Max Butler had an audacious plan to rule the black market in stolen credit cards. But angry hackers and pesky Feds had other ideas.

Spread Photo: Mark King; Mugshot of Max Butler: Courtesy Santa Clara County SheriffThe heat in Max Butler's safe house was nearly unbearable. It was the equipment's fault. Butler had crammed several servers and laptops into the studio apartment high above San Francisco's Tenderloin neighborhood, and the mass of processors and displays produced a swelter that pulsed through the room. Butler brought in some fans, but they didn't provide much relief. The electric bill was so high that the apartment manager suspected Butler of operating a hydroponic dope farm.

But if Butler was going to control the online underworld, he was going to have to take the heat. For nearly two decades, he had honed his skills as a hacker. He had swiped free calls from local telephone companies and sneaked onto the machines of the US Air Force. Now, in August 2006, he was about to pull off his most audacious gambit yet, taking over the online black markets where cybercriminals bought and sold everything from stolen identities to counterfeiting equipment. Together, these sites accounted for millions of dollars in commerce every year, and Butler had a plan to take control of it all.

Settling into his chair and resting his fingers on his keyboard like a concert pianist, Butler began his attack. Most illegal online loot was fenced through four so-called carder sites—marketplaces for online criminals to buy and sell credit card numbers, Social Security numbers, and other purloined data. One by one, Butler took them down. (This story, like the rest of this article, has been reconstructed using court documents and conversations with friends and associates; Butler declined to be interviewed.) First, he breached their defenses, tricking their SQL database servers into running his own commands or simply slipping in with a hacked password. Once inside, he sucked out their content, including the logins, passwords, and email addresses of everyone who bought and sold through the sites. And then he decimated them, wiping out the databases with the ease of an arsonist flicking a match. He worked for two straight days; when he tired, he crashed out on the apartment's foldaway bed for an hour or two, then got up and went back at it. Butler sent an email under the handle Iceman to all the thieves whose accounts he had usurped. Whether they liked it or not, he wrote, they were now members of his own site, CardersMarket.com. In one bold stroke, Butler had erected one of the largest criminal marketplaces the Internet had ever seen, 6,000 users strong.

The takeover was all business. The stolen-data market had become fractured across too many sites, and they were pocked with snitches and security holes. By taking control of the entire underworld, Butler had created a marketplace he could trust. Even more important, it satisfied his competitive urge. Offline, Butler was a gentle giant with a generous nature and hippie sensibilities. But in the privacy of his hidden redoubt, Iceman pursued his online enterprise with ruthless zeal. He wasn't after money, not really. He just wanted to prove that he was smarter, bolder, and tougher than everyone else.

The hostile takeover was Butler's crowning achievement, but it also marked the beginning of his downfall. His actions made him a target of law enforcement, to whom he represented the epitome of a new kind of computer criminal: mercenary cybercrooks who were emerging as a far greater Internet scourge than recreational hackers. The growth of carder forums allowed thieves around the world to purchase data, equipment, and services. Since 2005, hackers and corrupt insiders have stolen more than 140 million records from US banks and other companies, accounting for some $67 billion in losses each year, according to the FBI. In 2002, FBI director Robert Mueller listed cybercrime as one of the bureau's top priorities, below only terrorism and foreign espionage. Butler's power grab planted him directly in the Feds' kill zone.

In the days to come, his vanquished competitors raged against the forced merger, fought to regain their users, and staged limp counterattacks. If Butler was at all intimidated by the forces mobilized against him, he didn't show it. "Basically," he wrote later, the consolidation "was long overdue." He was fearless and doomed, just as he had always been.

From the start, Max Butler, now 36, struggled to find his place in the world. The older of two children, he grew up in Meridian, Idaho, a computer geek in a rural town where rodeo champions got all the girls. When he was 14, his parents divorced. Butler found a community in the local BBS scene. Computers provided an alternate reality, a place where every problem could be solved by will, guile, or reason. Hacking was even more exciting, adding an adventuresome, competitive dimension. By high school, friends say, Butler was dabbling in computer and phone hacking, carting printouts of the hacker zine Phrack to class and phreaking free phone calls.

Max ButlerHe was also developing an aggressive streak. A fit 6'5", he was one of the few geeks who could stand up to the cowboy-hatted bullies who taunted his friends at every corner. But he wasn't just pugnacious; he was troubled. In his junior year, he broke into his high school, scrawled messages on the chalkboards, and sprayed a fire extinguisher in the halls before plundering the supply closet in the chemistry lab; psychiatrists later diagnosed him with bipolar disorder. In 1990, his freshman year of college, his girlfriend of eight months told him she wanted to see other people. Butler took the breakup badly, phoning her repeatedly and hinting at suicide. When she visited him at his mother's house to talk him down, he put his hands around her throat and said he would kill her. Butler was charged with assault with a deadly weapon—his hands. In 1991, a jury found him guilty, and he received a harsh five-year sentence.

Butler emerged from prison in 1995 and tried to start over. He eventually took a new name—Max Vision—and moved to the Bay Area, where a few fellow Idaho geeks had coalesced after college. The group rented a mansion overlooking Half Moon Bay, a sleepy town on the Pacific 20 miles from Silicon Valley, where the dotcom economy was swelling to ripeness. They transformed the house into a geek paradise, pimping it out with high-performance game machines and strewing Cat 5 cable through the halls. When the sun went down, Butler celebrated his freedom at all-night raves in San Francisco. At one, he met a cute college student named Kimi Winters and invited her to a party at the house the next night. Six months later, they were married.

Now in his mid-twenties and thinking about settling down, Butler started a consulting business, renting himself out as a hacker for hire. He earned more than $100 an hour performing penetration tests for corporate clients while also volunteering his whitehat skills for the FBI's San Francisco office. But it wasn't enough. For a real hacker, sniffing out a system's defenses with the owner's consent is like watching porn when you could be having sex. And so, friends say, he spent his off-hours traipsing through private networks—the very kind of trespasses he spent his days defending clients against.

In spring 1998, his double life collapsed. Internet experts had found a security hole in the ubiquitous BIND name server daemon. If left unpatched, the hole would allow attackers to seize control of hundreds of thousands of machines. Butler took it upon himself to break into federal sites and fix the error. While he was at it, though, he installed a small backdoor, leaving himself an entryway into government and military networks around the country.

Pop-ups informed Butler every time his backdoor finished installing, and soon his computer screen exploded with alerts: military bases, nuclear laboratories, the US Departments of Commerce, Transportation, and the Interior, even the National Institutes of Health. Then, a few weeks later, there was a knock at the door. It was the same FBI agents he'd been helping as a volunteer, accompanied by a young Air Force investigator who had traced Butler through his pop-up notifications. Three years after he had emerged from jail with an opportunity to reboot his life, Butler was headed back inside.

In May 2001, he was sentenced to 18 months in Taft federal prison. Two months later, Winters told him over the phone that she wanted a divorce. She'd met someone else. "I don't know if you even think about the future anymore," she said.

Butler shouted and pleaded. In search of closure, his wife traveled to Taft, 300 miles southeast of San Francisco. When Butler was brought in, he fruitlessly appealed to her to change her mind. He did think of the future, he told her, and he'd been making plans. "I've been talking to some people," he said, lowering his voice. "People I think I could work with."

Jeff Norminton was finishing an 11-month stint at Taft for wire fraud when he met Butler. He was struck by the affable geek's obvious talent. The duo took daily walks in the yard, an associate says, fantasizing about working together when they got out. Butler could crack brokerage houses, where they'd tap into trading accounts and drain them into off-shore banks. One big haul and they'd have enough cash for the rest of their lives. (Norminton declined to comment for this article.)

It's the kind of talk hackers routinely indulge in when they hit the joint and mix with career criminals for the first time. After they get out, the schemes are usually forgotten. So it was for Butler, initially. In 2002, he was released from Taft to a halfway house in Oakland. Ordered to get a job or go back to prison, Butler offered his services at discount prices. "The last half-dozen employers I have had paid me at least $100/hr for my time," he wrote on a computer security job board. "Now I am only asking for $6.75."

A Berkeley company answered his plea, and Butler moved in with his new girlfriend, Charity Majors—a sysadmin at a porn site who painted her fingernails the color of Skittles and wore contact lenses that tinted her eyes an impossible emerald. The combination of low salary and expensive new apartment left him gasping for cash. When Norminton called to continue their prison-yard planning, Butler listened. Norminton wanted to hook Butler up with one of his associates. Christopher Aragon had recently run an Orange County leasing company, had access to cash and, just as important, had a good reputation in the criminal underworld; when he was 18, he had driven the getaway car in a trio of Colorado bank robberies. He served eight and a half years and never snitched.

Christopher AragonNorminton invited Aragon to San Francisco, where they met with Butler at a North Beach coffee shop. "This is the guy who's going to help fund our expedition," Norminton told Butler with a grin. The three talked for hours—Aragon and Butler were both vegetarians and shared Age of Aquarius philosophies—then headed to a nearby Holiday Inn, where Butler performed a demo, staging some rudimentary hacks. Aragon was impressed. Butler gave him a shopping list of equipment he'd need to get started, including a new laptop, military-grade crypto, and an antenna.

Butler had gotten out of jail just in time for the cybercrime gold rush. In 2002, the first generation of carder forums was infusing the underground with an entrepreneurial esprit de corps never before seen. For the first time, an identity thief in Denver could buy stolen credit card numbers from a hacker in Moscow, send them to Shanghai to be turned into counterfeit cards, then pick up a fake driver's license from a forger in Ukraine before hitting the mall.

But hacking from home was for idiots and teenagers; it was too easy for law enforcement to trace an IP address and subpoena the ISP for the location. So, according to Aragon, once a month he and Butler headed to downtown San Francisco, where the pair would check into a hotel—the Hilton, Westin, W, Hyatt—for up to a week at a time. They would sneak Butler's antenna into the room and mount it on a tripod duct-taped to the floor near the window. Butler would putter for a while to locate a high-speed wireless connection with a strong signal that he could hop onto and use anonymously. If he came up dry, Aragon ran down to the front desk to ask for a different room, explaining that he couldn't get a cell phone signal or was too afraid of heights to remain on the 20th floor.

Aragon remembers that Butler, rusty from his time in prison, started by attacking easy targets: other hackers, a breed that had evolved as all teeth and no shell. He lurked in online chat rooms, sniffing out the most vulnerable cybercrooks and tapping into their systems. He vacuumed up everything—stolen identity information, passwords, PINs. The most valuable goods were "dumps," the magnetic-stripe data on the backs of credit cards, filched primarily by corrupt restaurant wait staff and gas station attendants wielding pocket-size skimmers. Stealing credit card numbers was a way to dupe lenders without directly harming innocent consumers, who aren't held liable for fraud—an added benefit for the humanist Butler.

When Butler scored dumps, Aragon went to work, hurriedly stamping out bogus plastics using an embosser, a card printer, a heat foil press, and an MSR206 magstripe writer. The cards entered Aragon's assembly line as white plastic and emerged as near-perfect full-color forgeries, complete with holograms. As soon as the ink was dry, Aragon and his friends went shopping for luxury items that could be easily fenced. Timing was key; they had to grab the freshest dumps, press them in plastic, and buy as much as they could before the crooks who had purchased or stolen the numbers maxed them out first.

After months of ripping off crooks, Butler started knocking over primary sources. According to court documents, he picked his targets from the FDIC's Web site, choosing small regional banks and credit unions that couldn't afford top-notch security and pulling down virgin card numbers. He sold the goods to Aragon—for $5,000 to $10,000 a month—who, back in Orange County, hired a shadow staff: an assistant to help with card-printing and programming and pretty young women to shop at high-end department stores with his plastic. Their job was to snap up designer handbags, jeans, shoes, and watches for resale on eBay in exchange for a percentage of the profits. The work was easy to love; the first time a new hire swiped one of Aragon's cards and saw approved flicker on the PIN pad, she was hooked.

By late 2003, Aragon's enterprise was paying his rent and sending his oldest son to private school. But as the money poured in, the onetime bank robber found less-wholesome uses for it. Some members of the Orange County crew liked to party, Aragon says, and cocaine, ecstasy, and pot beckoned. Aragon began vanishing with his comely employees for weekend bacchanals in Vegas. (Butler preferred an ascetic lifestyle; a big-screen TV was his only indulgence.)

Charity Majors and MaxSuccess introduced fractures into Butler and Aragon's friendship. Butler worried that his partner's drug use would make him reckless, and he began pestering Aragon for a larger share of the profits. In April 2004, Aragon tried to pass a few suspicious cards at the front desk of the San Francisco W Hotel. That slipup earned him an arrest, three years' probation, and a lifetime ban from the W. It was the kind of bullshit bust that happened to Aragon's staff all the time—a local police matter with no serious follow-up investigation—but to Butler, it was unforgivably sloppy. He started looking for other buyers for his wares.

For most cybercrooks, that would mean creating an account on Shadowcrew, a 4,000-member carder site. Butler logged in—as Iceman—but soon grew suspicious. One of the site's admins, who went by Cumbajohny, was encouraging members to use an invitation-only virtual private network to evade surveillance. This gave Cumbajohny an exclusive peephole into members' activities. The offer apparently spooked Butler, who kept his distance. Sure enough, four months later Cumbajohny was exposed as a snitch when the Secret Service rounded up 28 Shadowcrew members and shuttered the site. Operation Firewall, as it was dubbed, was the largest-ever law enforcement operation against the computer underground. US attorney general John Ashcroft declared the sting the first major victory in a war against carders.

Butler's prudence had kept him safe. Even though new online forums popped up, he decided to build his own, CardersMarket. He incorporated the standard features: Vendors submitted their product to an approved reviewer, who ran test transactions. Fake IDs or bogus plastics were scrutinized for fuzzy logos, missing microprint, and signature panels that couldn't take ballpoint. Buyers were rated on each transaction. And vendors who didn't deliver what they promised saw the epithet "ripper" branded across their profile—the equivalent of a single-star review on eBay. Butler assembled a team of handpicked admins—trusted forum capos with the power to delete posts, ban users, and appoint reviewers. One of them, Gollumfun, had survived Operation Firewall and enjoyed a sterling reputation in the underworld. Another, Zebra, was a teenager from New York who Butler thought could become a partner some day. Butler also gave Aragon admin status—presumably a salve for the sting of Butler's mercantile infidelity.

His dependence on admins may have been necessary, but it was increasingly risky. In May 2000, the US Sentencing Commission had changed the penalties for possession of stolen credit cards. Previously, sentencing guidelines had punished thieves in proportion to how much money they stole. That worked great with low-level credit card cashers but not at the top of the distribution chain, where kingpins sit on thousands of untapped accounts. Letting them off the hook was like granting probation to a drug lord because his bricks of heroin hadn't yet found their way into a junkie's veins. Under the new rule, every stolen card number, used or not, was valued at sentencing at an arbitrary minimum of $500. Get caught with 1,000 numbers—an afternoon's work for a decent vendor—and you might as well have transferred $500,000 in cash, a crime worth about 10 years in the joint. Byte for byte, stolen cards now carried more prison time than child porn.

CardersMarket was an instant success. Butler ran the site under his Iceman identity and created two more usernames—Digits and Darkest—behind which he sold goods, Feds say. Butler expanded from banks to credit card transaction processing centers, as well as small restaurants and retailers, where he became an expert at smuggling sniffers onto point-of-sale terminals. He distributed price lists to potential buyers: $12 for Visa Classic, $19.50 for Visa Gold, $16.50 for MasterCard, $36 for American Express. Inquire for volume discounts. Within a year, CardersMarket had signed up 1,500 buyers, sellers, and scenesters, as many as any of its rival sites.

Butler wanted more. A fluent Russian speaker—a young Mongolian immigrant named Tsengeltsetseg Tsetsendelger—was brought in to help snag users from Russian and Ukrainian forums. As the operation grew, Aragon worried that Butler was losing focus on the ultimate goal, the big score that could catapult them both out of the crime business for good. But while Aragon craved a return to life as a legitimate entrepreneur, he saw Butler indulging his aggressive tendencies. Butler wasn't looking to escape the criminal underworld—he had new plans to rule it.

Butler spent months plotting to infiltrate and overtake his four competitors, culminating in the two-day hackfest in his overheated safe house high above the Tenderloin. The sites blinked out of existence, their thousands of forum posts later rematerializing on CardersMarket. Iceman now had upwards of 6,000 users on his site, making it by far the biggest carder site on the Internet.

To cope with the inevitable backlash and the increased workload, Butler relied on a new admin, Th3C0rrupted0ne—a well- regarded hacker who had helped run some of the sites Butler absorbed. But not all ruffled feathers were so easily smoothed. CardersMarket banned David "El Mariachi" Thomas, a former FBI operative, from the site. The blackballing sent Thomas into a rage. On public forums, he accused Iceman of working with law enforcement, calling him "Officer Ice" and "a fucking piece of shit on my shoes" and threatened to put a contract out on Iceman's life.

The scuffle exposed a side of Butler that nobody had seen since Idaho. "You better pray to your god that I am never outed," he responded. "Because not only will you look like even more of a jackass than you already do, but then I will have no inhibition about coming over and wringing your snitch punk neck."

Thomas wasn't the only one gunning for Iceman. In October 2006, a USA Today reporter contacted Butler for a story about the CardersMarket takeover and the fear that the consolidation could spark a new wave of cybercrime. Butler, as Iceman, told him that CardersMarket was just a service he offered to the public, like craigslist. "You don't see me ... engaging in any commerce."

Butler's comments didn't make it into the piece, but Aragon was apoplectic when he heard about them. He had watched as Butler burned hours squabbling with critics in the underground and pulling unprofitable, altruistic hacks like razing a kid-porn site. Now he was giving press interviews? "You've lost your fucking mind," Aragon told him.

On September 29, 2006, some 500 employees of Capital One received an email from a reporter for Lending News named Gordon Reily, seeking an interview about "the recent leak of customer records from Capital One." In the email, Reily said he got their name from a report that ran in Financial Edge and included a link to the original article. When the recipients clicked on the link—as about 125 of them did—they were sent to a blank page. While they puzzled over the empty site, a hidden payload rocketed through Capital One's firewall and onto their machines. In reality, there'd been no data leak at the fifth-largest US credit card issuer; but Reily—or someone using that name—was working on making one happen.

When Capital One security officials learned about the scam, they called the FBI, which referred it to the National Cyber-Forensics and Training Alliance. Founded in 2002, the nonprofit NCFTA acts as a Justice League for hacking, pulling FBI specialists and security personnel from banks and technology companies to share best practices and intelligence. The FBI agents weren't surprised to find that financialedgenews.com had been registered under an alias. But when they investigated the account records, they discovered it had been registered from the same account as another site they'd been watching: CardersMarket.com.

The Feds had some history with Iceman, the mysterious founder of CardersMarket. In 2006, one of their agents, after months of work, had won a coveted admin spot on DarkMarket under the alias Master Splynter. The government was preparing a massive sting—its biggest since Operation Firewall—through the site when, out of nowhere, Iceman shut it down and absorbed its members into CardersMarket. Not only that, he had traced Splynter's IP address to NCFTA offices and was telling everyone in the underground about the embryonic sting. Now the Capital One attack implied that Iceman wasn't just hosting a scurrilous Web site for cyberthieves. He seemed to be a thief himself, and a sneaky one at that.

Butler acted as if he knew the Feds were after him. In November 2006, he declared Iceman's retirement and let it be known that he had handed control of CardersMarket to Th3C0rrupted0ne, then secluded himself. Soon he took back the site under another handle, Aphex. He boosted his physical security, switching safe houses to become a moving target.

But the Feds were working on a secret asset: Jonathan "Zebra" Giannone, the promising young hacker who had served as one of CardersMarket's first admins. Zebra had made a fatal mistake in June 2005, when he sold 21 Bank of America platinum card numbers to Gollumfun for $600. Unbeknownst to Zebra, Gollumfun—whose real name was Brett Shannon Johnson—had recently been popped passing counterfeit checks in Charleston and agreed to serve as an undercover informant; he'd been working out of the Secret Service's Columbia office. Butler had sniffed out the rat quickly and banned him, but not in time to save Zebra. On March 8, 2007, the kid was found guilty of wire fraud and identity theft.

Brett Shannon JohnsonZebra was summoned from his cell in the Lexington County jail in South Carolina a week after his trial. He instantly recognized the Secret Service agents: Bobby Kirby and Brad Smith had been Gollumfun's handlers.

"We want to know who this guy Iceman is," one of them demanded.

The agents called Zebra's lawyer, who consented to an interview in the hope of winning leniency for his client. In a series of meetings over the next three weeks, authorities say, Zebra told them everything he knew: Iceman lived in San Francisco, did a brisk business in dumps, sometimes used the alias Digits to sell his goods, and, most crucially, had a partner named Christopher Aragon.

The Secret Service didn't know much about Aragon, but the FBI had a file on him. Back in 2005, Jeff Norminton had been nabbed on a new fraud charge in Orange County. While locked up, he willingly told the FBI all about Aragon and his partner Max Butler. Investigators never acted on the information. Now all the Feds had to do was get enough solid evidence on Aragon for a search warrant.

A month later, someone else beat them to it. On Saturday, May 12, Aragon was busted by the local police at a Bloomingdale's 20 miles from his house in Capistrano Beach, California, along with an associate who was buying handbags with his fake cards. The detectives got a search warrant for his home and a nearby warehouse and collected hundreds of cards, a computer, counterfeiting gear, and tasting portions of cocaine, pot, and ecstasy. Using Aragon's meticulous business records as a road map, they swept up his cashers and other confederates, making seven more arrests, including Aragon's wife, Clara, who had been fencing handbags on eBay. His mother took custody of the two boys, now 6 and 9.

Aragon's arrest appeared to frighten Butler. He deleted Aragon's CardersMarket account, ditched his cell phone, and found yet another safe house—the Oakwood Geary Courtyard, a corporate apartment building back in San Francisco's Tenderloin district. On June 7, Butler checked out a red Mustang from his neighborhood Zipcar, loaded it with a computer and bag, and drove to the Oakwood. He didn't notice the Secret Service agents watching from the street as he moved in.

__A month later,__Butler jolted awake, shot upright in bed, and blinked fretfully into the darkness of his apartment. It was his girlfriend, Charity Majors; she had crawled into bed next to him, trying in vain not to wake him. Butler was growing more tense every day; he had stopped exercising, and his health was suffering. "Sweetie, you can't keep doing this," Majors murmured. " You're losing focus on who you are and what you're doing."

"You're right," he said. "I'm done."

It was time to get out. Butler's supervised release was over, and getting a job would be easier now without his probation officer looking over his shoulder. But he couldn't bring himself to just abandon CardersMarket, and he didn't trust any of his remaining admins to take the reins. Even Th3C0rrupted0ne, who was devoting 14 hours a day to the site, sometimes behaved suspiciously.

Butler didn't know it, but he was running out of time. In July and August, the Secret Service interviewed Tsetsendelger, his former Russian interpreter, who was on probation after getting caught with Aragon-produced gift cards at an Apple store in Emeryville, California. Meanwhile the FBI won a secret court order that allowed agents to monitor the IP addresses of visitors to CardersMarket's server. It was the modern equivalent of taking down license plate numbers outside a mob hangout, and the Feds knew it was no coincidence that several traced back to broadband subscribers living within a block of the Oakwood. Butler was accessing his neighbors' Wi-Fi, they figured.

Post Street Towers, Max's San Francisco Safe House

Photo: Mark KingOn Wednesday, September 5, Butler dropped Majors off at the post office and directed his cabdriver to the Oakwood. He rode to the fourth floor, unlocked the door, and crashed out on the bed for an uneasy slumber. At about 2 pm, the front door flew open and a half-dozen Secret Service agents rushed the room, guns drawn. They handcuffed Butler and transported him to the nearby federal building for questioning. Two of the agents were dispatched to Majors' apartment. They told her what happened and took her to say good-bye to Butler. "I'm sorry," he told her when she walked in. "You were right."

Months later, Aragon's lawyer gave him some bad news. The Secret Service had cracked Butler's crypto and knew more about the hacker than Aragon did—which meant Aragon would probably never be offered a deal, even if he wanted one. Even more troubling, the lawyer said Butler had about 1 million credit card numbers on his hard drive. Aragon was shocked. All those years they'd spent searching for one big score, and Butler was sitting on enough dumps to set them up for life. Butler never said a word to Aragon.

Aragon's anger faded as he realized the implications for Butler. A million dumps; the sentencing equivalent of a $500 million heist. Butler was potentially looking at the first life sentence in US hacking history.

"I couldn't figure it out; what is this guy doing? Why doesn't he just go get a job? Then it dawned on me, many years later: Max just likes to hack."

Christopher Aragon is in a jail-issue V-neck at the Orange County Central Men's Jail, a grim lockup in the flat, sun-baked center of Santa Ana, California. He's been studying the Bhagavad Gita and reflecting on his life, his friendship with Butler, and the choices that have brought him to the precipice of a final plunge into the justice system.

Seven members of Aragon's old crew have pleaded guilty and received sentences ranging from a few months to seven years. His wife is about to finish her time. Aragon is alone: His bank robbery arrest as a young man and a related conviction for stealing a getaway car count against him under California's Three Strikes law. He's awaiting trial and, if convicted, could face 25 years to life.

Across the country in a holding facility near Pittsburgh, Max Butler has it even worse. He has spent a year in prison awaiting trial. The only deal prosecutors have offered is 30 years instead of life. His lawyer tried to get Butler released on bail, but the judge refused after the Feds speculated that Butler was sitting on vast stores of hidden cash and could easily use his contacts to disappear with a new name. To prove he was a flight risk, they played their trump card: messages between Butler and a Secret Service informant who had infiltrated CardersMarket. In them, Butler revealed the steps he took to cover his tracks after Aragon's arrest—showing his ability to assume fake identities and evade law enforcement. The name was blacked out, but the messages left little doubt as to the snitch's identity. Th3C0rrupted0ne's handle, it turns out, may have had dual meaning.

To his friends, Butler seems at peace with his confinement, as if he feels he deserves to be in jail for a while. He speaks daily with Majors, in long conversations more intimate than any they had while he was immersed in his double life. And he has made some like-minded acquaintances in the joint. They've started a Dungeons & Dragons campaign together. But this time, he isn't thinking about what he's going to do when he gets out of prison. Finally, it seems like Max Butler has nothing left to prove.

Kevin Poulsen (klp@well.com) is a senior editor at Wired.com, where he edits the blog Threat Level.

Coverage from Threat Level1. Cybercrime Supersite 'DarkMarket' Was FBI Sting2. I Was a Cybercrook for the FBI3. Stakeouts, Lucky Breaks Snare Ten in $2 Million Citibank ATM Heist4. Underground Crime Economy Healthy, Security Group Finds5. Feds Charge 11 in Breaches at TJ Maxx, OfficeMax, DSW, Others6. Indicted Federal Informant Allegedly Strong-Armed Hacker Into Caper That Drew 9-Year Sentence7. Secret Service Operative Moonlights as Identity Thief8. Crazy-Long Hacker Sentence UpheldSecret Geek A-Team Hacks Back, Defends Worldwide Web

The Seven Best Capers of 2008