Besa Mafia deep web hitman service turns out to be an elaborate bitcoin scam

The Besa Mafia hitman marketplace was the latest and most elaborate example of a hitman service on the deep web, the part of the World Wide Web that can’t be found with standard search engines.

The Silk Road offered a similar deep web marketplace, but focused on illegal drugs, drawing the line at hitmen and weapons.

As the Silk Road and its’ successors targeted different markets, it appeared that Besa Mafia was picking up the extra business, providing all kinds of violence for bitcoins, including beatings, arson, acid attacks, and even murder.

However, despite their glossy stock photos and above-average skills in website development for a deep web site, the service and business model have been exposed as a scam by researchers.

An investigative blogger and cybersecurity expert in London, Chris Monteiro, and his partner, who goes by the handle “Judge Judy,” exposed Besa Mafia on Monteiro’s blog. There are still more details yet to be revealed, according to Monteiro, although what has already been released is pretty damning evidence of a scam.

Although Besa Mafia, which claims to be a branch of the Albanian mafia, wasn’t the first site to offer hitman services on the dark web, it is the most elaborate attempt to date, and a natural target for Monteiros’ investigations. "I want to expose the urban legend of dark web assassination websites," Monteiro told The Mirror, explaining his actions, in spite of possible repercussions. "These marketplaces are a scam set up to steal your money and possibly even get you arrested."

The front page of the Besa Mafia deep web site claims it uses bitcoin and the deep web for security.

The researcher first ran across the site on a subreddit about the deep web that he moderates. After a lengthy interview with the Besa Mafia website administrator in March, which turned up quite a few flaws and more questions than answers, the accusation has now been backed up by a data hack. Risk Based Security claims a hacker breached the site’s database and posted the information online where it was accessible to anyone.

“Data leaked in this breach contains user accounts, user personal messages, ‘hit’ orders posted to the site, and a folder named ‘victims’ that contains additional documents within it [including] one additional ZIP file which contains photos of victims from the ‘hit’ orders on the site. The original leak post also contained 250 accounts with usernames, email addresses, and passwords however this data was not included in the download. The two CSV files from the leak are named orders.csv and msg.csv that contain 38 ‘hit’ orders and 2,682 personal messages to and from site administrators.”
— – Risk Based Security

While the administrator of Besa Mafia denies that the data is real, it shows that none of the orders have been completed, despite the earliest orders being from December 2015. Meanwhile, the administrator has netted bitcoins totaling “somewhere in the region of £50,000 in the past year,” as calculated by Monterio.

Risk Based Security reports that Besa has “a unique way of putting users who apply to be a hitman-for-hire to the test by asking them to perform a criminal task.” That task generally involves an activity such as stealing a car and setting it on fire. Videos on Youtube provide the evidence, along with a personalized message.

The data dump included conversations between site administrators and two of the alleged arsonists. There was also an exchange of emails between an administrator and someone identifying themselves as a Texas investigator, who was seeking details on a possible hit placed on a Texas woman through the site.

The administrator supposedly handed over the details provided by the person ordering the murder. The admin also included their own information, stating that they were “willing to work with the FBI” if needed.

A flowchart of Besa Mafia’s business model created by Monteiro & Judge Judy

Previous attempts at assassination markets on the deep web, including the alleged attempts by Silk Road’s Ross Ulbricht, and the Sanjuro Assassination Market that made international headlines in 2013, have all been shown to be ineffective, never resulting in a single kill.

The Sanjuro marketplace eventually folded when the hype died down, but 180 or so bitcoins are still held in escrow. “What we can see is that the money has not moved at all since the site’s closure,” Montiero says. “Frankly, I’m surprised, I had expected so see it moving to an exchange or tumbler for immediate cash-out, yet that’s 180 BTC / $60k USD / £40k GBP left in limbo, perhaps never to move again.”

The biggest mark in Sanjuro’s marketplace was the former federal reserve chairman Benjamin Bernanke, who had a price of 124.22 bitcoins, worth about US$56,000 today, placed on his head during his appointment as chairman.

Monteiro makes the point repeatedly throughout several of his blog posts, hiring hitmen over the internet simply does not work. Scams are easier, less dangerous, and a more profitable model for marketplace owners.