The question is simple. If Ross William Ulbricht running a darknet market inside a TOR network and he never exits through the exit node, and obviously he won't need to, so how did he get caught?

I was taking a course on the anonymizing techniques and there I had learned through the illustrated examples. As shown below

enter image description here

When a user connects to a TOR so his activity is nonencrypted as shown with a left red arrow it means an ISP can see a user is using a TOR network. Fine. When a user inside a TOR network then his all network is encrypted as shown with green arrow. As soon as, the user leaves the TOR network then his activity becomes again nonencrypted and anyone can see his traffic but not the origin (shown with right red arrow).

See below:

enter image description here

In this scenario, when a user enters a TOR network, at the time he is visible to his ISP but if he gets inside the TOR network then he is invisible to the clearnet world. And he can access the .onion services what we call a darknet. So Ross William Ulbricht was running the service inside the darknet and he never needs to leave the TOR network through the exit node to the outside world but yet he caught by the FBI, how?

Here is another example from a famous hacking series MR. Robot season 1 where Elliot tracks the activity of Roni's coffee who was running an illegal website on the darknet so Elliot says if anyone controls the exit node he can take control over the traffic. Again, if Roni was running his services inside the TOR network and did not exit through the exit node of the TOR network so how did Elliot catch him? Obviously, Mr. Robot is not a fake hacking series. 99% of things are real in that series. Here is the youtube reference for that scene. https://www.youtube.com/watch?v=sO2raiSHOhc

So, if not Roni's Coffee owner leave the TOR network nor Ross William Ulbricht then how did they get caught even they were inside the TOR network? How does the exit node plays a srole in both cases?

2 Answers 2


This defcon 22 talk covers most of the possible ways to get caught using Tor:

  • All tor nodes are known (except bridges). ISP or system administrator can figure out who was using tor at a given time and from what IP. That information can be used to narrow down who is using tor and find out the suspect.
  • People can give away a lot of information themselves. One slip up is enough to give away your location.
  • People can be found out using an exploit in the web page (for example, in JavaScript).
  • Server can have an RCE exploit (Remote Code Execution), which can be used to contact another server over clearnet, and thus, giving away the real IP.

Also in the talk, it was pointed out that the owner gave away himself by advertising his gmail over some shady forum, looking for an "IT pro in the bitcoin community". Oh, and also posted on stackoverflow asking for help with a Tor hidden service under his real name (later changed to frosty). The exact details on how FBI found his servers are unknown, but after they found them, they started taking them down and also took a copy of the server data.

  • 1
    I am surely gonna watch that DEFCON talk. So a quick answer would be there is no any role an exit node plays. I wonder why did Mr. robot series depict that scene with emphasizing the word about controlling the exit node. May 2, 2020 at 12:04
  • Yeah, controlling an exit node is not really useful in that case. May 3, 2020 at 22:14

There is many steps he did wrong that got him caught. Most of them are not related to tor\exit nodes directly.

  1. He boasted about running his international multimillion dollar drugs marketplace on his LinkedIn profile

  2. He used a real photograph of himself for a fake ID to rent servers to run his international multimillion dollar drugs marketplace

  3. He asked for advice on coding the secret website for his international multimillion dollar drugs marketplace using his real name

  4. He sought contacts in courier firms, presumably to work out how to best ship things from his international multimillion dollar drugs marketplace, on Google+, where his real name, real face and real YouTube profile were visible

  5. He allegedly paid $80,000 to kill a former employee of his international multimillion dollar drugs marketplace to a man who turned out to be an undercover cop



  • So would you care to explain the scene in Mr. Robot? Why did Elliot say about the exit node when talking with the roni's coffee owner and we know that Rohit (roni) was running the pedo website inside the TOR network? May 3, 2020 at 15:52
  • It's called writing for TV. It doesn't have to correspond to reality. Also hopping on a private plane to go to the datacenter is real TV b.s.
    – elmerjfudd
    May 5, 2020 at 11:17
  • That could be true. Thanks. May 7, 2020 at 11:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .