Neo-Nazi's Bitcoin History Suggests Russian Darknet Link

Hatewatch identified Anglin’s transactions through software that specializes in analyzing cryptocurrency transactions. Hatewatch believes based upon our reading of that software that in 2016 Anglin paid money to a Russian darknet site that traffics in hacked personal data, drugs, ransomware, stolen credit cards and money laundering. Hatewatch could not determine exactly why Anglin transferred currency to the apparent darknet site highlighted through the software. He did not respond to an email requesting comment on the findings published in this story, but he did deny them in a neo-Nazi forum he operates.

“This is totally fake. I don't even know what any of this is about. I never bought any Russian darknet drugs lol,” Anglin told other forum users in a comment on July 16. “I have never used bitcoin for anything other than website stuff.” You can read Anglin’s complete response to this analysis by clicking here.

Andrew Anglin

Anglin, a neo-Nazi known for leading internet-based harassment campaigns against women, Black, Jewish and Muslim people, among others, issued the Bitcoin payments in July and August of 2016, Hatewatch determined. At that time, Anglin produced a deluge of propaganda promoting Donald Trump’s presidential campaign. (Anglin voted for Trump that year via absentee ballot from the southern Russian city of Krasnodar.) The Southern Poverty Law Center successfully sued Anglin for $14 million over the terror campaign he organized against Tanya Gersh, a Montana-based Jewish real estate agent he targeted through his website in December 2016. Anglin has hidden from the public in recent years and has so far failed to pay out the judgment against him.

Promoting the darknet to a generation of extremists

Anglin and his Daily Stormer collaborator Andrew “weev” Auernheimer have promoted the darknet among the site’s community of readers for years. By darknet, Hatewatch refers to a layer of the internet that is only accessible through Tor, a peer-to-peer web browser that enables users to be anonymous. In an era when typically only those with money can obtain privacy online, activists endorse Tor as a means of protecting one’s identity from those who seek to steal data or create harm. Anglin and Auernheimer seek anonymity through Tor to help them engage in pro-fascist activism without outsiders detecting their activity, which often includes stirring up online harassment campaigns. Anglin advocated for his readers to download and employ Tor back in August 2015, when explaining how to skirt around software that blocks IP addresses.

“We already know how to deal with the IP blocking. We just use Tor,” Anglin wrote in that post, encouraging his readers to troll a comment section. “Download and use Tor browser. It’s very simple. Comment on the top stories until you’re banned, reset Tor, repeat. The Android version of Tor also works great, if you want to Troll on the move with your smartphone.”

Tech companies such as GoDaddy and Google originally provided web services to the Daily Stormer, but they cut ties with the hate site in August 2017 following the deadly “Unite the Right” rally in Charlottesville, Virginia, which Anglin promoted. Anglin and Auernheimer moved the Daily Stormer to more than a dozen different domains in the months that followed, often using a darknet address as a permanent home for the site at times when readers couldn’t access it on the clear web, where most internet activity happens. (Anglin sometimes refers to the clear web as the “normie web” to his readers.) Anglin wrote an entry on a personal blog on Aug. 25, 2017, calling the site’s move to the darknet “fitting.”

An early proponent of cryptocurrency

Anglin adopted cryptocurrency within years of it becoming available, and today operates at least 200 Bitcoin addresses. In addition to the addresses he uses to solicit donations, many of the other addresses are created as byproducts of his long history using the cryptocurrency. Each time Bitcoin holders receive “change” back from transactions on the blockchain, that “change” is held in a new address. Hatewatch determined that Anglin frequently combined the coins from his “change” addresses with coins held in his known donation addresses in order to make new payments.

Anglin’s transaction history also stands out for the money he holds relative to other extremists, his volume of transactions and his apparent interest in websites that traffic in illegal goods, stolen data and money laundering, Hatewatch determined. We also found that Anglin has traded at least $1,144,648 worth of Bitcoin in total across 6,147 transactions, 4790 inbound and 1357 outbound, spanning six and a half years. Anglin wrote in his denial that “[Hatewatch] just print[s] whatever amount of money to try to stop people from donating.” Anglin commonly solicits donations from his readers, sometimes threatening to stop working if he runs out of funds.

“We have long been banned from operating within the normal financial system. As far back as 2014, we were banned from PayPal and credit card processors, and switched to Bitcoin,” Anglin wrote of cryptocurrency in a February post.

Hatewatch found a series of transactions involving an address known to belong to Anglin on Dec. 24, 2014, which marks his first known use of the Bitcoin blockchain. On that date, two unidentified Bitcoin users sent Anglin four payments in quick succession of 0.008814 BTC each. (White supremacists place symbolic significance on the numbers 14 and 88.) Hours later, on the same date, someone also sent Anglin a 0.04 BTC payment. The person who sent the payment also transacted multiple times with the white nationalist Don Black, Hatewatch determined. (Black, a former Ku Klux Klan leader, created the white supremacist forum Stormfront and invested early in Bitcoin.) Hatewatch reached out about the transactions by email to Stormfront, Black’s website, but no one wrote back.

Anglin later spent Bitcoin at sites associated with darknet services, according to Hatewatch’s interpretation of the blockchain analysis software. In summer 2016, Anglin made payments to a Russian darknet website, Hatewatch found. He paid out roughly $19.68 on July 3, 2016, $31.74 on July 19, 2016, and $15.04 on Aug. 6, 2016, according to our reading of the software. Around the same time, Anglin transacted with addresses on the Bitcoin blockchain associated with trafficking in money laundering practices. In cryptocurrency parlance, these “mixing services” allow multiple users to combine their coins to obscure their precise destination. Anglin began receiving payments from users through mixing services in October 2016 and continued as recently as January 2020, Hatewatch found.

Daily Stormer’s move to Monero

Today, Anglin no longer solicits Bitcoin donations on his Daily Stormer website, but instead encourages readers to donate Monero, a privacy-focused coin embraced by the criminal underworld. Designed to obscure transactions from public view, darknet market shoppers spend theoretically untraceable Monero tokens to evade law enforcement scrutiny. For that reason, Hatewatch can analyze only fragments of Anglin’s cryptocurrency history right now, emphasizing payments he either made or received through known Bitcoin wallets.

“Every Bitcoin transfer is visible publicly,” Anglin wrote in February about moving Daily Stormer donations to Monero. “Generally, your name is not attached to the address in a direct way, but spies from the various ‘woke’ anti-freedom organizations have unlimited resources to try to link these transactions to real names. With Monero, the transactions are all hidden.”

The private security company CipherTrace claims to have developed the capacity to trace Monero transactions on behalf of law enforcement, according to an August 2020 statement on their website. CipherTrace notes in their statement that 45% of darknet markets now carry out transactions in Monero, making it the second most-used cryptocurrency for such transactions behind Bitcoin.

Russian darknet services, American crimes

One example of the type of Russian darknet site Anglin may have paid is “uniccshop.ru,” which the Justice Department (DOJ) described as being part of a “transnational criminal organization” when they issued cybercrime-related charges against 36 people connected to it in February 2018. A man named Andrey Sergeevich Novak operated the Unicc.ru site at the time Anglin made the apparent payments. Novak used the aliases “Unicc,” “Faaaxx” and “Faxtrod” while he participated in a shadowy group known as the InFraud Organization, which victimized “millions in all 50 states and worldwide,” contributing to losses of over $530 million through hacking and data theft, the indictment said. Hatewatch reached out to the DOJ for an update in the case against Novak and a comment on Anglin’s apparent use of darknet markets and is awaiting a response.

Law enforcement has also cracked down on Bitcoin mixing services in recent years. Federal authorities arrested Roman Sterlingov, the administrator of a website called BitcoinFog, on money laundering charges in April. Hatewatch reached out to the Internal Revenue Service for a comment on users of Bitcoin mixing services and an update on the Sterlingov case. If they respond, Hatewatch will update this story.

Editor’s note: This story has been updated to clarify that the analysis of Andrew Anglin’s bitcoin wallet data was made by an SPLC analyst interpreting data from a blockchain analysis software. Hatewatch also updated the analysis to include Anglin’s comment about our findings.

Photo illustration by SPLC