iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Investigators did not identify Welcome to Video users from a Bitcoin address alone. They followed payment flows on Bitcoin’s public blockchain, linked those flows to cryptocurrency services, obtained account-holder records from exchanges, and combined that evidence with server seizures and international police work. That process helped expose the Tor-based site, identify users, and rescue victims.
The historical 2019 headline used the term “child porn.” Contemporary usage is child sexual abuse material (CSAM) or child sexual exploitation material.
What Welcome to Video was—and when the investigation happened
Welcome to Video operated as a Tor-hidden service and accepted Bitcoin for access to child sexual abuse material. The U.S. Department of Justice (DOJ) said its investigation began in August 2017, focusing on illicit virtual-currency transactions on the darknet.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSouth Korean police seized the site’s server and arrested its operator, Jong Woo Son, on March 5, 2018. The operation involved the U.S. Internal Revenue Service Criminal Investigation, Homeland Security Investigations, the United Kingdom’s National Crime Agency, and South Korean National Police. The DOJ announced the U.S. indictment and coordinated actions against users on October 16, 2019. Son had also been charged and convicted in South Korea and was serving a sentence there; that conviction is distinct from the U.S. indictment.
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
How investigators followed the Bitcoin
1. They started with transaction flows
Bitcoin transactions are recorded on a public ledger. The ledger can show when value moves between addresses and can reveal repeated payment patterns or connections among addresses, but it does not display a payer’s legal name. Investigators therefore treated blockchain data as a source of leads, not as a complete identity database.
DOJ Deputy Assistant Attorney General Richard Downing said in prepared remarks at the October 16, 2019 press conference: “By following the funds on a blockchain, it ultimately uncovered the severity of Welcome to Video, a Tor network-based child pornography site that accepted payment in bitcoin.”
Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
2. Unique addresses helped separate users’ payments
According to the DOJ, each registered Welcome to Video user received a unique Bitcoin address. That design gave investigators transaction histories to examine for individual accounts rather than forcing every payment into one undifferentiated wallet.
3. Blockchain analysis pointed to cryptocurrency exchanges
DOJ remarks credited Chainalysis with significantly assisting the tracing. The reported investigative sequence was broader than a single software product: analysis identified cryptocurrency exchanges used by customers, and investigators then contacted those services for account-holder information. Exchange records could connect a blockchain address or deposit pattern with identifying information held under legal process.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
This distinction matters. The blockchain exposed flows and associations; investigative records supplied the bridge from an address or service account to a person. Other evidence—including the seized server, site records, and international cooperation—was necessary to build cases.
From financial leads to arrests and victim rescue
After the server seizure, investigators could compare site data with payment evidence and pursue leads in multiple countries. The DOJ’s October 2019 announcement reported that 337 users worldwide had been arrested and charged and that leads had been sent to 38 countries. Those figures describe the announcement’s status in 2019, not a verified total for every later arrest or case outcome.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
The DOJ also reported that at least 23 minor victims were rescued in the United States, Spain, and the United Kingdom. The investigation therefore used financial tracing as one component of a safeguarding and prosecution effort, rather than treating cryptocurrency analysis as an end in itself.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat the seized evidence showed
The DOJ reported approximately eight terabytes of seized videos and more than 250,000 unique videos. Of the videos analyzed at that time, 45 percent contained images that investigators said were not previously known to exist. That percentage applies only to the material analyzed by the time of the 2019 announcement.
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
The site claimed more than one million downloads, but DOJ presented that as the site’s claim—not as an independently verified count of unique people or confirmed downloads. Investigators also found more than one million Bitcoin addresses on the server. DOJ said that indicated capacity for at least one million users; addresses and capacity do not establish that an equal number of people actually used the site.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why Bitcoin was traceable despite Tor and pseudonyms
Tor can conceal a server’s network location and Bitcoin addresses are pseudonymous, but neither feature erases records. Payments still create durable ledger entries. When addresses interact with identifiable services, leave recognizable patterns, or match records recovered from infrastructure, investigators can combine those links with subpoenas, warrants, exchange compliance data, and traditional police work.
That is why “tracking Bitcoin payments” should not be read as “looking up a name on the blockchain.” It describes a layered process: identify relevant transactions, map flows to services, obtain records held by those services, and corroborate the resulting leads through seized evidence and international investigation.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the case demonstrates about cryptocurrency investigations
- Public does not mean personally identified. Transaction history is visible, while legal identity generally requires additional evidence.
- Privacy layers can raise the investigative cost without making payments disappear. Tor and pseudonymous addresses complicate attribution; they do not remove the financial trail.
- Service providers can be pivotal. Exchange account records supplied information that the Bitcoin ledger itself did not contain.
- Software is only one part of the case. DOJ’s credit to Chainalysis describes assistance with tracing, not an automated verdict about every user.
- International coordination determines impact. The 2018 seizure and 2019 announcement involved agencies in several countries, with leads distributed to additional jurisdictions.
What is—and is not—known from the 2019 announcement
The DOJ figures establish the scale reported at the time: 337 users arrested and charged, leads sent to 38 countries, at least 23 victims rescued, and the quantities of seized and analyzed material described above. They do not, by themselves, establish the final disposition of every defendant, later arrests, or a current worldwide total in 2026.
Futurism’s October 17, 2019 account attributed this warning to then-U.S. Attorney for the District of Columbia Jessie Liu: “You may try to hide behind technology, but we will find you and we will arrest and prosecute you.” In context, the message reflected the combination of blockchain evidence, exchange records, seized infrastructure, and cross-border investigative work.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
