Suspected Dream Market main administrator Owe Martin Andresen arrested in Germany on 2026-05-07 on German money-laundering charges in a coordinated German and US operation; the US indictment alleges he laundered the marketplace's dormant commission wallets (DEA, 2026-05-13).
Coverage
1
first 2026-05-16 → last 2026-10-21
Latest activity
2026-05-16
Suspected Dream Market administrator "Speedstepper" arrested in Germany; US prosecutors allege he reactivated…
Peak priority
routine
1 routine
Targets
·
regions: europe, dach, us
Sources cited
2
2 hosts
Defender insights
What each entry about Dream Market admin arrest tells a defender to do, newest first.
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)
ReconnaissanceSearch Closed Sources: Purchase Technical Data
Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.
On 2026-05-07, in a coordinated effort by German and US law enforcement, Owe Martin Andresen, 49, was arrested in Germany on German charges, and his residence and two other locations were searched (US DEA, 2026-05-13). A US federal grand jury had indicted him on 2026-01-13 on six counts of international concealment money laundering and six counts of concealment money laundering, each carrying up to 20 years, and Germany has charged him with several counts of concealment money laundering, each punishable by up to five years (US DEA, 2026-05-13). The DOJ indictment, unsealed in the week The Record reported it, accuses him of being the main administrator of Dream Market, a darknet marketplace launched in 2013 that announced its shutdown in 2019 (The Record, 2026-05-13); the release calls him the suspected main administrator, the role whose holder used the moniker "Speedstepper" and was not identified in the earlier prosecutions (US DEA, 2026-05-13). The case is investigated by the IRS-CI Cyber Crimes Unit and the DEA Miami Counternarcotic Cyber Investigations Task Force with substantial assistance from the Bundeskriminalamt Cybercrime Unit and the Zentrale Kriminalinspektion Oldenburg; the FBI, USPIS and HSI were part of the task force that investigated the marketplace between 2016 and 2022, whose prosecutions convicted the administrators "Oxymonster" and "KITT3N" in the US and the mid-level administrator "GOWRON" in the UK (US DEA, 2026-05-13).
Prosecutors allege that in November and December 2022 Andresen moved funds from the marketplace's dormant commission wallets into new consolidated wallets, activity that could only have been initiated by someone holding Dream Market's original private keys, and that in August 2023 he used an Atlanta-based cryptocurrency service provider to buy gold bars that were shipped to his home address in Germany; in total he is alleged to have laundered over $2 million between August 2023 and April 2025 (US DEA, 2026-05-13). The US Attorney says the commissions came from selling illegal drugs, stolen personally identifiable information, counterfeit identification documents and other items (US DEA, 2026-05-13). US agencies had kept watching the marketplace's wallets after the shutdown and found them untouched until then (The Record, 2026-05-13). The searches located about $1.7 million of gold bars and over $23,000 in cash, along with information identifying bank accounts and cryptocurrency wallets holding about $1.2 million believed to be Dream Market proceeds (US DEA, 2026-05-13).
On May 7, 2026, in a coordinated effort by both German and U.S. law enforcement, Andresen was arrested on German charges, and his residence and two other locations were searched.
Law enforcement also located information identifying several bank accounts and cryptocurrency wallets containing approximately $1.2 million of funds believed to be proceeds of the Dream Market.
The arrest on 2026-05-07 was a coordinated German and US effort on German charges rather than a BKA arrest: the case is investigated by the IRS-CI Cyber Crimes Unit and DEA Miami with substantial assistance from the Bundeskriminalamt Cybercrime Unit and the Zentrale Kriminalinspektion Oldenburg, while the FBI, USPIS and HSI belonged to the task force that investigated the marketplace from 2016 to 2022 (US DEA, 2026-05-13). Only the US indictment accuses Andresen of being the main administrator; the German charges are concealment money laundering (US DEA, 2026-05-13; The Record, 2026-05-13). The 2022 transfers went into new consolidated wallets, not a single wallet, and the searches located about $1.7 million of gold bars and over $23,000 in cash and identified bank accounts and wallets holding about $1.2 million, rather than seizing $1.2 million in cryptocurrency (US DEA, 2026-05-13). The marketplace commissions behind the laundering came, the US Attorney says, from selling illegal drugs, stolen personally identifiable information, counterfeit identification documents and other items (US DEA, 2026-05-13).