TRM Labs has published new research tracing cryptocurrency payments to Virtualine, a hosting provider whose website domain the FBI seized on October 27. The October 28 report links payments to wallets TRM associates with a drug marketplace, ransomware groups, and other criminal services.
Drug marketplace payments outweighed ransomware
According to TRM’s analysis, a Russian drug marketplace accounted for about 44% of Virtualine’s direct cryptocurrency inflows, while ransomware groups were about 5%.
A large sextortion scheme accounted for roughly 17%, while a cryptocurrency mixer, a service used to obscure transaction trails, contributed around 13%.
TRM also identified payments from StealC, malware designed to steal information, and another hosting provider called Volhav.
TRM based its breakdown on payments received by Bitcoin addresses it associates with Virtualine. The purpose of individual transfers was not specified.
TRM said Virtualine received more value attributed to illicit sources in 2026 than any other bulletproof hosting provider it labels.
A hosting service that promised to resist complaints
So-called “bulletproof” hosts rent servers and website infrastructure while promising customers resistance to abuse complaints and law enforcement requests.
The Justice Department said authorities obtained court approval to seize virtualine.net. Prosecutors allege the provider advertised to criminals, accepted direct Bitcoin payments, and laundered customer funds.
They also allege that Virtualine continued to host a forum that distributed child sexual abuse material and nonconsensual intimate images, and this was despite repeated warnings.
The FBI’s Washington Field Office, the German, Dutch, and British authorities, and private-sector partners were all part of the investigation.
The payment trail remains after the seizure
The DOJ announcement disclosed no cryptocurrency seizure amount and announced no arrests or criminal charges.
TRM said the provider’s known blockchain addresses can be used to track subsequent payments and movements to other hosts. This could help researchers to assess whether customers migrate or continue paying existing addresses.
For now, the confirmed enforcement step is the domain seizure, but what happens to Virtualine’s operations is not yet known.
