TRM also identified payments from StealC, malware designed to steal information, and another hosting provider called Volhav.
TRM based its breakdown on payments received by Bitcoin addresses it associates with Virtualine. The purpose of individual transfers was not specified.
TRM said Virtualine received more value attributed to illicit sources in 2026 than any other bulletproof hosting provider it labels!
A hosting service that promised to resist complaints
So-called “bulletproof” hosts rent servers and website infrastructure while promising customers resistance to abuse complaints and law enforcement requests.
The Justice Department said authorities obtained court approval to seize virtualine.net. Prosecutors allege the provider advertised to criminals, accepted direct Bitcoin payments, and laundered customer funds.
They also allege that Virtualine continued to host a forum that distributed child sexual abuse material and nonconsensual intimate images, and this was despite repeated warnings.
The FBI’s Washington Field Office, the German, Dutch, and British authorities, and private-sector partners were all part of the investigation.
The payment trail remains after the seizure
The DOJ announcement disclosed no cryptocurrency seizure amount and announced no arrests or criminal charges.
TRM said the provider’s known blockchain addresses can be used to track subsequent payments and movements to other hosts. This could help researchers to assess whether customers migrate or continue paying existing addresses.
For now, the confirmed enforcement step is the domain seizure, but what happens to Virtualine’s operations is not yet known.
Final Summary
- The FBI seized Virtualine’s domain on October 27 in an international operation.
- TRM attributed 44% of direct inflows to a drug marketplace, versus 5% to ransomware groups.
ambcrypto.com
