# US Charges "Speedstepper": Dream Market's Hidden Admin Finally Exposed After Seven Years on the Run
The identity of one of the darkest figures in the history of the internet's black markets has finally been revealed—and with it, a federal indictment that underscores both law enforcement's long reach and the enduring vulnerability of cryptocurrency-based money laundering schemes.
Owe Martin Andresen, 49, a German national, has been identified as "Speedstepper," the elusive chief administrator of Dream Market, one of the largest dark web narcotics marketplaces ever operated. Arrested in Germany in May 2026, Andresen now faces federal charges in the United States for his alleged role in laundering over $2 million derived from the platform's operations—and up to 20 years in prison for each of the 12 counts against him.
## The Rise and Fall of Dream Market
Dream Market launched in November 2013 with a singular purpose: to provide anonymous access to illegal goods and services. The platform gained prominence following high-profile law enforcement takedowns of competing marketplaces. When the U.S. Department of Justice and international partners shut down AlphaBay (in 2017) and Hansa (also 2017), Dream Market positioned itself as the successor, rapidly becoming the largest dark web marketplace by transaction volume.
At its peak, Dream Market hosted close to 100,000 listings and served as a central hub for the global narcotics trade. According to the Department of Justice, the platform facilitated staggering quantities of controlled substances:
| Substance | Quantity |
|-----------|----------|
| Cocaine | 450+ kilograms |
| Heroin | 90 kilograms |
| Methamphetamine | 45 kilograms |
| Crack cocaine | 25 kilograms |
| Fentanyl | 36 kilograms |
| Oxycodone | 13 kilograms |
The marketplace operated continuously from 2013 until its shutdown in 2019—a six-year run that generated tens of millions of dollars in commission revenue for its operators. While other high-ranking administrators were eventually prosecuted and convicted, the marketplace's lead administrator remained anonymous, operating under the pseudonym "Speedstepper." Until now.
## The Investigation: A Seven-Year Trail
The gap between Dream Market's 2019 shutdown and Andresen's May 2026 arrest spans seven years—a period that underscores both the complexity of transnational cybercrime investigations and the difficulty of remaining hidden once law enforcement identifies you.
The breakthrough came through a critical forensic discovery: in November and December 2022, dormant Dream Market cryptocurrency wallets containing millions of dollars in accumulated commission payments were suddenly accessed and moved into new wallets. This activity could only have been performed by someone possessing the original private cryptographic keys—a detail that law enforcement zeroed in on immediately. The DOJ identified Andresen as the individual responsible.
What happened next reveals a crucial mistake in operational security. Rather than simply moving the cryptocurrency funds and disappearing, Andresen allegedly decided to liquidate a portion of his holdings through a conventional financial system. In August 2023, approximately nine years after Dream Market's founding and four years after its shutdown, Andresen contacted a cryptocurrency service provider based in Atlanta, Georgia.
His transaction was ostensibly straightforward: convert cryptocurrency into tangible assets. He requested that the service provider purchase gold bars from international companies—a move that made sense operationally (gold is portable, fungible, and less traceable than cash) but created a fatal vulnerability: shipping addresses.
Andresen directed the companies to ship the gold bars to his residential address in Germany. By converting digital currency into physical commodities with delivery to a real location, he had transformed ephemeral blockchain records into concrete evidence that could be physically seized.
## The Money Laundering Scheme and Its Unraveling
Subsequent to those gold purchases, German law enforcement launched its own investigation into Andresen's activities, uncovering an additional money laundering infrastructure that operated between August 2023 and April 2025.
On May 7, 2026, German authorities executed searches at Andresen's residence and two additional locations. They recovered:
In total, federal prosecutors allege that Andresen laundered over $2 million during the 20-month window between August 2023 and April 2025.
## A Pattern of Accountability
The prosecution of Andresen is not an isolated victory. Over the past 18 months alone, federal authorities have dismantled the upper echelon of dark web marketplace operations:
This sequence suggests that the infrastructure for prosecuting dark web operators has matured significantly, and that hiding for years—even after a marketplace's shutdown—offers diminishing returns.
## HackWire Analysis
The apprehension of Andresen after seven years of freedom carries lessons that extend far beyond this single prosecution. Most notably, the case demonstrates that anonymity is not permanence. Law enforcement did not need to identify Andresen immediately; they needed only to identify the pathway by which he would eventually monetize his holdings. The decision to convert cryptocurrency into gold and ship it to a residential address was not a failure of tradecraft—it was a failure of strategic foresight. A sophisticated operator would have anticipated this vulnerability years earlier, either by using false identities, reshipping services, or intermediaries. Andresen's mistake was not technical; it was psychological. He waited too long.
The gold scheme itself deserves scrutiny. For years, operators have sought alternatives to direct cryptocurrency exchange, viewing traditional money laundering through gold, art, and real estate as "safer." But this case reveals a critical truth: physical assets carry physical liabilities. Gold may be fungible, but it is not weightless. The $1.7 million in gold bars recovered from Andresen's properties represent a forensic anchor point—authorities could track the purchase, the shipment, the storage, and the eventual recovery. In this sense, gold is less anonymous than cryptocurrency, not more. The blockchain creates permanent records, but it also creates mathematical certainty. Physical assets create inventory problems.
The seven-year timeline also matters. Andresen did not flee immediately; he remained in Germany, operated financial accounts, and only began liquidating assets in 2023. This suggests either confidence in his anonymity or miscalculation about law enforcement's capability. Given that other Dream Market administrators had already been convicted, the confidence appears to have been unfounded. This is a lesson for current dark web operators: once your marketplace is shut down and your peers are imprisoned, operating from your home country while conducting transactions that touch regulated financial infrastructure is not a matter of tradecraft—it is a matter of time.
For defenders and security professionals, the case illustrates the importance of international cooperation in digital forensics. The investigation spanned the United States, Germany, and the United Kingdom. The coordination required to link cryptocurrency wallets, identify shipping addresses, execute coordinated searches, and pursue parallel prosecutions remains one of law enforcement's most potent tools.
— HackWire Editorial
## Implications for Organizations and Defenders
While Dream Market itself shut down in 2019, the operational lessons remain relevant:
## Related Coverage