Empire Market co-founder Raheim Hamilton sentenced to 40 years for the $430M darknet marketplace

Executive Summary

On Monday, October 5, 2026, U.S. District Judge Steven C. Seeger sentenced Raheim Hamilton, 30, of Suffolk, Virginia, to 40 years in federal prison and fined him $5 million for co-creating and operating Empire Market, a Tor-based darknet marketplace that between February 2018 and August 2020 became one of the largest of its kind. The U.S. Attorney's Office for the Northern District of Illinois announced the sentence on October 7, 2026.¹ Hamilton had pleaded guilty in Chicago on January 26, 2026 to a single count of drug-distribution conspiracy; his co-creator, Thomas Pavey, 41, of Ormond Beach, Florida, pleaded guilty in 2025 and is awaiting sentencing before the same judge later in October 2026.¹²

Empire Market was a hidden service reachable only through the Tor network and settled exclusively in cryptocurrency.³⁴ By the time it went dark on August 22, 2020 it had roughly 1,681,429 registered users, 5,002 vendors and had processed about 4,003,803 transactions worth approximately $432,951,570 in net sales, making it one of the largest darknet markets of its kind at the time.³⁵ Vendors sold controlled substances, stolen and compromised account credentials, stolen payment-card data and personal information, counterfeit U.S. currency, and hacking tools including exploit kits, ransomware and "crypters."³⁴ Drugs were the dominant trade — about 2,750,712 drug transactions totalling roughly $374 million, including, as relevant conduct, at least 13,314 grams of fentanyl, 446,683 grams of cocaine, 103,396 grams of heroin and 71,992 grams of methamphetamine.¹³ Hamilton and Pavey skimmed a portion of every cryptocurrency transaction and employed moderators to settle disputes.³

The investigative spine of the case is a reused identity. Before Empire, Pavey ("Dopenugget") and Hamilton ("ZeroAngel") ran a counterfeit-currency operation on AlphaBay from June 2016 until that market was shut down by law enforcement in July 2017; on AlphaBay Pavey used his own encryption key to publicly vouch for "ZeroAngel" as his authorised retailer, cryptographically tying the two personas together.⁴⁶ When they built Empire they advertised it, at Hamilton's direction, as an AlphaBay "clone," and Hamilton administered it under the screen name "Sydney."³ The prosecution was led by Homeland Security Investigations New York — home of the El Dorado Task Force, the government's flagship money-laundering unit — with the FBI and U.S. Postal Inspection Service in Chicago; agents seized cryptocurrency valued at about $75 million at the time of seizure, along with cash and precious metals.⁶⁷ Despite Empire's own in-site advice to "tumble" coins so that "a determined investigator" could never trace them, Hamilton forfeited roughly 1,230 bitcoin and 24.4 Ether and three Virginia properties; Pavey forfeited about 1,584 bitcoin and gold bars.³⁴

Why it matters: the 40-year term is among the longest ever imposed on a darknet-market operator, and the record is a case study in how pseudonymous market tradecraft — Tor, crypto-only settlement, mixing services, encrypted messaging and "stealth" packaging — breaks down against reused handles, cryptographic self-endorsement, identity-verified exchange and banking rails, and blockchain tracing. It also exposes a recurring reporting gap: the August 2020 shutdown is near-universally described as an "exit scam," a characterisation the prosecution record never adopts.

Verification of Claims

1. Claim: Hamilton was sentenced to 40 years and fined $5 million. → Verified → The Northern District of Illinois stated that on Monday (October 5, 2026) Judge Steven C. Seeger "sentenced Hamilton to 40 years in federal prison and fined him $5 million."¹

2. Claim: Empire Market handled ~4 million transactions worth ~$430 million. → Verified → Hamilton's plea agreement admits approximately 4,003,803 transactions and net sales of approximately $432,951,570.47, of which roughly $374,069,309.81 was controlled-substance sales across about 2,750,712 drug transactions.³ The indictment and DOJ releases use the rounded "more than four million transactions … more than $430 million."¹⁴

3. Claim: Hamilton is "ZeroAngel," who sold counterfeit currency on AlphaBay. → Verified → The superseding indictment charges that Hamilton used the username "ZeroAngel" on AlphaBay and that Pavey ("dopenugget") used his encryption key on June 21, 2016 to endorse "ZeroAngel" as his authorised retailer; Hamilton's plea agreement repeats that he "used the name 'ZeroAngel' on AlphaBay" and that Empire was advertised as an AlphaBay "clone."³⁴

4. Claim: Hamilton forfeited approximately 1,230 bitcoin and 24.4 Ether. → Verified → Summing the wallets itemised in the plea agreement — 55.84957653, 180.18680571, 7.94359639, 0.10187733, 0.12656229 and 986.18168774 bitcoin — yields about 1,230.4 BTC; the two Ether entries (24.31293164 and 0.10678391) total about 24.4 ETH. Three Virginia properties and numerous devices are also forfeited.³ The DOJ releases state the same rounded totals.¹²

5. Claim: Empire Market's operators pulled an "exit scam" in August 2020. → Partially verified → The site did cease operating around August 22, 2020 with user funds stranded in escrow, and vendors and analysts labelled it an exit scam.⁸ But contemporaneous reporting attributed the collapse to an extortion-driven DDoS campaign and said the operators' intent was never confirmed, and the federal prosecution record charges operation only "until on or about August 22, 2020" without ever charging or characterising an exit scam.⁴⁸

6. Claim: Empire Market began/was founded in 2017. → Partially verified → The superseding indictment and Hamilton's plea charge the drug, access-device, counterfeiting and money-laundering conspiracies as "beginning in or about August 2017," and say the pair "agreed to create" Empire around then.³⁴ But the same documents state the marketplace itself launched on February 1, 2018; secondary coverage consistently gives February 2018.³⁴⁹ The 2017 date is the planning/agreement phase (following AlphaBay's July 2017 shutdown), not a live 2017 market.

7. Claim: Investigators have disclosed exactly how the operators were de-anonymised. → Unverified → The charging documents and plea reveal the evidence the government assembled — AlphaBay vendor records, a cryptographic self-endorsement linking the two handles, identity-verified exchange and bank accounts, undercover buys, and traced-and-seized cryptocurrency — but neither DOJ nor HSI has publicly stated which lead first tied the pseudonyms "Dopenugget," "ZeroAngel" and "Sydney" to Pavey's and Hamilton's legal identities.³⁴⁷

Timeline

Operation Anatomy

The AlphaBay precursor and the linkage that mattered

From June 15, 2016 until AlphaBay closed on July 5, 2017, Pavey manufactured counterfeit U.S. currency and Hamilton resold it: the indictment alleges Hamilton paid a vendor bond, built listings as "ZeroAngel," and made more than 2,700 counterfeit-currency sales, while Pavey — "dopenugget" — publicly identified Hamilton as his "authorized retailer."⁴ The decisive piece of tradecraft is in overt act 13(g): on June 21, 2016 Pavey "used his encryption key to endorse a message on AlphaBay's forum" vouching that "ZeroAngel" was trustworthy and sold his notes.⁴ That cryptographic self-endorsement bound the two personas to one another in a way that survived AlphaBay's shutdown, because the market's seized records preserved the forum posts, messages and transaction history. Both men also funded their activity through identity-linked rails: the indictment notes Pavey used a bank account and a cryptocurrency-exchange account to buy virtual currency, and Hamilton used a separate exchange account.⁴

Building Empire as an AlphaBay clone

Beginning around August 2017 the pair agreed to create Empire Market, which went live on February 1, 2018 and which Hamilton directed be advertised as an AlphaBay "clone."³⁴ Empire was a hidden service: it "could not be searched for or located on the Internet like a traditional online store," and required Tor plus the site's ".onion" address.⁴ Hamilton administered it under the screen name "Sydney" from March 11, 2018.⁴ The storefront was organised into categories — "Fraud," "Drugs & Chemicals," "Guides & Tutorials," "Counterfeit Items," "Carded Items" and "Software & Malware" — with drug sub-categories down to "Heroin," "Meth" and "OxyCodone."³⁴

Marketplace mechanics: bonds, escrow, Autoshop, moderators

Vendors paid a cryptocurrency vendor bond and attested to accurate listings; rule-breakers could be removed by the administrators.⁴ Buyers deposited funds and settled in cryptocurrency only — no cards — and rated vendors on criteria including "stealth," how well drugs were concealed in shipping.³⁴ A homepage "Autoshop" feature automated the bulk sale of stolen card data and account credentials, searchable by criteria such as geographic location.⁴ Hamilton personally handled dispute resolution at times and supervised a group of about five paid moderators.³ The administrators paid themselves by retaining a portion of the cryptocurrency flowing through every sale.³

Anti-law-enforcement design and laundering

Empire was, in the plea's own heading, "designed to hide its creators and users from law enforcement."³ It forced crypto-only settlement, promoted encrypted messaging, and ran "stealth" ratings; by October 2018 the site itself advertised that tumbling coins "for a small fee (normally 1-3%)" would "ensure that you will never be traced back to here," while conceding that otherwise "a determined investigator can trace you back to this Empire."⁴ Hamilton admitted using mixers and tumblers to launder his own earnings and discussing further laundering techniques.³

How it unravelled

The record documents several converging threads rather than a single published break. Law enforcement had AlphaBay's seized vendor data (the granular 2016–2017 messages and the 2,700-sale count in the indictment reflect that corpus) and the cryptographic "dopenugget"/"ZeroAngel" linkage.⁴ Between April 16, 2019 and May 1, 2020 agents made undercover purchases on Empire (at least 143.5 g of methamphetamine and 105.4 g of heroin), bought counterfeit $20s and a ~590,000-account database from vendors, and on August 10, 2020 intercepted a 443.5 g methamphetamine package addressed to Chicago — anchoring venue in the Northern District of Illinois, where a named counterfeit-currency customer also resided.³⁴ HSI New York's El Dorado Task Force, a money-laundering specialist unit, led the financial tracing, and blockchain-analytics mapping of Empire's flows showed incoming exposure from mainstream exchanges and outgoing exposure to mixers and unhosted wallets; despite Empire's tumbling, the government traced and seized roughly 1,230 bitcoin and 24.4 Ether from Hamilton (and about 1,584 bitcoin from Pavey), seizing wallets and devices on December 21, 2022 and more bitcoin on May 30, 2023.³⁷¹⁰ What the public record does not state is which lead first converted the pseudonyms into legal names.

Accused

Name: Raheim Hamilton, 30, of Suffolk, Virginia Aliases: "Sydney" and "ZeroAngel" (also rendered "Zero Angel" in DOJ press releases)¹⁴ Case: United States v. Pavey and Hamilton, No. 22 CR 323, U.S. District Court for the Northern District of Illinois, Eastern Division, before Judge Steven C. Seeger Status: Convicted by guilty plea. Hamilton pleaded guilty on January 26, 2026 to Count Two, conspiracy to distribute controlled substances (21 U.S.C. § 846), and was sentenced on October 5, 2026 to 40 years and a $5 million fine.¹³²

Hamilton was charged in a five-count superseding indictment (returned June 13, 2024) with conspiracy to distribute counterfeit currency (18 U.S.C. § 371, Counts One and Four), drug-distribution conspiracy (21 U.S.C. § 846, Count Two), conspiracy to possess fifteen or more unauthorised access devices (18 U.S.C. § 1029(a)(3), Count Three) and money-laundering conspiracy (18 U.S.C. § 1956(h), Count Five).³⁴ He pleaded guilty to Count Two; the government agreed to move to dismiss the remaining counts at sentencing.³ His admitted relevant conduct produced an anticipated offence level of 45 and an advisory Guidelines range of life; the statutory floor was a 10-year mandatory minimum and the ceiling life.³ His only criminal-history point came from an April 2016 petit-larceny conviction in Suffolk County, Virginia.³

Co-defendant: Thomas Pavey ("Dopenugget"), 41, of Ormond Beach, Florida, co-created and co-administered Empire Market, pleaded guilty to a drug-conspiracy charge in 2025, faces the same statutory maximum, and is awaiting sentencing before Judge Seeger later in October 2026. Pavey agreed to forfeit approximately 1,584 bitcoin, two boxes of 25-ounce gold bars, three automobiles and two Florida properties.¹²

Attribution and naming basis: Both men are named because they are charged and convicted by their own guilty pleas and admissions; the pseudonym-to-identity mapping is established by the indictment and the signed plea agreement, not by press attribution.³⁴ This is a prosecution of named individuals, not a tracked threat group.

MITRE ATT&CK: No ATT&CK table is provided. ATT&CK's enterprise matrix models intrusions against victim networks; an illicit-marketplace operator prosecution does not map cleanly onto it, and forcing technique IDs would misrepresent the conduct. The operators' relevant tradecraft was operational anonymity and laundering rather than network intrusion: a Tor hidden service, cryptocurrency-only settlement, coin mixing/tumbling, encrypted messaging and "stealth" packaging, all described in the Operation Anatomy above.³⁴

Technical Indicators

# No file hashes, IP addresses, C2 domains or the Empire .onion address were
# published by DOJ or in the court record reviewed. What follows are named
# aliases, infrastructure characteristics and seized-wallet labels from the
# primary filings. These are identity/forensic artefacts, not network IOCs.
aliases:
  thomas_pavey:
    - 'Dopenugget'
  raheim_hamilton:
    - 'ZeroAngel'   # used on AlphaBay (2016-2017)
    - 'Sydney'      # used to administer Empire Market (2018-2020)
infrastructure:
  - 'Empire Market: Tor hidden service, .onion address (not disclosed)'
  - 'Access required Tor browser; cryptocurrency-only settlement'
  - 'Homepage "Autoshop" for bulk stolen-card and credential sales'
laundering_tradecraft:
  - 'Coin mixing / tumbling services (site-promoted, ~1-3% fee)'
  - 'Encrypted messaging; "stealth" vendor ratings'
seized_wallet_labels:   # wallet names from Hamilton's plea, not addresses
  - 'Trezor "mum"'
  - 'Trezor "dani trezor"'
  - 'Mycelium'
  - 'Exodus'
  - 'source wallet "clean"'
  - 'source wallet "mine"'
network_iocs: none disclosed
file_hashes: none disclosed

Legal and Regulatory Response

Charges and court. United States v. Thomas Pavey and Raheim Hamilton, No. 22 CR 323, N.D. Ill., Eastern Division, before Judge Steven C. Seeger. The case number dates the matter to 2022 (administrative forfeiture of seized assets began December 21, 2022); a five-count superseding indictment was returned by the Special January 2023 Grand Jury on June 13, 2024 and announced June 14, 2024, with both men then in custody and facing a maximum of life.³⁴⁶⁵ Counts: § 371 counterfeit-currency conspiracy (Counts One and Four), § 846 drug conspiracy (Count Two), § 1029(a)(3) access-device conspiracy (Count Three) and § 1956(h) money-laundering conspiracy (Count Five).⁴

Pleas and sentence. Pavey pleaded guilty in 2025; Hamilton pleaded guilty to Count Two on January 26, 2026 and was sentenced on October 5, 2026 to 40 years and a $5 million fine.¹² The § 846 count carried a 10-year mandatory minimum and a maximum of life; restitution was deemed impracticable given the number of victims.³ Pavey's sentencing before Judge Seeger was scheduled for later in October 2026.¹

Investigating agencies. Homeland Security Investigations New York led, directing the El Dorado Task Force; the FBI Chicago Field Office and the U.S. Postal Inspection Service Chicago Division assisted. The sentence was announced by U.S. Attorney Andrew S. Boutros; Assistant U.S. Attorneys Melody Wells and Ann Marie E. Ursini prosecuted.¹⁶⁷

Forfeiture. Hamilton consented to forfeiture of roughly 1,230 bitcoin, about 24.4 Ether, 1,035.7 Tether, three Virginia properties (two in Norfolk, one in Suffolk) and numerous phones, laptops and storage devices; Pavey forfeited about 1,584 bitcoin, gold bars, vehicles and two Florida properties.³² Across the investigation, agents seized cryptocurrency valued at about $75 million at the time of seizure, plus cash and precious metals.⁶⁷

Impact Assessment

• Confirmed — marketplace scale: approximately 1,681,429 registered users (359,763 buyers, 5,002 vendors), 4,003,803 transactions and $432,951,570.47 in net sales over the life of the site.³
• Confirmed — drug volume: about 2,750,712 controlled-substance transactions totalling $374,069,309.81; relevant-conduct quantities of at least 446,683.15 g cocaine, 103,396.21 g heroin, 71,992.33 g methamphetamine, 13,314.23 g fentanyl, 7,694.63 g cocaine base and 21,177.23 oz marijuana (a later Guidelines paragraph lists the marijuana figure as 21,777.23 oz — a minor internal discrepancy in the plea).³
• Confirmed — fraud/credential trade: about 63,224 account/password listings and 50,850 compromised-account transactions; about 1,533,386 stolen-or-compromised payment-card listings and 200,096 card transactions; a "Software & Malware" category offering exploit kits, zero-days, ransomware and crypters.³
• Confirmed — sentence and forfeiture: 40 years, $5 million fine, ~1,230 BTC + 24.4 ETH + three Virginia properties from Hamilton; ~1,584 BTC and other assets from Pavey.¹³²
• Reported, not independently confirmed: that the August 2020 shutdown was a deliberate exit scam, and any platform-wide total of user funds lost; contemporaneous reporting left intent unresolved and gave only individual-vendor loss figures.⁸
• Estimated: the "$75 million" cryptocurrency seizure is a point-in-time valuation as of 2022–2023; a separate HSI figure in the 2024 announcement cited "$60 million-worth of cryptocurrency" tied to the drug operation, and the two were not reconciled.⁷
• Unknown: the specific investigative step that de-anonymised the operators; the identities and number of vendors and buyers prosecuted elsewhere; the current realised value of the forfeited cryptocurrency.³⁷

Lessons and Defensive Recommendations

For investigators and the darknet-research community

• Reused identity is still the dominant failure mode. A single cryptographic endorsement — Pavey signing a forum post to vouch for "ZeroAngel" in 2016 — tied two personas together durably enough to survive AlphaBay's takedown and resurface in a 2024 indictment.⁴ Seized-market datasets remain a long-tail intelligence asset years after a takedown.
• Crypto-only settlement and site-promoted tumbling did not defeat attribution: identity-verified exchange and bank rails plus blockchain tracing by a money-laundering task force produced ~1,230 BTC in seizures despite Empire's own "never be traced back to here" marketing.³⁴⁷

For journalists covering darknet takedowns

• Do not launder a vendor's characterisation into a finding. "Exit scam" has been attached to Empire's August 2020 collapse since the week it happened, but even then reporting attributed the shutdown to DDoS/extortion and said intent was unconfirmed, and the prosecution record charges operation only "until on or about August 22, 2020" without alleging an exit scam.⁴⁸
• Separate the planning date from the launch date: the agreement to build Empire dates to about August 2017, but the site went live on February 1, 2018 — the source of recurring "2017 vs 2018" confusion.³⁴⁹
• Treat seizure dollar figures as point-in-time. "$75 million in cryptocurrency" reflects 2022–2023 valuations and sits beside a separate "$60 million" figure in the same announcement.⁷

For platform, fraud and payment teams

• The Autoshop model — automated, geographically searchable bulk sale of stolen cards and credentials — shows how commoditised credential abuse is; the ~1.5 million card listings underline that card-not-present fraud monitoring and credential-stuffing defences should assume broad prior exposure.³⁴

Sources