A Public Bitcoin Ledger and a Sloppy Homepage Took Down Welcome to Video, and a Seoul Court Still Would Not Send the Operator to America

LONDON — After British investigators finished with Richard Huckle, they did not stop pulling the thread. On his computer was a customer relationship with a hidden site they had not seen before. The National Crime Agency later told the world that the site was called Welcome to Video, that it had run on Tor from June 2015 until March 2018, and that a task force built around it had helped arrest 337 people in 38 countries. The number is the one agencies still quote. The more useful fact is why a site that thought it was invisible was not.

U.S. prosecutors called Welcome to Video the largest child-sexual-exploitation marketplace they had found by volume of content. More than 250,000 unique videos. Downloads running past a million. About 1.2 million user accounts. Roughly 4,000 of those users paid. The library was about eight terabytes. Deputy Assistant Attorney General Richard Downing said nearly half the videos were previously unknown to the National Center for Missing & Exploited Children, which is the detail that separates a warehouse of old files from a market that was paying for new abuse. The site told users not to bother uploading adult pornography. It was selling access to the sexual abuse of children, including infants, and it priced that access in Bitcoin.

Bitcoin was the mistake, and so was the homepage. Agents have described a step that sounds too plain for a dark-web case: in September 2017 they viewed the page source and found an IP address sitting in the open. Another address showed up the same way the following month. Both traced to a residence in South Korea. Separately, the Internal Revenue Service Criminal Investigation division had been following cryptocurrency payments on abuse sites and brought Homeland Security Investigations into the work. Welcome to Video gave each depositor a Bitcoin address that looked unrelated. The addresses were not unrelated. Chainalysis-style clustering of change addresses and common-input ownership pulled them back to one operator, and the operator cashed out through a South Korean exchange that had to know its customer. A subpoena did what Tor did not.

https://www.youtube.com/watch?v=x0AfRoEzO2I

The NCA had reached the site while investigating Matthew Falder, a Cambridge-trained geophysicist. Falder admitted 137 offenses, including encouraging the rape of children and sharing images of a newborn being abused. He is serving 25 years. His machine was a door, not the whole building. Once the server existed as evidence, the NCA, HSI, the IRS, the German federal police, and the Korean National Police Agency could hand user data outward. In Britain, 18 investigations came off that intelligence. Seven men were convicted, with terms up to 15 years. Kyle Fox, then 26, was sentenced to 22 years in March 2019 for raping a five-year-old boy and abusing a three-year-old girl in material connected to the site. Authorities said at least 23 children were identified and rescued in the United States, the United Kingdom, and Spain. South Korean police put the Korean share of the global arrests at 223. The DOJ’s public count of the sweep was 337 suspects across 38 countries. The lists do not have to match line for line to describe the same operation.

The administrator was Son Jong-woo, also rendered Jong Woo Son, then 23, operating from a bedroom, not a cartel. NCA officers traveled to Seoul in March 2018 and helped seize the server. A South Korean court gave him 18 months for running the site. He was released in July 2020. In October 2019 a federal grand jury in the District of Columbia charged him with nine counts, including conspiracy to advertise child sexual abuse material and money laundering. The indictment described on the order of 7,300 Bitcoin transactions. American prosecutors wanted a sentence measured in decades. They did not get the defendant.

Seoul’s High Court refused extradition on July 6, 2020. The legal path to that refusal is the part American coverage often skips. The extradition warrant was framed around international money laundering, a charge that did not overlap with the child-exploitation counts he had already served, which was how prosecutors tried to get past a double-jeopardy objection. At a May 19, 2020 hearing his lawyer raised that objection anyway. On June 16, Son told the court he would accept a severe sentence in South Korea and did not want to leave his family. The court decided his continued presence in Korea would help ongoing child-exploitation investigations. Campaigners, including the Women’s Party of Korea, called the outcome a gift. His father then did something that kept him in a Korean courtroom instead of an American one. Yonhap reported that the father filed a criminal complaint, and that Seoul prosecutors indicted Son in February 2022 for concealing the proceeds. On July 5, 2022, a Seoul court sentenced him to two more years for hiding about 400 million won, roughly $305,000 at the time, that had been laundered through exchange accounts and bank accounts in his name or his father’s, plus about 5.6 million won spent on online gambling. He had admitted the allegations. On November 11, 2022, the appellate division of the Seoul Central District Court upheld the two years and a fine of 5 million won. The United States still does not have him.

NCA investigations director Nikki Holland said at the time of the arrest announcement that dark-web offenders “are not as cloaked as they think they are.” The line held for the users. It held, in a narrower way, for the operator: Korea punished him twice and would not ship him. Welcome to Video remains the case agencies cite when they argue that Bitcoin is a ledger, not a cloak. It sits beside the prison killing of Richard Huckle, whose files came off a different hidden forum, and beside The AEGIS Alliance’s reporting on the Elysium network.

https://twitter.com/CPSUK/status/2105279587223490914

The ledger has a second lesson, and it arrived from inside the agency that helped make the first one famous. On September 30, 2026, the Crown Prosecution Service said former NCA officer Paul Chowles, 44, had been ordered by Liverpool Crown Court to repay £1,810,678.93 after stealing Bitcoin seized in the investigation of a different dark-web market, Silk Road 2.0. He pleaded guilty to theft and money laundering and was jailed for five years and six months in 2025. Prosecutors said he stole 50 Bitcoin. Thirty were later recovered. Luke Clements, a specialist prosecutor in the CPS Proceeds of Crime Division, said Chowles “exploited a position of trust for personal gain, stealing assets that had already been recovered through law enforcement action.” Welcome to Video showed that a public chain can identify a bedroom server in Seoul. Chowles showed that the same coins, once they are in an evidence locker, can be stolen by the officer trusted to watch them. The cloak was never the interesting failure. The custody of the evidence was.

Downing’s warning at the unsealing still sits on the unsolved half of the library. Many of the children in those videos had not been identified. An arrest count of 337 does not identify a child. A refused extradition does not delete a file. The reporting path is unchanged and worth repeating in plain language. In the United States, suspected child sexual exploitation goes to the NCMEC CyberTipline at 1-800-843-5678 or report.cybertip.org. In Britain it goes to the NCA’s CEOP. The AEGIS Alliance’s Crime News and Hacker News files carry the related cases.