US authorities have seized over $4 million worth of cryptocurrency and cash following a movie piracy investigation conducted by Homeland Security Investigations (HSI) and Motion Picture Association of America (MPAA). But here’s the saucy part: it was PayPal that tipped off the detectives to the case.

The investigation dates back to October 2013, when PayPal pointed HSI to two supposedly illegal streaming services (Noobroom.com and Noobroom7.com), TorrentFreak reports. Curiously, the owner of the pirate sites held a rather diversified portfolio of cryptocurrencies, including Bitcoin, Bitcoin Cash, Ethereum, and Litecoin.

According to court documents, an Oregon federal court is already reviewing the case. Authorities are seeking the forfeiture of all funds seized on the basis that the owner of the streaming sites conspired to commit copyright infringement and money laundering.

After the HSI reported the streaming services to the MPAA, the film industry association found that the websites illegally distributed copyrighted works. It also noted that Noobroom generated revenue by collecting subscription payments via Stripe and PayPal.

Shortly after its investigation, the MPAA sent a cease-and-desist letter to Noobroom and its associated websites.

Instead of complying with the order though, the MPAA discovered that Noobroom notified users that their accounts were being moved to a new domain, called SuperChillin.com. Eventually, the MPAA linked SuperChillin.com to two additional piracy portals, movietv.co and Sit2Play.com.

It also found the websites were managed by an individual going by the name of Talon White.

Investigators discovered that all Noobroom revenue – generated by subscription payments – was then moved from the streaming service’s Stripe account to bank accounts controlled by White.

Screenshot from court documents obtained by TorrentFreak.

According to court files, Noobroom and its associated websites received almost 80,000 payments of $9.99 between October 2015 and December 2016, amounting to $789,060.

The investigators also detected another 7,611 payments of $25.49 ($194,004.39) and 5,348 payments of $44.99 ($240,606.52) linked to Noobroom.

Another review of White’s Stripe transactions showed the Noobroom owner received a total of $6,373,816.57 in another 396,843 payments between October 2017 and September 2018.

After obtaining a warrant from an Oregon court, authorities seized over $4 million in cash and cryptocurrency from White.

Interestingly, the court documents note that “withdrawals from [one of White’s JP Morgan Chase bank accounts] include over $1 million used to purchase cryptocurrency through Coinbase, a virtual currency exchange.”

In addition to the $4 million found in four separate JP Morgan accounts, authorities also seized 31.53 Bitcoin ($254,964), 1,022.39 Ethereum ($211,972), and 5.74 Bitcoin Cash ($2,252) from White’s Coinbase accounts. Although not seized, court documents reveal White also purchased over $72,000 worth of Litecoin. Pretty bullish.

A court has since ordered the IRS to hold the funds until further notice.