The Alleged Scammers Behind the Most Notorious Murder-for-Hire Site Have Been Arrested

Five men believed to be behind the web’s most notorious murder for hire scheme were arrested in Romania this week, in part of an operation aimed at putting an end to the infamous dark web scam. 

Since its inception in the 2010s, the operation has funneled users searching for ways to hire an assassin online to a site on the dark web. That site has gone by a series of different names; Besa Mafia, Camorra Hitman, and, most recently, the #1 Hitman Marketplace. Once there, users were asked to submit their target, information about how and when they would like them killed, and to pay a fee, typically $5,000-20,000, in Bitcoin. 

The site was quickly identified as a scam, and yet thousands of orders flowed in over the years, along with plenty of paying customers. Husbands ordered hits on their wives, business partners sought assassins for their colleagues, a man who lost money on a sports betting website asked to murder the customer service rep who failed to return it to him, and a predator paid to arrange the death of a 14 year-old boy. 

Romania’s Directorate for the Investigation of Organized Crime and Terrorism (DIICOT) says that it led the raids at the request of the United States; the Department of Homeland Security and the FBI have been investigating cases related to the operation for years. In a statement made after the arrests, DIICOT said that “authorities in the United States of America have determined that this group consists of five or more persons located in Romania, who acted in a coordinated manner to administer those sites and to launder money obtained as a result of instigating crimes to kill.” Five individuals and four witnesses were detained in the operation, a video of which the agency released along with the announcement. 

The security analyst Christopher Monteiro gained access to the backend of the first scam site run by this group, Besa Mafia, in 2016, allowing him to see a full inventory of the ordered “hits,” which he would then pass along to the authorities. He published a number of blog posts exposing the operation, which angered Yura enough to hire someone to threaten him personally. 

The operation is a scam, but its users are serious about their purchase, and intend to inflict real harms. Monteiro has access to this “kill list,” which I have viewed. Some of the names on that list now belong to homicide victims, killed by the person who originally made the order. Others know that someone in their lives wants them dead, which amounts to a unique form of psychological abuse. I reported extensively on the operation, and the database of evidence it yielded, for Harper’s Magazine in 2020. After years of mostly ignoring his tips, in 2020, authorities began taking them seriously. Since then, Monteiro estimates that around 25 arrests have been made of individuals who have paid to have people killed through the website. (Neither DIICOT nor the DHS immediately responded for a request for comment.)

But the team behind the site orchestrating it all remained elusive. For years, authorities were unclear who was behind the operation; all communications were conducted by a figure who went as “Yura.” Yura would communicate with users who sent messages inquiring into the hitman services, encouraging them to order and easing their concerns in broken English. It was long believed, on the evidence of those chat logs, that he or they resided in Eastern Europe, and Romania, which has a reputation for fostering a culture friendly to web scammers. Yura even conducted interviews, his voice disguised, for TV segments; and yet his identity and whereabouts were unknown. 

Even after the raids, it’s still unclear whether this was the work of one person who grew an operation to the point it needed support from a team, or if it was always a larger effort. The website itself evolved over time, from a clunky and simple page reminiscent of Geocities-era web to one that hosts putative forums, user profiles, and a (slightly) more modern design, replete with gruesome images intended to relay a proof of concept. 

The DIICOT says that the damages of the operation are believed to be around 500,000 euros, though if the scammers held onto the bitcoin they collected back in 2016, it would be worth far more than that today. And whether it’s enough to shut down the operation for good is an open matter; it is easy enough for another to keep running the scam. Furthermore, there are still thousands of people who have contacted Yura about hiring a hitman, and submitting the name of a person they want dead.

This is why Monteiro is ambivalent about the news of Yura’s apparent apprehension, despite years of working to shed light on the operation and its victims. “It's great an international law enforcement operation took down these criminals, but when will they ever proactively investigate the thousands of names on the kill list?” Monteiro wrote me in a message. 

Finally, even if Romanian authorities and U.S. agencies do manage to shut Yura’s operation down, it has already proved successful enough to inspire copycats around the web. Another site, which appears to be operated by different people, and claims to serve the Russian region primarily, is fully operational. I downloaded a Tor browser and logged on, found a link to the Telegram chat of the “Jabba Syndicate” and inquired into getting a hitman in Los Angeles. They replied within minutes. 

Yes, they could get someone to do the elimination right away. It would cost $15,000.