US charges suspected Dream Market admin arrested in Germany

At a glance:

• Owe Martin Andresen, 49, indicted in US for money laundering as alleged admin of Dream Market.
• Dream Market was a major dark web marketplace handling drugs and services before shutting down in 2019.
• Andresen arrested in Germany; US authorities recovered gold bars and millions in assets linked to the marketplace.

The Indictment and Arrest

Owe Martin Andresen, a 49-year-old Norwegian national, was charged by a federal grand jury in the United States on Wednesday with six counts of international concealment money laundering and six counts of concealment money laundering. Each count carries a maximum penalty of 20 years in prison. Andresen was arrested in Germany under separate charges related to concealment money laundering, which also carry up to five years per count. The Department of Justice (DOJ) announced the indictment, highlighting the transnational nature of cybercrime investigations and the ongoing efforts to dismantle dark web operations.

Andresen is alleged to have operated under the "Speedstepper" handle, the main administrator of Dream Market, a role never previously identified despite earlier prosecutions of other high-ranking operators. His arrest in Germany followed a coordinated international law enforcement effort, with German authorities acting on information provided by US agencies. The case underscores the persistent reach of US law enforcement into global cybercrime networks, even when suspects are beyond domestic borders.

Dream Market's Rise and Fall

Dream Market launched in November 2013, providing anonymous access to illegal items and services on the dark web. It rapidly grew to become one of the largest such marketplaces, especially after the seizure of competitors Hansa and AlphaBay. At its peak, Dream Market hosted close to 100,000 listings at any given time, facilitating a vast array of illicit trade. The platform's infrastructure allowed vendors and buyers to transact using cryptocurrencies, obscuring financial trails and enabling widespread criminal activity.

The DOJ detailed the scale of illegal goods sold through Dream Market, which included more than 450 kilograms of cocaine, 90 kilograms of heroin, 45 kilograms of methamphetamine, 25 kilograms of crack cocaine, 13 kilograms of oxycodone, and 36 kilograms of fentanyl. These operations continued until the marketplace's shutdown in 2019, when law enforcement disruptions and exit scams led to its demise. Dream Market's closure marked a significant victory for international cybercrime units but also highlighted the resilience of dark web ecosystems as new platforms emerged to fill the void.

Alleged Money Laundering Activities

Prosecutors allege that Andresen accessed dormant Dream Market cryptocurrency wallets containing millions of dollars in commission payments in November and December 2022. He moved these funds into new wallets, an activity requiring possession of the marketplace's original private keys—a capability limited to a select few. This suggests Andresen maintained control over critical assets long after the platform's shutdown, exploiting dormant funds for personal gain.

Months later, in August 2023, Andresen used a cryptocurrency service provider based in Atlanta, Georgia, to purchase gold bars from international companies. He directed these companies to ship the gold bars to his home address in Germany, using funds from the consolidated wallets. "German law enforcement identified additional money laundering transactions committed by Andresen in Germany," the DOJ stated. In total, he is alleged to have laundered over $2 million between August 2023 and April 2025, converting digital assets into physical gold to evade detection.

Asset Recovery and International Cooperation

On May 7, 2026, German authorities conducted searches at Andresen's residence and two other locations. They recovered approximately $1.7 million in gold bars, allegedly purchased with Dream Market funds, along with more than $23,000 in cash. Investigators also seized evidence from bank accounts and cryptocurrency wallets holding approximately $1.2 million in suspected Dream Market proceeds. This recovery demonstrates the effectiveness of cross-border collaboration in tracing and confiscating illicit assets, even when obfuscated through multiple transactions and jurisdictions.

The operation involved close coordination between US agencies, including the FBI and IRS-Criminal Investigation, and German law enforcement. Such partnerships are crucial in combating cybercrime, as dark web operators often exploit legal and geographic gaps. The seizure of physical gold bars, in particular, highlights a common money laundering tactic—converting digital currencies into tangible assets to avoid electronic monitoring.

Other Dark Web Prosecutions

Andresen's case is part of a broader crackdown on dark web administrators. Other high-ranking Dream Market operators who used the monikers "Oxymonster" and "KITT3N" were previously convicted following US-led prosecutions. A mid-level admin responsible for customer service, operating as "GOWRON," was convicted by the United Kingdom Crown Prosecution Service. These prosecutions illustrate the layered approach law enforcement takes, targeting leaders, technical experts, and support staff alike.

Recent years have seen similar actions against other major dark web markets. The owner of Incognito Market, linked to over $105 million in illegal drug sales, was sentenced to 30 years in prison. Additionally, a Virginia man who co-created Empire Market pleaded guilty to drug conspiracy charges for facilitating $430 million in illegal transactions. These cases reflect a sustained focus by global authorities on disrupting online narcotics distribution and money laundering networks, with significant prison sentences serving as deterrents.

Implications for Dark Web Enforcement

The indictment of Andresen reinforces the long memory and reach of law enforcement in pursuing dark web criminals. Even years after a platform's shutdown, administrators can remain targets if they attempt to exploit residual assets. The use of cryptocurrency service providers in conventional financial systems, such as purchasing gold bars, shows how cybercriminals blend digital and traditional methods, creating vulnerabilities that investigators can exploit.

For the security industry, this case underscores the importance of blockchain analysis and international cooperation in tracing illicit funds. As dark web markets evolve, so too must the strategies to combat them, including monitoring cryptocurrency flows and collaborating with global partners. The ongoing prosecutions also serve as a warning to current and aspiring dark web operators about the persistent risks of identification and prosecution, potentially disrupting the ecosystem's stability.

Conclusion

As the alleged mastermind behind Dream Market, Andresen's prosecution highlights the enduring commitment of US and international law enforcement to dismantle cybercriminal enterprises. The recovery of millions in assets and the continued pursuit of dark web figures signal that no matter how sophisticated the anonymity tools, legal accountability remains a potent force. This case adds to a growing body of precedents that shape the future of cybercrime investigation and asset forfeiture.

Glossary

• Dark Web: A part of the internet accessible only through special software like Tor, often used for illicit activities.
• Money Laundering: The process of making illegally gained proceeds appear legal.
• Cryptocurrency Wallets: Digital tools used to store and manage cryptocurrencies like Bitcoin.
• Private Keys: Cryptographic keys that allow access and control over cryptocurrency funds.
• Exit Scam: A fraud where operators of a marketplace disappear with users' funds.