Following the Money and the Cloud: Silk Road and Capital One

What you'll be able to do

By the end of this lesson you will be able to explain how investigators followed money, networks and cloud logs in two landmark cases.

• Explain how the Silk Road investigation combined undercover work, network and cryptocurrency analysis and a live seizure.
• Explain how cloud logs and a public post identified the Capital One intruder, and correct a common misunderstanding about the case.
• Describe cryptocurrency tracing and cloud forensics as techniques, with their limits.

Case 4: Silk Road (2013)

The case. Silk Road was an online marketplace for illegal drugs and services, reachable only through the Tor anonymity network and paid for in Bitcoin. Its operator called himself "Dread Pirate Roberts".

The book's account. Investigators traced Bitcoin transactions and uncovered the identity of Ross Ulbricht, the site's operator, and forensic analysis of his laptop revealed incriminating evidence, including administrative access to Silk Road. In section 14.11 the book adds network forensics (traffic to Silk Road's hidden services on Tor and server logs showing administrative access) and cryptocurrency tracing (analyzing the blockchain ledger, clustering addresses that belong together, and using legal process to link wallets to accounts at exchanges).

The arrest, a lesson in live acquisition. Reporting based on trial testimony describes how the identification came together. An undercover agent had worked his way into Silk Road's staff, and investigators had linked Ulbricht to old forum posts about the site. On 1 October 2013, agents watched him enter the Glen Park public library in San Francisco. When "Dread Pirate Roberts" came online, the undercover agent started a chat asking him to log in to the site's administration panel. Agents then moved in, pulled the laptop out of his reach while it was open and logged in, and photographed its screen, which showed the same chat. Had the laptop been closed, its encryption could have locked the evidence away (Lessons 2.4 and 3.4).

What happened next. Ulbricht was convicted in 2015 and sentenced to two life terms plus 40 years. In January 2025 he received a full presidential pardon. The forensic lessons are unaffected by the pardon.

The book's takeaway: cryptocurrency tracing and disk analysis are essential tools against cybercrime.

Case 7: Capital One (2019)

The case. An intruder obtained personal information about Capital One credit card customers and applicants stored in the cloud. Capital One says the incident affected about 100 million people in the United States and about 6 million in Canada.

The book's account. Analysis of Amazon Web Services (AWS) logs revealed unauthorized access patterns, and the suspect's GitHub account contained incriminating code and tools. The book describes the intruder as "a former employee" who "exploited a vulnerability in AWS".

What the official record shows. The US Department of Justice's case page gives a more precise picture, and it corrects two common misunderstandings:

• The suspect, Paige Thompson, was a former software engineer at a Seattle technology company, widely reported to be Amazon. She was not a Capital One employee; Capital One calls her an "outside individual".
• The intrusion occurred through a misconfigured web application firewall that enabled access to the data, not through a flaw in AWS itself. Under the cloud's shared responsibility model, the provider secures the underlying cloud and the customer secures what it configures in it.

The DOJ also explains how the case broke. Thompson had posted about the theft on GitHub. On 17 July 2019 a GitHub user alerted Capital One, which confirmed the intrusion on 19 July and contacted the FBI. Investigators identified the poster, and agents executing a search warrant seized storage devices containing a copy of the data. A federal jury convicted Thompson in 2022.

The book's takeaway: cloud forensics and log analysis are increasingly important as cloud-based attacks rise.

The Techniques in Focus

Cryptocurrency tracing. Bitcoin's ledger is public: every transaction between addresses is visible to anyone. Addresses are pseudonymous, not anonymous. Analysts use patterns, for example addresses spent together in one transaction probably belong to the same owner, to cluster addresses into likely entities. When funds reach an exchange that knows its customers, legal process can link an address to a real account. Specialist companies sell tracing tools, and free blockchain explorers show raw transactions.

Cloud forensics. Evidence lives in the provider's and customer's logs: who called which service, from where, when, and what data moved. Investigators need those logs to be switched on and retained before an incident, and need legal process or the customer's cooperation to obtain them.

Limits. Cluster analysis gives probabilities, not certainties, and privacy techniques can break the chains. Cloud logs show actions by credentials, not by people. In both cases, the decisive evidence came from combining sources: chats, forum posts, a live seizure, a public boast and seized devices.

Real-World Example

Imagine (a fictional scenario) a company whose cloud storage bucket of customer invoices was found to be readable by anyone on the Internet for six weeks. The question is whether anyone actually downloaded it. The examiner checks whether access logging was enabled for the bucket. It was, so the logs show 11 downloads from unknown addresses during the exposure, the first two days after a configuration change by an administrator. Without those logs, the company could only have said "we don't know", which under many data protection laws would mean treating everyone as affected. Forensic readiness, a setting switched on months earlier, made the difference.

From the Book to 2026

What the book teaches. Silk Road: Bitcoin tracing and laptop analysis identified and convicted Ross Ulbricht. Capital One: AWS logs and the suspect's GitHub exposed a former employee who exploited an AWS vulnerability.

Why it made sense. Both cases show how money trails, logs and seized devices combine, and both remain landmark cases.

What has changed. Two corrections and two updates. Correction: the Capital One intruder was not a Capital One employee, and the DOJ attributes the intrusion to a misconfigured web application firewall rather than an AWS vulnerability. Correction of emphasis: accounts of the Silk Road arrest based on trial testimony stress undercover work, old forum posts and the seizure of an open laptop, alongside the financial analysis. Updates: Ross Ulbricht was pardoned in January 2025. And cryptocurrency tracing has since grown into a major discipline used in many cases worldwide.

What to do now. When you read a case summary, check it against the primary record, such as court documents and official statements. In cloud investigations, ask first which logs exist and how long they are kept. For laptops, plan to seize running devices open whenever the law and the situation allow.

Watch: Capital One's Cloud Data Breach

This explainer by Kevin Fang, an independent creator who analyzes notable software incidents, breaks down how the Capital One breach happened technically.

Questions to keep in mind as you watch:

• How does the explanation of the misconfiguration compare with the DOJ's description above?
• Which logs and records would show each step of the intrusion?
• Where does the shared responsibility model put the fault, and why does that matter for the investigation?

The video complements what you just read. The lesson is complete without it. For an optional interview on how cryptocurrency tracing developed, see the further-study link on this lesson.

What Would You Do?

A colleague writes in a report: "The Bitcoin address belongs to the suspect, as shown by blockchain analysis." The analysis shows that the address was clustered with others that received funds from the suspect's exchange account. How would you rewrite the sentence? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Silk Road: undercover work, forum posts, network and cryptocurrency analysis, and the seizure of an open, logged-in laptop. Ulbricht was convicted in 2015 and pardoned in 2025.
• Capital One: cloud logs, a public GitHub post and seized devices identified the intruder, an outsider who exploited a misconfigured firewall, not an AWS flaw.
• Cryptocurrency is pseudonymous: tracing gives probabilities that need corroboration.
• Cloud forensics depends on logs being switched on and kept before an incident.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 14 (cases 4 and 7; section 14.11)
• KQED — The 2013 SF Sting That Captured Ross Ulbricht, Silk Road Operator Pardoned by Trump (23 January 2025)
• US Attorney's Office, Southern District of New York — Ross Ulbricht sentenced to life in prison (2015)
• US Attorney's Office, Western District of Washington — United States v. Paige Thompson
• US Attorney's Office, Western District of Washington — Former Seattle tech worker convicted of wire fraud and computer intrusions (2022)
• Capital One — Information on the Capital One cyber incident
• Amazon Web Services — Shared Responsibility Model
• NIST — IR 8006: NIST Cloud Computing Forensic Science Challenges