The CSAM Buyer Who Ran Bohemia's 12 Million Euro Drug Empire

Conservatively 90% of Dark net market admins will exit scam and rob everyone. Throughout the years I have seen a small portion of them do something even worse. Bohemia launched on October 12, 2021, when its administrators posted their Official Market Announcement on Dread.

The marketplace offered everything darknet buyers expected: drugs, fake identification documents, DDoS-for-hire services, and malware, all purchasable with Bitcoin or Monero through a centralized escrow system. By September 2023, Bohemia processed 67,000 transactions monthly and generated 12 million euros in revenue, serving 82,000 advertisements daily across the globe. The Netherlands alone accounted for over 20,000 orders from Dutch vendors.

Finlay H., a British national, joined the operation in late 2022 according to Dutch police. He was seventeen years old. His technical skills earned him rapid promotion through the organization, and by 2023 he held partner status with full administrative access to Bohemia's infrastructure. Dutch prosecutors now want him locked up for three years, and the drug trafficking charges are the least disturbing part of his case file.

Police discovered child sexual abuse material on his Telegram account. They found CSAM on his device and evidence he paid for such material with bitcoin between September 2023 and February 2024. During the same months Bohemia hit peak revenue, during the same months Finlay H. helped execute an exit scam that robbed vendors of their deposits, he spent his cryptocurrency buying images of child exploitation. Dutch authorities found the payment records in his Telegram chat logs.

The exit scam unfolded publicly on Dread. On November 17, 2023, HugBunter, Dread's owner and administrator, locked the /d/Bohemia subdread and posted a megathread warning users to avoid the marketplace after vendors reported large missing Monero withdrawals and deposited funds became inaccessible. HugBunter wrote that he locked the subdread "for user safety, while things are unclear and issues still persist."

The administrators blamed a "rogue developer" for the problems. They claimed an insider had stolen funds over several weeks and announced plans to temporarily disable Bitcoin withdrawals while migrating users to Monero. On November 18, HugBunter updated the megathread saying he'd made contact with "Admin" and felt "a little more confident in things being resolved." Admin promised a "full transparent announcement" on Dread for November 19, 2023. By November 22, vendors with large missing XMR withdrawals were being told to contact HugBunter directly so he could pass their cases to Admin for prioritization.

The transparent announcement never materialized into restored funds. The administrators divided whatever remained among themselves and shut down operations permanently, leaving thousands of vendors and buyers with empty wallets and no recourse. The centralized escrow system that made Bohemia convenient also made it trivially easy for administrators to steal everything when they decided to exit.

Dutch police had monitored the operation since late 2022, when investigators discovered Bohemia's servers running partially on Dutch infrastructure in Dronten. They traced Finlay H. through the server data and waited. On June 27, 2024, when he flew into Schiphol Airport in Amsterdam, police arrested him on arrival. His laptop and phones contained incriminating evidence of his role in Bohemia, along with access keys to Bitcoin wallets holding 31 BTC worth approximately 1.7 million euros at the time of seizure. He was twenty years old at arrest and turned twenty-one by his December 2024 hearing.

The devices also contained the Telegram logs showing evidence of his child abuse material purchases.

His Irish partner fared no better. Kevin Daniel Andrei, 23, was arrested in Dublin by Ireland's Garda National Cyber Crime Bureau in August 2024. He faces charges for money laundering 14 million euros in cryptocurrency proceeds through 1,822 Revolut transactions and 422 Binance transactions. Authorities seized 6.5 million euros in cryptocurrency during his arrest. Andrei's charges focus exclusively on the financial infrastructure: money laundering and cryptocurrency exchange violations related to processing the marketplace's drug proceeds.

The two administrators followed different criminal paths. Andrei allegedly laundered drug money through cryptocurrency exchanges and traditional payment platforms, the standard financial operations for darknet marketplaces. Finlay H. bought child exploitation material while simultaneously robbing the criminals who trusted him with their deposits. Laundering drug proceeds represents calculated financial crime. Purchasing images of children being abused represents something entirely different about moral boundaries crossed.

Dutch prosecutors demand three years imprisonment for Finlay H. plus forfeiture of his 31 bitcoins. The Rotterdam court will deliver its verdict approximately two weeks from his December 2024 hearing. Three years seems light for someone who administered a 12 million euro monthly drug operation, helped execute an exit scam, and collected child abuse images, but Dutch sentencing guidelines operate differently than American ones.

That said, I think it's worth noting that the vast majority of darknet market admins end up robbing people in the end. It seems also like a disproportionate amount of them are also sick weirdos as this seems to be a reoccurring theme when they get arrested when they get arrested for some.

Dutch police identified the servers, traced the administrator, and coordinated with Irish, British, and American counterparts. The combined seizure exceeded 8 million euros in cryptocurrency across both arrests. The investigation ran for nearly two years before the arrests, building evidence through server analysis and financial tracking. That said there's no hard discussion about how things were actually done in a specific way. Much of the time many of these investigations hinge on fringe and foolish mistakes made by the administrators. I would have no doubt that this is the case for this market as well.

Bohemia's fall also shows the fundamental vulnerability in darknet market architecture. Administrators who control centralized escrow can steal from users whenever they choose. Bohemia offered a sleek user interface, flexible cart system, merchant statistics, automated deposits and withdrawals, and 24/7 support, but all those features meant nothing when the people running the escrow decided to take everything. The "rogue developer" story gave Bohemia's operators cover while they drained accounts, and the promise of a "full transparent announcement" bought time while funds disappeared.

For the vendors and buyers who lost money when Bohemia collapsed, the CSAM revelation adds a nauseating coda to their losses. Their deposits funded both the administrators' lifestyle and, in at least one administrator's case, the purchase of child exploitation material. Every transaction through Bohemia contributed to the commission structure that put bitcoin in Finlay H.'s wallet.