ctipilot.ch

Dream Market lead admin Owe Martin Andresen arrested in Germany (BKA + US multi-agency)

incident · incident:dream-market-admin-arrest-2026-05

Coverage timeline
1
first 2026-05-16 → last 2026-05-16
Briefs
1
1 distinct
Sources cited
7
7 hosts
Sections touched
1
active_threats
Co-occurring entities
4
see Related entities below

Story timeline

  1. 2026-05-16CTI Daily Brief — 2026-05-16
    active_threatsFirst coverage. German national arrested 2026-05-07, publicly identified 2026-05-13–14; US indictment 2026-01-13 (6 counts intl money laundering); OPSEC failures: 2022 wallet reactivation traceable to original private keys; 2023 crypto-to-gold purchase shipped to home address; €1.7M gold + crypto seized; co-admins Oxymonster/KITT3N/GOWRON previously convicted.

Where this entity is cited

  • active_threats1

Source distribution

  • bka.de1 (14%)
  • dea.gov1 (14%)
  • therecord.media1 (14%)
  • bleepingcomputer.com1 (14%)
  • cisa.gov1 (14%)
  • scworld.com1 (14%)
  • welivesecurity.com1 (14%)

Related entities

Items in briefs about Dream Market lead admin Owe Martin Andresen arrested in Germany (BKA + US multi-agency) (3)

BKA Dream Market arrest — "Speedstepper" detained in Germany after seven years at large

From CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026) · published 2026-05-17 · view item permalink →

BKA arrested Dream Market lead administrator "Speedstepper" in Germany; OPSEC failure traced to cryptocurrency-to-physical-gold conversion patterns (daily 2026-05-16). Complements the W20 BKA Crimenetwork takedown (daily 2026-05-12) — two consecutive German federal LE actions against darknet-market administrative-tier operators in the same week. For European cybercrime ecosystem analysis: the BKA tempo on darknet-administrator pursuit is materially elevated through Q2 2026 and likely informs the broader operator OPSEC environment.

BKA — Dream Market lead administrator "Speedstepper" arrested in Germany

From CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026) · published 2026-05-17 · view item permalink →

Adds to the BKA Crimenetwork takedown (covered daily 2026-05-12 as a separate W20 LE action). Two consecutive German federal LE actions against darknet-administrator-tier operators within the same week — a notable tempo signal for the EU cybercrime LE ecosystem. The OPSEC failure (cryptocurrency-to-physical-gold conversion patterns over seven years) is forensically interesting but the policy-horizon implication is that BKA's investigative throughput on darknet-administrator pursuits is materially elevated through Q2 2026 (daily 2026-05-16).

BKA arrests Dream Market lead administrator "Speedstepper" in Germany — cryptocurrency-to-physical-gold OPSEC failure after seven years at large

From CTI Daily Brief — 2026-05-16 · published 2026-05-16 · view item permalink →

Owe Martin Andresen, a 49-year-old German national alleged by US and German prosecutors to be "Speedstepper" — the lead administrator of the Dream Market darknet narcotics marketplace from 2013 until its 2019 voluntary shutdown — was arrested in Germany on 2026-05-07 and publicly identified on 2026-05-13–14 (The Record, 2026-05-14 · US DEA, 2026-05-13). The action was a coordinated multi-agency operation: the Bundeskriminalamt and the Zentrale Kriminalinspektion Oldenburg for the German side, with the US DEA Miami, IRS-CI Cyber Crimes Unit, FBI, USPIS, and HSI executing in parallel. A US federal grand jury in the Northern District of Georgia had returned a sealed indictment on 2026-01-13 charging Andresen with six counts of international concealment money laundering and six counts of concealment money laundering (240 years aggregate maximum); German charges carry up to five years. The OPSEC failures that closed the seven-year gap were operational, not technical: in late 2022 Andresen allegedly accessed Dream Market's dormant cryptocurrency wallets — an action only the holder of the original private keys could perform — and consolidated the contents into a single wallet, providing prosecutors with a definitive on-chain link; and in August 2023 he used an Atlanta-based cryptocurrency-to-physical-asset service to purchase gold bars that were shipped directly to his home address in Germany, providing the geographic and identity link. At arrest, German authorities seized approximately USD 1.7 million in gold bars, USD 23,000 in cash, and approximately USD 1.2 million in cryptocurrency. Three Dream Market co-administrators ("Oxymonster", "KITT3N", "GOWRON") had been convicted previously. The case is operationally interesting to public-sector intelligence liaisons because it illustrates that long-tail attribution of darknet operators is increasingly driven by post-cessation financial behaviour — wallet reactivation, regulated-service touchpoints, physical-asset conversion — rather than on-platform OPSEC; the seven-year delay between the marketplace's closure and the arrest is the operational signal.