On 8 May 2019, the United States Department of Justice announced the indictment of two alleged DeepDotWeb operators. The website had acted as a directory and referral gateway to darknet marketplaces. Prosecutors said the operators received cryptocurrency kickbacks when users followed links and completed purchases of illegal goods. The site was seized by court order at the same time.
What the indictment alleged
The indictment named Tal Prihar, an Israeli citizen living in Brazil, and Michael Phan, an Israeli citizen living in Israel. According to the DOJ announcement, the pair allegedly operated DeepDotWeb from around 2013 and received referral payments in bitcoin. The marketplaces linked from the site offered narcotics, firearms, malicious software, stolen payment information and other contraband.
The alleged mechanism was simple but significant. Darknet markets commonly required a precise onion address, while DeepDotWeb collected links and directed visitors to them. When a referred customer bought something, the marketplace paid a percentage to a wallet controlled by the site’s operators. Prosecutors said the defendants moved those payments through additional bitcoin addresses and shell-company bank accounts to conceal their source.
Why this was an infrastructure case
Authorities had previously targeted individual marketplaces and vendors. DeepDotWeb presented a different theory of disruption: attack the traffic and referral layer that helped users discover markets that ordinary search engines did not index. The DOJ described the seizure as a strike against infrastructure supporting illicit commerce, while also emphasizing that an indictment contained allegations only.
The legal record later changed. In 2021, Prihar pleaded guilty to conspiracy to commit money laundering. The 2022 DOJ sentencing release said he received more than eight million dollars in kickbacks, agreed to forfeit $8,414,173 and was sentenced to 97 months in prison. Phan remained abroad and was subject to extradition proceedings at that time.
Reading the cryptocurrency angle accurately
Bitcoin did not make the scheme anonymous in the absolute sense. The investigation followed wallet movements, shell-company relationships and cooperation between agencies in several countries. The case illustrates a more limited point: pseudonymous payment records can still be evidence when investigators connect addresses to people, services and off-chain transactions.
It also shows why a historical article should separate accusation, plea and sentence. The 2019 headline concerned charges and a seizure; later filings supplied admissions and a punishment for one defendant. Those stages should not be collapsed into a single claim about both men or about every site that discussed darknet markets.
DeepDotWeb was not a blockchain protocol. It was a web business whose referral model allegedly converted traffic into cryptocurrency payments for illegal-market transactions.
The case remains useful for readers studying cybercrime, platform liability and cryptocurrency tracing. Its durable subject is the connection between an online directory, referral economics, virtual-currency wallets and traditional money-laundering controls—not a claim that digital assets erase jurisdiction or investigative evidence.
Any future update should preserve the same chronology and identify which statements come from an indictment, a plea agreement or a sentencing memorandum. That discipline is especially important in cross-border cybercrime cases, where a seized domain, an arrested administrator and a final judgment are separate events with different evidentiary status.
