WARNING: STORY CONTAINS DISTURBING DETAILS
DORDRECHT, Netherlands — In the eight years he ran an online market selling images of violent child sexual abuse, Michael Mohammad made the equivalent of more than 100,000 euros. At his trial in May, while some of his victims listened, he told the judge: “It was purely business.”
The Dutch court sentenced Mohammad to 10 years in jail after convicting him of a litany of crimes. They included distributing thousands of photos and videos of child abuse, rape and bestiality via his website, Dark Scandals. He forced a dozen girls under the age of 16 to penetrate themselves and record it. He raped two of them and filmed it.
A new breed of company enabled his business: cryptocurrency exchanges. Mohammad’s customers used these platforms to buy digital tokens with dollars and euros, and spend them with relative anonymity. These tokens were the currency of Mohammad’s abuse. In all, transaction data reviewed by Reuters show, Dark Scandals’ customers used almost 50 different exchanges, including industry leaders Coinbase and Binance.
Coinbase told Reuters the exchange “is the wrong place to go if you’re trying to get away with a crime. We have a zero tolerance policy for anyone engaging in illicit activity like child sexual abuse material.” Binance said it cooperated with law enforcement to help take down Dark Scandals.
As a 26-year-old student, Mohammad turned to bitcoin in 2013 after PayPal blocked his newly launched website from its payment network. According to the judge, the payment provider objected to the website’s pornographic content. PayPal did not respond to requests for comment.
Stating “We love anonymity” on Dark Scandals’ homepage, Mohammad used crypto to build the site into one of the largest known marketplaces for illegal sexual imagery. He drew in customers on the “darknet” of illicit websites that are hidden from mainstream browsers.
Mohammad charged clients crypto worth up to 200 euros ($205) to download video “packs” made up of hundreds of clips. He also traded access to his collection for new videos — requiring that the bartered material depict acts that his website said were “forced against will.” He earned 115,000 euros in cryptocurrency from his clients, the court found, joining the growing numbers of criminals who facilitate and profit from online sexual abuse.
Mohammad was arrested in 2020 after an international investigation involving US and Dutch law enforcement. Authorities were able to track the crypto flows to Dark Scandals on the blockchain, the software that underpins cryptocurrencies by publicly recording the dates, value and digital wallet addresses of customer transactions.
However, users could still transfer funds to the site without detection if exchanges did not require them to provide any personal details. Many of the accounts Mohammad’s customers opened at eight different exchanges held either no personal details or fake ones, an assistant US attorney testified in a court submission.
“This anonymity promoted the success of the Dark Scandals sites,” wrote the assistant US attorney, Zia Faruqui, who helped oversee the investigation that led to Mohammad’s capture in the Netherlands. Mr. Faruqui didn’t identify the exchanges.
For this article, Reuters interviewed a dozen experts on sexual violence, current and former law enforcement officials involved in investigating child abuse, and several victims’ parents. To research Dark Scandals, which offers a rare window into offenders’ use of crypto, Reuters attended Mohammad’s four-day trial at a district court in the city of Dordrecht, where he and his victims gave hours of testimony.
“You have destroyed my life and ruined all the beauty I saw in it,” testified one girl he abused from the age of 14. Her statement was read out by her lawyer as the victim, now 18, stood alongside. “I will never forgive you for what you did.”
Naming him as “Michael M.,” the court sentenced Mohammad in June to 10 years in jail for producing and distributing child abuse images, and for sexually assaulting and raping underage girls. The US Justice Department identified Mohammad fully in 2020 when it unsealed an indictment against him. In an email to Reuters, his lawyer said Mohammad was wrongly convicted and would appeal, declining further comment.
Exchanges are key conduits in the roughly $1 trillion crypto industry, processing billions of dollars of transactions each day and earning revenue from trading fees, typically set around one percent. Their rapid growth has drawn scrutiny from regulators and law enforcement.
The US Justice Department, in a report this September, said many crypto exchanges still “make little or no effort to comply” with know-your-customer requirements. Europol, the European Union’s police force, warned in January that unregulated exchanges’ often “loose” client checks had helped digital currencies become the “payment of choice” for criminals operating online, including those selling child abuse material.
Coinbase let users transfer cryptocurrencies between digital wallets without submitting identification for at least two years after its 2012 launch, according to a 2014 investor presentation. Coinbase now requires all customers to verify their identities to open accounts. At Binance, which launched in 2017, clients could open accounts with just an email until mid-2021.
The sums involved in buying and selling images of sexual abuse remain small compared to other criminal activities, such as the drugs trade. But the figures are increasing. While in the past offenders typically traded child abuse imagery among themselves in small communities, the darknet has become a breeding ground for sites like Dark Scandals that charge in crypto. And the damage is far-reaching.
Researcher Chainalysis, used by US government agencies to track illegal flows, estimates that child abuse sites’ annual revenue in crypto leapt from around $250,000 in 2017 to almost $1 million in 2020.
Reuters reviewed Chainalysis data relating to transactions through Dark Scandals’ digital wallets. These data show that the site’s customers used 47 exchanges, of which the three most popular were Coinbase, Finland-based LocalBitcoins and Binance. Crypto worth a total of $22,000 moved through Coinbase and LocalBitcoins between 2013 and 2019. Some trade shifted to Binance and to another exchange called ShapeShift as other platforms tightened their identity checks. Binance and ShapeShift together processed about $3,400 until Dark Scandals closed in 2020, according to the data.
The sums of money involved fail to capture the gravity of the harm being done, according to the Internet Watch Foundation (IWF), a British child sexual abuse hotline which collects data worldwide.
The IWF says the annual number of webpages it has confirmed contain such images rose over four-fold from 2016 to over 250,000 last year. During that same period, the IWF found the number of commercial sites selling abuse imagery for virtual currency exploded to 1,014 from just 41. These sites often included links for users to pay via crypto exchanges, the IWF told Reuters, declining to name companies.
“For those people looking to make money from child sexual abuse, crypto has lowered the barrier,” said Dan Sexton, the IWF’s chief technology officer.
Coinbase’s vice president of global intelligence, John Kothanek, told Reuters that the exchange works closely with law enforcement on child abuse cases, alerts authorities to potential illicit activity and closes down accounts. Coinbase has “dedicated, around-the-clock compliance and investigative teams, access to sophisticated blockchain analysis tools, and a best-in-class process for identifying criminals,” he said in a statement, adding that crypto is easier to track than traditional currency.
“We will find you and hold you accountable — this has been the case since day one at Coinbase,” Mr. Kothanek said.
Binance’s global head of intelligence and investigations, Tigran Gambaryan, is a former US Internal Revenue Service agent who was involved in the Dark Scandals case. He said Binance and other exchanges provided records to the investigation team. “If not for crypto and the cooperation Binance provided, the individual behind the website would not have been identified,” Mr. Gambaryan said. LocalBitcoins and ShapeShift did not respond to requests to comment.
‘GAP IN THE MARKET’
Mohammad lived a double life.
In public, he appeared a normal young man, posting Instagram photos of himself at music festivals and dining out with friends. An ex-girlfriend, in an interview with investigators, knew him as “quiet and gentle.” On LinkedIn, he said he ran a marketing business called National Network that produced videos for corporate clients.
The company was a fiction, however. It was registered as the owner of DarkScandals.com, which Mohammad ran from the suburban town of Barendrecht, outside Rotterdam. He stored the site’s material — which ended up amounting to over 3,600 videos and images — on computers and hard drives at his small apartment.
Until US investigators alerted the Dutch to the site, his work remained a secret, even to his friends, the judge said at his trial.
Mohammad had lived in the area since 2006, when he returned to the Netherlands after almost a decade in Suriname. Born in Amsterdam, he testified at the trial that as a child his parents died violently. Following several years at an orphanage, he moved to the former Dutch colony to live with an uncle.
Back in the Netherlands, he said he accumulated debts while studying to become a social worker, though the judge noted he rarely attended class. In mid-2012, he saw a “gap in the market” and set up Dark Scandals. He hoped it would improve his “bad financial situation,” he testified.
Once launched, its homepage advertised “real blackmail, rape and forced videos of girls,” along with “sex videos of real schoolgirls” and “passed out teens.” The Dutch national prosecutor, Brechtje Lijnse, told the court the images were “aimed at the total humiliation of women.” She cited videos depicting underage girls being extorted into sexually abusing themselves and the rape of a child under the age of two.
“I have seen these images and they never let me go,” said Ms. Lijnse, who has spent a decade investigating child sexual abuse.
Mohammad curated this material into packages that users could download in return for a new video or a payment priced in bitcoin. The US indictment related how in December 2013 he rejected one uploaded clip, telling the provider in an email it was “just acted, we don’t accept video’s like that.” Mohammad signed the message, which was obtained by investigators, with the moniker “Dark.”
On the site’s forum, users praised his collection, referring to the girls and women it featured as “sluts” and “whores.” “Great stuff!” wrote one user in a 2012 thread about videos showing women being tortured.
PayPal cracked down on his customers’ payments, however, blocking Dark Scandals around a year after its launch, according to the Dutch court’s written judgement. PayPal did not respond to requests for comment.
PayPal and other financial firms had been working for years with nonprofit groups such as the US National Center for Missing & Exploited Children (NCMEC) to disrupt offenders’ attempts to use the firms to buy imagery. John Shehan, senior vice president of NCMEC’s exploited children division, told Reuters that as a result the financial industry largely “snuffed out” such activity on their platforms. Crypto, Mr. Shehan said, offered a new avenue.
While banks and payment platforms demanded more details from online merchants, many crypto exchanges for years requested little or no information from clients. Touting crypto as a tool to free people from government control of the financial system, some supporters rejected the idea that exchanges should collect substantial data on users.
Binance’s CEO Changpeng Zhao told staff in a 2020 video call that “people should have privacy (as) part of financial freedom.” The same year, Coinbase’s CEO Brian Armstrong said he expected so-called “privacy coins,” which are designed to be untraceable, to gain mainstream adoption as “it doesn’t make sense in most cases to broadcast every payment you make.” Erik Voorhees, founder of the ShapeShift exchange, wrote in a blog post last year, “Surveillance of all people cannot be our standard.”
Asked at his trial for his opinion of crypto, Mohammad noted, “Privacy is something that a lot of users value.”
Barred by PayPal, his clients began transferring bitcoin and another virtual token, ether, to him via four digital wallets. In the early years of the site, blockchain data show that many of these customers used the crypto exchanges Coinbase and LocalBitcoins to make their transfers. LocalBitcoins didn’t require customer identification until 2019. Once Binance launched in mid-2017, allowing customers to trade anonymously, it was used, too, along with ShapeShift. Mohammad traded the funds he received for euros at a Dutch crypto broker named Bitonic, he testified.
Bitonic said that while it couldn’t comment on an individual case “we can reassure you that if we have any indication that transactions are linked to crimes like trading child sexual abuse material, we immediately block these transactions, conduct further investigation and alert the authorities when appropriate.” Bitonic added that sometimes authorities may ask it to keep an account functioning in order to gather evidence “with the end goal that the suspect can be successfully convicted.”
Ms. Lijnse, the Dutch prosecutor, told the court that Mohammad’s shift to crypto marked the “professionalization of his crimes” as he sought to build his client base off the radar. By mid-2014, the site was already drawing over 13,000 unique visitors a week, she said.
On Reddit, a user gushed about Dark Scandals in a discussion about where to find child-abuse videos. “We real customers love that site!” the user wrote, linking to Dark Scandals’ darknet address.
One customer was a British man called Dale Lutkin, who lived in the northern English town of Hornsea with his wife and foster daughter.
For several years, Lutkin downloaded several thousand child abuse images from Dark Scandals and other sites, including a video of a 10-month-old infant being abused, court records show. Tipped off about Lutkin’s activity, British police officers visited his seaside home in 2018 and searched his laptop and hard drive.
As well as the downloads, officers discovered a video of Lutkin’s foster daughter covertly taken by a camera placed in a smoke detector in her bedroom, according to sentencing records. The footage showed the 14-year-old undressing and changing out of her school uniform.
Lutkin pleaded guilty and admitted to filming her for “sexual gratification,” the judge said in 2019 when sentencing him to a year and a half in jail. Social workers removed the girl from the home. Reuters was unable to reach Lutkin.
‘PIECES OF THE PUZZLE’
In early 2018, US law enforcement officials from the Internal Revenue Service and Department of Homeland Security were tracing crypto payments made to another child abuse website called Welcome To Video. The owner, a South Korean man, was jailed for 18 months by a Seoul court for violating child protection laws and then sentenced to a further two years for concealing the site’s proceeds from authorities. He admitted the allegations.
Investigators spotted that one of Welcome To Video’s clients had sent crypto to a digital wallet linked to a darknet site unknown to them: Dark Scandals. Chris Janczewski, then a special agent at the IRS’s cyber crimes unit, was shocked to see that Dark Scandals was selling videos of actual rapes.
“It just seemed unreal to realize that was a thing,” Mr. Janczewski told Reuters.
That February, undercover officers made a payment worth $25 in bitcoin to one of the Dark Scandals wallets and received a download link by email. The content they downloaded included two videos depicting minors being sexually abused, according to the US indictment.
Law enforcement then located and accessed Mohammad’s email account, which contained messages about payments to the site’s service providers. These providers were paid using a financial account in Mohammad’s name, the indictment said.
The investigators tracked payments made to Dark Scandals to more than 300 accounts at eight unnamed exchanges, the US prosecutor, Faruqui, said in a later request to recover funds these accounts held. Many customers used the accounts, opened with either no documents or “patently false” details between 2013 and 2020, solely to pay Mohammad, he wrote.
Mr. Janczewski, the former IRS agent, said the exchanges cooperated in turning over whatever information they held. A Coinbase spokesperson said the exchange worked with US authorities on the case, reporting around 300 users and closing their accounts. Binance too said it cooperated. Mr. Gambaryan, its investigations head, added that the “blockchain provides unparalleled transparency into illicit money flows.”
After the Americans alerted Dutch authorities to Dark Scandals, a police unit in The Hague began an investigation. While police monitored Mohammad, he continued to earn money: On February 8, 2020, a client used Binance to send him $200 in bitcoin, blockchain data shows.
A month later, police raided his home in Barendrecht and arrested him, seizing his computers, hard drives and iPhone. Ms. Lijnse, the prosecutor, got a call several days afterwards from officers who had been scouring his devices. Until then, investigators knew only that Mohammad had been soliciting child abuse material from others, Ms. Lijnse recalled in an interview. Now, police told her they also had found that Mohammad was sexually abusing underage girls.
On a hard drive, Mohammad stored 50 videos that recorded his chat and video calls with several dozen Dutch girls on Snapchat, WhatsApp and Instagram, his judgement said. Police found photos and videos of the same victims either posing naked or performing sex acts on themselves. Other videos, taken by a spy camera, showed him committing rape at his home.
Jacqueline Beauchere, global head of platform safety at Snapchat owner Snap, said the firm works with police, experts and industry partners to combat sexual abuse of children. “If we proactively detect or are made aware of any sexual content exploiting minors, we immediately remove it, lock the account, and report the offender to authorities,” she said. WhatsApp and Instagram owner Meta directed Reuters to a blog post detailing its policies on protecting teenagers from online harm.
Investigators identified 12 of the girls, aged between 11 and 15, from the videos. For each victim, they saw that Mohammad’s method was the same, Ms. Lijnse later told the court, reading from the messages and displaying some of the recordings.
Pretending to be a confident Dutch teenager called Rose, Mohammad befriended the girls on social media. After several months chatting, Rose messaged to say a boy was threatening to expose explicit photos of her or rape her. She told them she was so distressed that she was thinking about hurting herself. Rose said her aggressor would leave her alone if the girls did “an assignment,” typically by first sending the boy a semi-nude photo.
The girls agreed. They were desperate to help someone they thought was a friend in need, several later testified.
Once they sent the picture, Mohammad, often using the online alias SavageBoys, began making escalating requests, including that they penetrate themselves with objects in front of a webcam, Ms. Lijnse said. If the girls refused, he threatened to share images with their schools and families, or even kill them.
Mohammad abused many of his victims daily, and over several years. On recordings, they were heard crying and pleading. Mohammad was heard laughing. Ms. Lijnse said Mohammad forced two of the victims to repeatedly visit his home to rape them.
He recorded all his interactions with his victims, Ms. Lijnse told the court. He had “commercial plans with this material,” she said, though her investigators could not confirm how widely he had distributed it. “He turned women into disposable items as objects of lust,” she said.
Two months after Mohammad’s arrest, a Dutch mother of two living in The Hague received a phone call from police. It concerned her daughter, officers told the woman, inviting her to the station. It was this daughter who would later stand before the Dutch court as her lawyer read her victim statement.
She had known for months that something was wrong with her child. “I couldn’t put my finger on it,” she told Reuters, identified here only by her second initial, “S,” to protect her family’s privacy.
Her daughter’s behavior had changed drastically, though S put it down to teenage hormones and troubles at school. The teen regularly told S that she didn’t want to live any more, without saying why. S said she was afraid to come home and find her daughter dead.
At the police station, officers told S that Mohammad had started abusing her daughter two years earlier, when she was 14. After first contacting her on Instagram as his alter-ego Rose, Mohammad blackmailed her into making hundreds of videos, police said. On hearing this, S said she stopped breathing and felt the world come to a standstill.
“The pieces of the puzzle fell into place for me,” she said.
‘THE OTHER SIDE’
On May 2, S and her daughter travelled to Dordrecht, across the river from Barendrecht, to attend Mohammad’s trial.
They sat in the audience, along with other victims and their parents, separated from Mohammad by a glass wall. It was the first time the girl saw him in person. Each time he glanced toward the teen, she panicked and felt sick, S said. Her daughter and another victim held hands while the judge described the charges against Mohammad.
Mohammad told the court he set up Dark Scandals because he didn’t believe selling videos of sexual abuse was illegal. He considered it a “gray area” and an “opportunity to make money.” He denied the rape allegations, claiming video and audio evidence did not identify him.
His lawyer, Sjoerd van Berge Henegouwen, portrayed Mohammad as a victim. The attorney complained that Mohammad was upset that photos of himself, taken from his social media accounts, had been spread online before the trial. “The personal damage to my client is enormous,” the lawyer said. While a court sketch artist worked, Mohammad tried to conceal his face with a sheet of paper.
On the second day, victims and parents testified about the impact of Mohammad’s operation. S’s daughter entered the courtroom with her lawyer, Priya Soekhai. In a statement read by Ms. Soekhai, the teen said she hardly dared to sleep any more because of the nightmares she suffered. She was eating almost nothing. She couldn’t trust men, and struggled even to look at them.
“I’ll never be the same person I used to be,” she said. “I hope you never dare do this to girls and women again.”
The teenage victim sitting next to her spoke next. After one of the videos she sent Mohammad circulated on Instagram, she said she was harassed and “called a whore” because people thought she made it voluntarily. “No one believed me,” she said. She often thought about taking her own life during the abuse, which began when she was 14. “I couldn’t do it because of my family who I would leave behind,” she said.
A month later, the court reconvened for the verdict. The chief judge, Paul Putters, ordered Mohammad to spend a mandatory period of psychiatric treatment and secure confinement after a 10-year jail term. Mohammad walked out without a word. S’s daughter and the other victim hugged each other.
Afterwards, in an interview alongside her daughter, S said the teenager, now 18, wanted to put the case behind her and focus on school. She planned to train to become a police officer to investigate abuse cases like her own.
S, however, doesn’t see the case as closed. Her greatest fear, she said, is that her daughter’s footage had been resold and would appear again, restarting the nightmare. She wants police to identify the Dark Scandals customers who used cryptocurrency to pay for the abuse videos. Ms. Lijnse told Reuters her team is looking into this.
Law enforcement officials and researchers told Reuters that crypto exchanges remain a vital payment tool. The IWF received more reports last year of websites selling child abuse imagery for crypto than any year prior. Though most major exchanges now proactively help authorities to track down suspects, the IWF’s Mr. Sexton said offenders are always looking for the weak spot and simply hop to platforms with looser controls.
“People think bitcoin is just a fun way to make money,” S said. “They don’t know the other side.” — Reuters