 2019 shutdown helped identify Owe Martin Andresen, who allegedly laundered over $2 million via crypto and gold purchases. The case signals old darknet funds remain traceable.
Continue with
U.S. prosecutors have indicted a German national for allegedly operating Dream Market, one of the largest darknet marketplaces, after dormant cryptocurrency wallets that sat untouched for years suddenly moved. The Department of Justice announced on 13 May that Owe Martin Andresen faces money laundering charges tied to the platform, which shut down in 2019. The case turns on a simple but powerful forensic fact: blockchain activity can remain visible to investigators long after a marketplace disappears, and moving old funds can break a case wide open.
How Dormant Dream Wallets Led to the Speedstepper Identity
The indictment alleges that Andresen controlled the "Speedstepper" identity, the main administrator behind Dream Market. The marketplace operated from 2013 to 2019, allegedly facilitating large-scale sales of narcotics, counterfeit documents, stolen personal data, and fraud services. When Dream Market closed, its cryptocurrency infrastructure remained largely untouched, including wallets holding millions of dollars in administrator commission payments.
That changed in late 2022. Funds began moving from the original "Dream Wallets" into newly consolidated wallets. According to the DOJ, those transfers
"could only have been initiated by someone with access to Dream Market's original private keys."
That single observation turned dormant wallets into a direct link to the administrator. Anyone moving those funds had to possess the private keys that controlled the marketplace's core treasury. The movement pattern mirrored classic money laundering techniques. The blockchain recorded every step.
The Gold Bar Off-Ramp
Prosecutors allege Andresen then used some of the moved funds to purchase gold bars through a cryptocurrency service provider based in Atlanta, Georgia. The gold was shipped to his home in Germany. That physical off-ramp created a paper trail connecting a real-world identity to the wallet activity. The DOJ says Andresen laundered more than $2 million between August 2023 and April 2025.
German and U.S. law enforcement coordinated raids on 7 May following Andresen's arrest. The operation recovered evidence that further tied him to the Speedstepper persona. The case demonstrates that even a years-long gap between a marketplace shutdown and fund movement does not erase the forensic link.
The $2 Million Laundering Trail: Consolidation, Gold, and Atlanta
The laundering path reveals a sequence that law enforcement agencies now routinely monitor. First, dormant wallets awaken. Second, funds consolidate into fewer addresses, often using fresh wallets with no prior history. Third, the consolidated funds interact with a cryptocurrency service provider–an exchange, a payment processor, or a precious metals dealer–that has know-your-customer (KYC) obligations. That interaction creates a real-world identity anchor.
In this case, the Atlanta-based service provider shipped gold to a physical address in Germany. The DOJ's filing does not name the provider, however the transaction pattern is a template for how blockchain analysis firms and investigators connect old darknet funds to individuals. The $2 million figure is not the total held in the Dream Wallets; it is the amount allegedly laundered during the specific period. The original wallets likely held far more, and the remaining funds may still be under surveillance.
Why Dormant Wallets Are a Forensic Goldmine
Key insight: Blockchain immutability turns dormant wallets into time capsules that law enforcement can open years later. When a darknet marketplace shuts down, administrators often leave funds in place, believing that inactivity will make the wallets invisible. The opposite is true. A wallet that never moves is a wallet that preserves its entire history. The moment it moves, that history becomes active evidence. Investigators can trace the funds back to the marketplace's known addresses, often identified during the original investigation. The movement itself is the trigger.