Empire Vendor “TheQueensHive” Pleads Guilty to Drug Charges

A man from New Mexico admitted selling methamphetamine, LSD, and MDMA through a vendor account on the darkweb.

In federal court in Brooklyn, defendant Gilberto Melgarejo pleaded guilty to conspiracy to distribute and possession with intent to distribute. Melgarejo and his co-conspirator Brooke Gray operated a vendor account on Wall Street Market and Empire Market under the username “TheQueensHive.” Gray pleaded guilty to the same charges on August 10, 2021.

The investigation followed the pattern seen in the vast majority of darkweb investigations. In a criminal complaint, U.S. Drug Enforcement Administration (DEA) Special Agent Allan Liefke wrote that investigators had identified the TheQueensHive account on Wall Street Market as a target in either 2018 or early 2019. Recurring investigative methods included undercover purchases, viewing surveillance footage, blockchain analysis, subpoenas to financial service companies, and open-source intelligence gathering.

A picture of TheQueensHive had profiles on Empire and Wall Street Market | Recon

TheQueensHive had profiles on Empire and Wall Street Market | Recon

In 2019, undercover DEA employees in New York conducted several undercover purchases from TheQueensHive account on Wall Street Market. The purchases and deliveries occurred as expected. However, investigators quickly had the defendant on camera. After receiving the package, investigators reviewed information from the United States Postal Service (USPS) to find out where the package had entered the mail stream: a Speedway gas station located at 6570 Paradise Blvd NW in New Mexico. Investigators reviewed footage obtained from the Speedway and identified a hispanic male who arrived at the gas station in a silver Honda Civic and a package wrapped in gold foil. After entering the Speedway, the suspect, later identified as Melgarejo, placed the package inside a USPS envelope. Special Agent Liefke noted that the gold foil packaging matched the packaging received by the DEA after ordering methamphetamine from TheQueensHive.

A picture of Apparently one can mail USPS packages at gas stations in New Mexico | Google Maps

Apparently one can mail USPS packages at gas stations in New Mexico | Google Maps

The DEA conducted numerous undercover purchases from the vendor on Wall Street Market (WSM) and then switched to Empire Market after law enforcement had seized the WSM servers. In later surveillance footage, investigators spotted a second defendant, later identified as Gray, accompanying Melgarejo at the Speedway.

After establishing a relationship with the vendor, investigators started conducting controlled purchases through an unidentified “text message application.” Given that vendors have historically provided their Wickr account information to customers in an attempt to avoid marketplace fees, the application referenced is likely Wickr.

TheQueensHive, through the application, provided investigators with a Bitcoin address for payment. Investigators immediately identified the Bitcoin address as one linked to a Bitcoin exchange company. The company remains unidentified in the criminal complaint but various pieces of information in the document point to Coinbase as the company in question.

Vendors constantly use Coinbase. The exchange allowed users to convert Bitcoin to USD in minutes. The exchange allowed users to cash out to a PayPal account. Timestamps in the complaint show that within the space of five minutes, the defendant had received Bitcoin, converted it to USD, cashed out to PayPal, and sent it to their bank account. Before Coinbase supported instant withdrawals to certain bank accounts, Coinbase allowed instant withdrawals to PayPal.

A picture of Coinbase now allows instant withdrawals in certain cases.

Coinbase now allows instant withdrawals in certain cases.

In July 2019, after conducting an undercover purchase from the vendor, the DEA established surveillance at the Speedway and obtained the Honda Civic license plate number. The accessed the vehicle registration database provided by the New Mexico Department of Motor Vehicles (DMV). A search of the database revealed that Melgarejo owned the car. Investigators then searched the DMV driver database for Melgarejo and matched the man caught on the surveillance footage with Melgarejo’s ID picture.

During the investigation, the vendor provided the undercover DEA employee with a phone number they could use to conduct business. The phone number was associated with the unidentified “Application 2,” investigators learned. That application was associated with a Google Email (Gmail) account. Records from Google revealed that the I.P. address used to access the Gmail account belonged to the internet service provider (ISP) CenturyLink. Records from CenturyLink identified the account holder associated with the I.P. address lived at a house owned by Gray’s father.

A picture of Between February and September 2019, Gray received more than $18,000.

Between February and September 2019, Gray received more than $18,000.

A search of public records revealed that Gray used a phone number associated with an AT&T account. Records from AT&T revealed that Gray’s mother, who lived at the same address as her father, owned the AT&T account. The DEA knew the phone numbers Gray had contacted between August and September 2019. Although the complaint does not indicate the method used to obtain this information, one can only assume they obtained authorization to install a pen register or trap and trace device. Gray’s number had sent more than 300 SMS messages to a specific number during the timeframe specified above. Records from the cryptocurrency exchange indicated that the number in question belonged to Melgarejo’s exchange account. The same records revealed that the same phone number had accessed an exchange account under Gray’s name. The DEA also obtained information from CenturyLink that associated the Gray I.P. address with Melgarejo’s cryptocurrency exchange account.

They were both arrested on November 14, 2019, in Albuquerque, New Mexico.

Although the actual sentence will likely be much shorter, the charges allow for a maximum prison sentence of life.

Complaint (pdf)

Do you really want to comment here? not rules
c8b4b010 Sat, Sep 11, 2021

couple hundred sales and popped and only 18K. for n e one looking to start vending do exactly what they did but the opposite lol.

17976000 Sun, Sep 12, 2021

It was a lot more than a couple hundred sales when you consider the number of direct sales he must of done off the books on wickr.

d1332160 Sun, Sep 12, 2021

The lack of common sense is unbelievable !! Coinbase, Paypal, Google, ATT&T Account. Using the same drop, the gas station. Having a fucking partner, unless one of them had the connect and the other thought they had some tech skills. Vending should be a solo operation ALWAYS !! The only person that should know you move product is the connect, period. Why anyone thinks or wants a partner shows a weakness. It says to me they’re scared to roll solo. I get if you’re running something out on the streets like a trap or a delivery service, but on the DM, nah. What people don’t get is your “boy”, “homie”, “partner” will be the first to snitch you.

02ab4b40 Wed, Sep 15, 2021

lls nah fr but at the same time her only partner was the connect

08b1ce10 Wed, Sep 15, 2021

lls nah fr but at the same time her only partner was the connect

5f99afa0 Tue, Sep 28, 2021

Totally agree about the partner. That at minimum doubles your risk of getting caught. Very dumb

ae709f50 Fri, Sep 17, 2021

direct btc address to dea from personal registered coinbase account instantly cashed out to real paypal and then transfer direct to personal bank account. what could go wrong. W T F

abfc8390 Wed, Sep 22, 2021

Crazy. Why did the feds go after this vendor? Why did they choose him?

4333f150 Wed, Sep 29, 2021

low-hanging fruit…. it makes their numbers look better when they can’t catch everyone else

New comments are disabled after ten days in an attempt to limit spam.