Government says creator of illicit Abacus Market is the ultimate owner of the domain.
The United States government has filed a lawsuit seeking to seize the domain name Egypt.com, alleging it was purchased using funds obtained through criminal activity. According to court filings, investigators believe the domain’s acquisition was funded by proceeds from a darknet drug marketplace known as Abacus Market.
Homeland Security Investigations (HSI) Special Agent Geoffrey Gordon submitted an affidavit describing the investigative findings. The affidavit outlines a money laundering network tied to the darknet marketplace that converted virtual currency used in drug sales into Bitcoin, and then funneled those assets into a domain purchase. The government’s complaint asserts that the person who ran Abacus Market is the actual owner of Egypt.com, despite intermediaries and nominal account holders involved in the transactions.
An HSI investigation into the real person(s) who controlled and operated the darknet marketplace ABACUS MARKET identified a money laundering network used to launder the proceeds of drug trafficking, including drug sales in the District of Puerto Rico. As part of this money-laundering activity, the virtual currency Monero was exchanged into Bitcoin via a foreign virtual currency exchange (VCE) account held in an unconfirmed identity. This Bitcoin was then transferred to a Bitcoin wallet controlled by the suspected Administrator of ABACUS MARKET and then used to purchase the domain EGYPT.COM for approximately $638,000 via a U.S. domain brokerage and a U.S. VCE on September 17, 2024. The purchase of the SUBJECT DOMAIN NAME was conducted using a suspected intermediary. On the date the domain EGYPT.COM was purchased, the same IP address was used to access both the foreign VCE account which originated the Bitcoin transfer and the U.S. VCE account used to transact the purchase, though both are nominally held in differing names in distinct countries. The evidence indicates the true owner of the domain EGYPT.COM is the Administrator of ABACUS MARKET and it was purchased using proceeds of drug trafficking and was involved in money laundering.
The affidavit specifies that the domain was acquired through the domain brokerage Atom. Investigators obtained records from both Atom and the registrar Namecheap that, according to the filing, point toward an individual identified only by initials in the documents: “A.Y.” Those records are central to the government’s claim that the purchase was part of a broader laundering operation tied to illicit drug proceeds.
Law enforcement further reports that the purchase involved multiple virtual currency exchanges and accounts. The affidavit describes an exchange of Monero into Bitcoin through a foreign virtual currency exchange where the identity associated with the account was not confirmed. That Bitcoin was then transferred to a wallet controlled by the alleged Abacus Market administrator and used to buy the domain. The government highlights technical evidence, such as IP address activity, suggesting coordination between accounts that were nominally registered under different names and in different countries.
In April, federal authorities obtained a seizure warrant for the Egypt.com domain. Following the warrant, the registrar was served with the legal order and placed a lock on the domain while the case proceeds through the courts. The lock prevents transfer or sale of the domain pending resolution of the government’s claim. At this time the case remains active, and the outcome will hinge on the court’s review of the evidence presented in the filings.
This action is part of a broader pattern of U.S. law enforcement efforts targeting darknet marketplaces and the financial mechanisms they use to conceal proceeds from illegal activity. By pursuing assets such as premium domain names, prosecutors aim to disrupt criminal enterprises by seizing assets they allege were purchased with illicit funds. As the case advances, further public filings may provide additional detail on how the government linked the domain purchase to the darknet marketplace and the individuals it alleges were responsible.