Non-registered users could view thumbnails of the videos on the platform, but to download or stream the related videos, the user had to be registered and have ‘Points’. Points were the on-site currency for purchasing this illegal material. Users bought points via Bitcoin. The user could also earn points by uploading a unique video, or having a friend sign up using the user’s referral code.

On multiple occasions, including September 28, 2017 and February 23, 2018, federal agents made payments on the platform. Within 48 hours, the money had been moved to another Bitcoin wallet. The wallet was registered to Coinbase, one of the largest cryptocurrency trading platforms available.

Further research and questioning resulted in finding the wallet owner – Jong Woo Son. Coinbase requires the user to run through a process called KYC – ‘Know your customer’. Information such as the user’s name, place of residence, email address and phone number are confirmed and stored.

This was enough to give law enforcement a no-knock warrant to raid Mr. Son’s residence. One server was confiscated, containing 8 terabyte of child pornography. Further, log files indicating that more than one million videos had been downloaded from the site were found.

The raid was conducted by US IRS-CI, US HSI, UK NCA, and the South Korean National Police. By comparing the hashes of these videos to the collection at NCMEC (The National Center for Missing and Exploited Children), they found that 45% of these videos had never been seen before.