{
  "id": "case-ross-ulbricht-silkroad",
  "slug": "us-v-ross-ulbricht-silk-road",
  "title": "U.S. v. Ross Ulbricht (Dread Pirate Roberts / Silk Road)",
  "summary": "Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.",
  "case_number": "1:14-cr-00068",
  "court": "U.S. District Court for the Southern District of New York",
  "district": "S.D.N.Y.",
  "country": "United States",
  "opened_at": "2014-02-04",
  "status": "sentenced",
  "victim_sector": "Public Safety, E-Commerce, Controlled Substances",
  "victim_country": "United States, Worldwide",
  "loss_amount_usd": 213000000,
  "loss_amount_note": "Generated $213 million in total sales and $13 million in commissions across 1.5 million transactions.",
  "first_seen_at": "2011-01-01T00:00:00Z",
  "last_updated_at": "2026-06-10T12:00:00Z",
  "actor_slug": "silk-road",
  "defendant_slugs": [
    "ross-ulbricht"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1090",
      "evidence_excerpt": "Ulbricht built Silk Road as a hidden service on the Tor network to conceal server IP addresses and protect buyer and seller anonymity.",
      "evidence_locator": "Indictment \u00b6 8, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Ulbricht",
      "source_url": "https://www.justice.gov/usao-sdny/pr/ross-ulbricht-creator-and-operator-silk-road-website-sentenced-manhattan-federal-court",
      "technique_name": "Proxy",
      "tactic": "Command and Control"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2013-10-01",
      "description": "Ulbricht arrested in the Glen Park branch of the San Francisco Public Library by FBI agents while logged into the Silk Road admin panel."
    },
    {
      "event_type": "verdict",
      "event_date": "2015-02-04",
      "description": "Jury finds Ulbricht guilty on all seven felony counts including narcotics conspiracy and computer hacking."
    },
    {
      "event_type": "sentencing",
      "event_date": "2015-05-29",
      "description": "Sentenced to two life terms of imprisonment plus 40 years without parole and ordered to forfeit $183 million."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Unauthorized intrusion originating from targeted infiltration directed against Public Safety, E-Commerce, Controlled Substances networks. Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.",
    "blast_radius": "Generated $213 million in total sales and $13 million in commissions across 1.5 million transactions. Impacted Public Safety, E-Commerce, Controlled Substances infrastructure and associated victim operations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Infiltration",
        "title": "Perimeter Ingress",
        "description": "Operatives secured access to victim infrastructure within the Public Safety, E-Commerce, Controlled Substances sector.",
        "technical_artifacts": [
          "Network perimeter logs"
        ],
        "mitre_technique_id": "T1190"
      },
      {
        "phase": "Phase 2: Execution",
        "title": "Payload Deployment",
        "description": "Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.",
        "technical_artifacts": [
          "Malicious payload"
        ],
        "mitre_technique_id": "T1486"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.",
      "Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.",
      "Maintain isolated, immutable backups of critical directory services and transaction databases.",
      "Deploy real-time endpoint detection and response (EDR) agents with automated containment policies."
    ]
  }
}