Cybersecurity

Canada’s law enforcement has successfully dismantled TradeOgre, a cryptocurrency exchange operating on the Tor network, involved in the theft and laundering of over 56 million dollars in digital assets.

TradeOgre, emerging in early 2023, functioned as a hidden service on the Tor network, bypassing regulatory oversight and concealing the source of illicit funds. The platform did not implement Know Your Customer (KYC) protocols, allowing untraceable trading of cryptocurrencies such as Bitcoin, Monero, Ethereum, and various altcoins.

Initially perceived as a decentralized marketplace for privacy-focused traders, TradeOgre became a hub for cybercriminals to process ransomware payments, darknet proceeds, and stolen funds. Transactions were conducted via a custom API interface accessible through a .onion address.

The Royal Canadian Mounted Police identified suspicious traffic patterns and cluster-analysis indicators linked to the platform’s involvement in high-value thefts, resulting in a 56-million-dollar seizure on September 18, 2025.

TradeOgre’s backend utilized open-source components with proprietary scripts for order matching and deposit processing. Although the code was not publicly released, investigators recovered fragments of shell and Python scripts used for wallet hot-storage and mixing services, along with configuration files demonstrating multi-hop proxy chaining.

Evading Detection Through Tor and Proxy Chaining

TradeOgre employed a layered obfuscation strategy, operating on a virtual machine cluster within bullet-proof hosting, with each node communicating over Tor circuits and randomized VPN endpoints. Investigators recovered a proxy setup script illustrating how TradeOgre maintained its hidden service:

# Proxy chaining for TradeOgre hidden service
sudo apt-get install tor privoxy
cat << EOF > /etc/privoxy/config
listen-address 127.0.0.1:8118
forward-socks5t   /               127.0.0.1:9050 .
EOF
systemctl restart privoxy
# Access API through Tor proxy
curl --socks5-hostname 127.0.0.1:9050 http://tradeogrehidden.onion/api/v1/markets

This approach hindered attribution and complicated conventional threat-intelligence tracking, highlighting the challenge of combating darknet-enabled financial crime.