One week after the deadly white nationalist Unite the Right rally in Charlottesville in August 2017, Andrew Anglin, the publisher of the Daily Stormer and one of the rally’s chief proponents, received an extraordinary cash infusion to keep his hate site running.
The amount: 14.88 bitcoin. The figure referenced a 14-word white supremacist credo and the eighth letter of the alphabet repeated. (As in, “Heil Hitler.”) This was one extremist helping another ― and the benefactor was sharing a small part of a $25 million bitcoin fortune.
Over $60,000 dollars at the time, the donation was sizable by any measure. And Anglin had earned it. He’d used the Daily Stormer, the world’s largest neo-Nazi publication, to promote the rally and stoke violence in Charlottesville. (“We want a war,” he’d written in one post.) He’d let extremists use his message boards to plan logistics. When a neo-Nazi rammed his car into counterprotester Heather Heyer and murdered her during the rally, Anglin celebrated the killing on his site the next day.
Domain registrars dropped the Daily Stormer after that. So did Cloudflare, which protected the site from denial-of-service attacks. Anglin was bounced to the dark web. But the shadowy donor soon stepped up with the 14.88 bitcoin donation.
Two years later, we still don’t know who made the donation, but one veteran information security researcher is getting closer. John Bambenek, who is vice president of security research and intelligence for cyber security firm ThreatSTOP, has spent months digging through the byzantine web of bitcoin transactions and discovered that whoever made the donation to Anglin is sitting on close to $25 million in bitcoin.
That small treasury is a potential slush fund for white nationalism ― and controlled by a mystery donor who already saw fit to back Anglin, a neo-Nazi who has called for “an end to what is known as the United States of America” and has said he’d “absolutely and unequivocally” endorse violence to achieve his goals. Anglin’s racist propaganda has already inspired several domestic terrorists, including James Jackson, a white supremacist who stabbed a homeless black man in New York to death with a sword in 2017.
Bambenek was able to trace the mysterious donation because although Bitcoin is anonymous, it’s not private. To send or receive coins, which can be fractional, a user needs a bitcoin wallet. Each wallet has an address made up of a unique sequence of letters and numbers. With a user’s address, you can track how that person sends and receives bitcoin, since transactions are public. And Anglin has for years publicized his bitcoin wallet on the Daily Stormer.
The 14.88 bitcoin donation can be traced back through 29 pass-through wallets, Bambenek said. At the start of the money chain, he found three “origin” wallets transferring a total of 3,301.01 bitcoin among them ― worth almost $26 million today. (More details on the specific wallet addresses are at the end of this story.) All these wallets, Bambenek’s data indicate, belong to the same mysterious owner, who is evidently sloshing millions of dollars in bitcoin around different accounts.
The trail before these origin wallets snakes back into the hazy Wild West days of bitcoin mining, when in 2012 a wallet controlled by an English and Russian speaker either sold or gave 3,900 bitcoin — worth only $42,000 then — to Anglin’s eventual benefactor, according to Bambenek.
Around that time, Anglin, an Ohio native who had been living abroad for years, relocated to Russia. A source familiar with the Anglin family told HuffPost that Anglin’s mother visited him there and, upon her return, found federal agents — most likely with the FBI — waiting for her at JFK airport in New York. Anglin’s father, Greg, an Ohio resident who has played a vital role in moving money for his son, planned to be at the airport “with a lawyer,” said the source, who requested anonymity out of fear of violent retribution from Anglin.
While in Russia, Anglin frequently used the Daily Stormer to heap praise on Russian President Vladimir Putin. Much of the site’s content would seemingly have violated Russian hate speech laws. Anglin, however, appears to have operated freely in Russia. The neo-Nazi’s absentee ballot in the 2016 American election arrived from Krasnodar, a Russian city near the Black Sea. As one of the first white nationalists to endorse Donald Trump’s candidacy, Anglin was, by then, pumping out Nazi-tinctured Make America Great Again propaganda.
“[W]hen people are paying a lot of money to do a MAGA routine, you do it,” Anglin told HuffPost in April. “Money talks.”
Since Jan. 28, 2017 ― just eight days after Trump’s inauguration ― when Anglin received his first donation to the wallet that he advertises on the Daily Stormer, the neo-Nazi publisher has taken in around $260,000 in bitcoin at that single address, according to Bambenek’s data. (Anglin has other wallets and has likely received even more money through bitcoin.)
Anglin’s most lucrative month was August 2017, when he raised around $80,000, most of it from the mysterious 14.88 donation. He also had big months in October of 2017, when he raised $72,000, and in October of 2018, when he got about $50,000.
Today, Anglin’s bitcoin donations have tapered off to under $20,000 per month, in part because he and other extremists switched to harder-to-track cryptocurrencies such as Monero toward the end of 2017, possibly after Bambenek began publishing their bitcoin transactions on Twitter. Anglin, however, claims to still be pulling in the same level of cryptocurrency.
“I make [$]15,000 a week in crypto,” he told HuffPost in April through one of his Twitter accounts. (HuffPost confirmed through Anglin and other sources the account is controlled by the neo-Nazi.) “Business is doing well.”
Although it’s impossible to vet Anglin’s statements about his cryptocurrency income without access to his financial records, $60,000 a month correlates roughly with the amount of bitcoin he earned during his peak in 2017 and 2018. But the 14.88 bitcoin he received after the Charlottesville riot remains the single biggest known donation.
Anglin’s benefactor took pains to obscure the money’s provenance, moving 101 bitcoin from one of the origin wallets through the series of pass-through wallets for over a year. At each stage, the donor bled off a few bitcoin in a pattern familiar to Bambenek called a “peel chain.” Bambenek said Anglin’s benefactor could be sending the smaller bitcoin amounts to himself in order to launder it into Monero.
On August 20, 2017, the 14.88 bitcoin landed in Anglin’s wallet. While it might take a subpoena to unmask the mysterious donor, Anglin’s finances are the subject of multiple court proceedings in the various jurisdictions where he’s been sued because of the harassment and slander campaigns he launches from the Daily Stormer.
Anglin suffered an enormous setback in Ohio federal court on Wednesday after a judge awarded $4.1 million in damages to Dean Obeidallah, a Muslim-American comedian and radio host who sued Anglin for libel after the neo-Nazi tried to frame Obeidallah as the mastermind behind a 2017 terrorist attack in Manchester, England. The ruling could spell the downfall of both the Daily Stormer and Anglin’s extremist career.
At the hearing on Wednesday, Bambenek was called as an expert witness to testify about Anglin’s cryptocurrency finances.
Though Bambenek has the data to prove that Anglin has made a small fortune off his hate site, recovering cryptocurrency is a challenge. Anglin has already converted some of his bitcoin into Monero, according to Bambenek. But the information security researcher believes it would be possible to flag Anglin’s wallets at cryptocurrency exchanges in order to conduct what would amount to a wage garnishment.
Even if Anglin obeys the court order and pays Obeidallah ― or the other plaintiffs who are lining up for damages ― his rich benefactor’s identity might remain a mystery.
Bambenek is “highly confident” that the three origin wallets mentioned in this story belong to the same Anglin donor. HuffPost wants your help finding this person and is listing the addresses of the suspicious wallets below.
The wallet that initially held the 3,301.01 bitcoin: 13P4eHfeYRArfjhF87npd63VPW49KM7QGo
The wallet that initiated the peel chain to Anglin: 1FRXg9JRPpbPJyN5bF1spinTVy5fjDPhUS
The wallet with the $23 million slush fund: 17TZNT8CBPzUPDfKTXC25RQHrW6M2q6kRo
Please send tips to luke.obrien@huffpost.com or lukehuffpost@protonmail.com