On August 15, Cody Wilson, the man best known for distributing blueprints for 3D printed guns, allegedly paid for sex with an underage girl he met on SugarDaddyMeet.com. The next day, Wilson emptied over 60 bitcoin wallets, equaling $986,525, into a single, new account—the same day a friend of the victim told Wilson she’d spoken to the police. On August 27, Wilson’s accuser spoke with investigators at the Center for Child Protection, telling them how Wilson identified himself on the website, where he used the pseudonym Sanjuro, before setting up their meeting. Four days later, Wilson emptied the account with his nearly $1 million worth of bitcoin and dumped it into another new account, where it remains, as of September 20.
We know all this because the Southern Poverty Law Center has been tracking the activity of Wilson’s bitcoin wallets. In fact, the SPLC has been tracking the bitcoin wallets of a number of alt-right hate groups, white supremacists, and neo-Nazis since last year—not long before the Charlottesville Unite the Right rally. That’s when the organization started noticing white supremacists like the Daily Stormer’s Andrew Anglin “advertising aggressively for bitcoin donations,” Heidi Beirich, head of the SPLC’s Intelligence Project, which publishes the Hatewatch blog, told BREAKER.
“After Charlottesville happened in 2017, PayPal started stripping white supremacists’ accounts,” said Beirich, “so everybody was promoting bitcoin addresses as a way to get donations.” Beirich and her team started building an Excel spreadsheet of all the hate groups they could find with bitcoin accounts. “I’ll tell you everything that happened, but it’s not that sophisticated,” she said.
The idea was to follow the money to see which hate groups and individuals had connections. Beirich’s team at the SPLC spent hours looking at accounts connected to the alt-right, noting when one known account started interacting with another and linking more and more names to bitcoin wallets. This ended up changing the way the SPLC perceived the affiliations of certain white supremacist groups.
Take the publisher Counter-Currents. Though its website clearly espouses harmful white nationalist doctrine, it appears milder than, say, the neo-Nazi blog Daily Stormer, which houses headlines like “Europe Finally Beginning Ethnic Cleansing—Of Russians Tho”—and that’s one of the more mild ones. Other headlines include a dizzying array of racial slurs, while art for the website’s “Krypto Podcast” (which seems to cover a number of hateful topics that aren’t cryptocurrency-related) features a gorilla wearing a swastika armband.
Counter-Currents’ editor-in-chief, Greg Johnson, and the Daily Stormer’s founder, Andrew Anglin, aren’t outwardly buddy-buddy. Though their public disagreements seem to boil down to Johnson thinking Anglin isn’t doing a smart enough job of denying the Holocaust, according to a Counter-Currents post by Johnson, their relationship doesn’t suggest a financial connection.
The SPLC has been tracking bitcoin wallets connected to Counter-Currents and Johnson, as well as those connected to Andrew “weev” Auernheimer, a white supremacist hacker who, according to the SPLC’s website, “performs system administrator duties” for the Daily Stormer. The SPLC discovered that Counter-Currents has been sending bitcoin to Auernheimer, connecting the dots between the “milder” white nationalist site and one that blatantly professes neo-Nazi ideology. These are the sort of connections that the SPLC feels are key to unlocking the financial web that powers the alt-right movement. Both Counter-Currents and the Daily Stormer currently accept donations in bitcoin and Monero through their websites, while the former also takes payments in ether and Litecoin.
Donations to sites like these poured in immediately following the first, deadly Unite the Right rally in Charlottesville. John Bambenek, VP of security research and intelligence at cybersecurity firm ThreatStop, had been “poking around” alt-right members’ bitcoin wallets then, partly spurred on by the history of his native Illinois. “The part of the country where I live has some ties to white supremacy,” he told BREAKER. A second version of the Ku Klux Klan formed in the state in the 1920s, touting a platform of “morality” that excluded “African-Americans, Catholics, immigrants, and Jews.” Bambenek grew up in the 1970s, when neo-Nazis were fighting what was dubbed the “Skokie swastika war” to march through the predominantly Jewish Illinois community. (The Supreme Court ultimately allowed the march, but its leader called it off.)
Bambenek started assisting the SPLC with its research into alt-right bitcoin wallets in the fall after Charlottesville, and as he put it, “Transactions follow results, and Unite the Right one had a huge result.” These transactions were taking place more and more frequently through bitcoin, as payment platforms like PayPal and Stripe had started banning alt-right groups since Charlottesville thrust them and their supporters into the limelight.
In February 2018, the SPLC began publishing the bitcoin wallet activity of alt-right actors like the Charlottesville organizer Jason Kessler and head of the white supremacist think tank National Policy Institute, Richard Spencer. “In some ways we hurt ourselves,” said Beirich, “because they started moving their bitcoin out of those accounts or started investing in Monero and other online currencies where you can’t really see what’s going on.” Members of the alt-right also started tumbling their wallets, so they ended up looking “like this financial strudel, you can’t tease it apart,” said Beirich.
Tumbling wallets basically uses the same principle as tumbling clothes in a dryer. Bitcoin from separate wallets go through a coin-tumbling platform (like Bitcoin Laundry or Bitmix), where they get all mixed up. If enough different people are sending money and enough are receiving on the other end, tracking who received how much in payments from which person “becomes mathematically complicated,” said Bambenek, because of the jumbled journey those bitcoin went through between the sender and receiver.
Around the same time that the SPLC published the alt-right bitcoin wallets, a democratic congressman from Missouri who serves on the Financial Services Committee, Emanuel Cleaver II, sent letters to both The Bitcoin Foundation and the Chamber of Digital Commerce requesting that they start tracking and limiting cryptocurrency activity among “groups that wage campaigns of hate, abuse, anti-Semitism, discrimination, or violence.” Citing a “well-known white supremacist receiving over $1 million in bitcoin” (likely referring to Auernheimer) and Spencer’s tweet calling bitcoin “the currency of the alt-right,” Cleaver wrote to The Bitcoin Foundation’s chairman Brock Pierce, “It is clear that the corporate cryptocurrency community should take the necessary steps to deter these troubling activities.”
Responses from both groups were underwhelming, said a spokesperson from Cleaver’s office who talked to BREAKER. He called the letters “condescending.” Perianne Boring, the founder and president of the Chamber of Digital Commerce, essentially spelled out legal reporting obligations for financial institutions in her April reply to Cleaver, reminding the congressman that her group consists of “highly regulated financial institutions, unlike many of those referenced in your letter.”
Meanwhile, The Bitcoin Foundation published its own response to Cleaver’s letter in May, calling the issues he raised “misconstrued” and saying they never received the letter “addressed to Chairman Brock Pierce,” only learning about its existence during a March hearing held by the Subcommittee on Capital Markets, Securities, and Investment. Besides explaining the origins of bitcoin (“Nakamoto published a paper titled ‘Bitcoin: A Peer-to-Peer Electronic Cash System’ in October 2008…”), the foundation’s executive director Llew Claasen noted that bitcoin is decentralized, and therefore cannot be policed.
Claasen isn’t wrong. There is no central authority that can control who does and doesn’t use bitcoin, and Bambenek agrees that there isn’t much The Bitcoin Foundation or the Digital Chamber of Commerce can do about alt-right groups using the cryptocurrency for evil. However, Bambenek does propose an alternative.
While the bitcoin ecosystem is decentralized, the third parties needed to turn bitcoin into cash and vice versa are not. “There are very few places to do that in,” Bambenek said, “a couple hundred. If you want to put in screws to stop alt-right fundraising, you go to those places.” He floated the idea going to those exchanges and warning them, essentially, that the Department of Treasury and the IRS will be watching what alt-right groups and other extremists are doing on their platforms. If both of those groups start putting pressure on bitcoin exchanges to block hate groups, they might have a chance of cutting off yet another avenue of alt-right funding.
After Cleaver received what his spokesperson characterized as dismissive replies from The Bitcoin Foundation and the Chamber of Digital Commerce, he did turn to the Department of Treasury. In July, special counsel Robert Mueller indicted 12 Russian agents who were found to be using bitcoin to fund illicit activities that supported Trump, and therefore the views of many alt-right groups. This prompted Cleaver to turn to the Department’s financial crimes enforcement network to look into the nefarious use of cryptocurrency by hate groups, both at home and abroad. The Department of Treasury shared the Congressman’s concerns, said his spokesperson, but there’s been no word yet on any progress.
As various groups, like the government, the SPLC, and Bambenek attempt to untangle bitcoin transaction webs and stop hate groups from making use of cryptocurrency, the Daily Stormer published a defense of Wilson after his arrest, calling him a “brother in arms” and noting that “Cody was woven into Daily Stormer history when he launched Hatreon,” a Patreon ripoff that featured hate groups banned by the mainstream crowdfunding platform. Hatreon hasn’t been functional since February 2018—if you visit the site now, you’ll see a note that said Visa suspended its services in November 2017—but for a while that was a big contributor to Wilson’s cash flow. Though Wilson aligns more with anarcho-capitalism than the alt-right specifically, he sees no problem facilitating their causes and has been known to make racist comments.
Bambenek believes that Wilson’s movement of bitcoin after allegedly paying for sex with a minor is an effort to obfuscate his assets. Wilson’s financial assets, however, were already murky to begin with. “I’m not sure that we’ve ever been able to completely disentangle his personal bitcoin assets from stuff that’s moving around in Hatreon and going to others,” Bambenek said. “He’s operated as a PayPal of sorts to the alt-right, and that was not his money, per se, aside from what he’s gleaned from fees.”
On September 25, Wilson resigned from Defense Distributed, the company through which he published 3D printed gun blueprints and sold the “Ghost Gunner,” a machine that helps owners create their own guns at home out of metal. The company plans to run just as it did before Wilson made his exit, and it uses open-source software to process bitcoin payments, according to Bambenek. (He sent this link to the software.) The money from those wallets, Bambenek continued, are not directly going to Wilson but rather to the company, though Bambenek plans to dig deeper into Defense Distributed’s transactions.
Now that Wilson faces a maximum of 20 years in prison, a hero of the alt-right has been stymied. Meanwhile, the alt-right’s cryptocurrency donations have fizzled. The second Unite the Right, which took place this past August, attracted only 20 to 30 protestors while thousands of counter-protestors flocked to Washington, D.C. Between the two rallies, the alt-right had fallen into in-fighting, according to Bambenek, with some white supremacists calling Kessler “an FBI stooge, an idiot.” Others succumbed to paranoia after learning that bitcoin was not as anonymous as they’d originally thought—thanks, in part, to Bambenek’s Twitter bot that follows their transactions.
Some white supremacists and neo-Nazis have switched to Monero—accepted by the Daily Stormer and Counter-Currents—and other privacy coins to better obscure their financial activity. But while many white supremacist leaders are tech-savvy enough for adoption, their followers don’t necessarily have the same cryptocurrency know-how. A hacker and tech specialist, Auernheimer is well-versed in Monero—but so is Bambenek. The latter periodically looks into the Auernheimer’s privacy coin transactions and posted a bunch to the r/weev subreddit several months ago. They were quickly taken down, and Bambenek was banned from the subreddit. “Every now and then I just provoke weev because it’s funny,” he said.
Since Beirich said the SPLC hasn’t been able to track Monero movements, the organization is setting its sights on Coinbase and other cryptocurrency exchanges, essentially echoing Bambenek’s thoughts that centralized exchanges will be the most effective way to track and stop the alt-right’s cryptocurrency movements. Though Coinbase does not list Monero, Kraken and other exchanges, like Binance and Bitfinex, do.
So why continue to track alt-right payments? They’re seemingly disorganized, and have fewer platforms from which they can spew hate. “I think a certain sense of equilibrium has taken hold,” said Bambenek of their movement.
Take a look at the SPLC’s alt-right bitcoin wallet tracker. Suspect transactions continues to take place. Alt-right blog Fash the Nation regularly receives thousands of dollars worth of bitcoin that it subsequently distributes among a bunch of different wallets, leaving its own wallet empty. Auernheimer still receives bitcoin payments, and Anglin’s gotten paid in bitcoin nearly every day this past week.
As for Wilson, his $1 million worth of bitcoin didn’t just disappear. He moved it. And if he wants to turn it into fiat currency, he’ll have to move it again.