Hosting Company Used by Extremists Received $3 Million in Bitcoin After 2021 Hack

An unknown person or group transferred 62.5322 bitcoins, then worth $2,922,069, to a wallet associated with Epik on Sept. 14, 2021, at 10:08 p.m. Coordinated Universal Time (UTC). The transfer took place less than 36 hours after members of the hacker collective Anonymous announced that they had gained access to Epik’s backend servers and exfiltrated over 150 gigabytes of the company’s operations and customer records, including domain purchases, payment histories and account information.

Two days after receiving the nearly $3 million in bitcoin, the person in control of Epik’s wallet transferred the funds, along with an additional six bitcoins, to another wallet. The recipient of nearly 70 bitcoins appears to be Arsyan Ismail, a Malaysian businessman and programmer who, according to social media posts and Malaysian news reports, was accused by his prior employer of being involved in a get-rich-quick scam that authorities in that country estimate defrauded half a million people between 2013 and 2017.

The Data Lab confirmed that the address that received the 62 bitcoins was part of a cluster of addresses belonging to Epik through our comparison of the wallet’s activity on the blockchain and hacked-and-leaked sales records. However, we were unable to determine who owned the wallet that transferred the funds to Epik. The Data Lab identified the proprietor of the wallet that received the 70 bitcoins on Sept. 16 as Ismail through his use of custom wallet addresses containing his first name and the name of one of his companies, as well as a 2014 post that he shared in a bitcoin-focused Facebook group that contained one wallet address.

Epik began accepting bitcoin as a payment type for its services in fall 2016, according to a press release from that time. In a question-and-answer session following the 2021 hack, Epik founder Rob Monster described his company as “one of the first registrars to accept crypto.” Nevertheless, the Epik-controlled wallet, which was active between March 2020 and September 2022, only received a total of roughly 85 bitcoins. As a result, the Sept. 14, 2021, transfer accounts for 74% of the wallet’s total transactions during its lifetime.

Epik is a web services company founded in 2009 by Monster, a businessman based in Sammamish, Washington. Though Monster has denied holding any sympathies for white nationalism, Epik became the web company of choice for the radical right in late 2018.

Hatewatch reached out to Monster over email and through a contact form on the website for his company, Kingdom Ventures. Hatewatch reached out to Ismail over an email on his personal website. Neither of the two men responded.

A who’s who of the global far right

Prominent far-right extremist sites began turning to Epik after Epik’s services helped Twitter knockoff Gab get back online in 2018. Gab had been banned by its prior domain registrar after an October 2018 white supremacist terror attack in Pittsburgh, Pennsylvania.

Since then, Epik has become a haven for websites with ties to right-wing extremism, with its client list representing a veritable “who’s who” of the global far-right movement. Among those who relied on Epik’s services are 8chan, an online message board that has hosted manifestos and livestreams from multiple white supremacist terrorists; Parler, a social media site popular among rioters at the Jan. 6, 2021, insurrection at the U.S. Capitol; and Stormfront, a once-popular online forum founded by Don Black, a former Klansman who was arrested in 1981 for attempting to invade a Caribbean island. Conspiracy theorist Alex Jones, whose junk-news site Infowars helped jump-start the 2021 Capitol insurrection, credited Epik with keeping his network of junk-news channels online.

“We wouldn’t be around if it weren’t for Epik. … They have all the services you need, and they are expanding,” Jones said during an April 2021 broadcast of his show.

The 2021 hack resulted in years of purchase records, company emails and customer accounts – including from Epik’s privacy service, Anonymize, which allowed customers to conceal their identity – being made available to the public. In addition to some 15 million unique email addresses, the customer data exposed by the hack included IP addresses, phone numbers, passwords and mailing addresses. The material allowed activists, journalists and researchers, including from the Southern Poverty Law Center, to identify the once-anonymous owners of numerous websites, including sites with ties to terrorist organizations.

On Sept. 2, 2022, Monster stepped down as Epik’s chief executive officer. Brian Royce, the former executive vice president of operations, replaced him. Monster, meanwhile, assumed a role as chairman of the company’s board of directors. A September 2022 press release announcing the decision presented the company under Monster’s leadership as “a defender of civil liberty.”

Following a March lawsuit leveled against Epik by one of its clients, the company publicly blamed Monster for a scandal involving its proprietary financial product Masterbucks. Launched in 2022, Masterbucks was intended to compete with online money-transferring platforms like PayPal or CashApp, though it was quickly embroiled in controversy after reports of users being unable to withdraw funds. The complaint from the March lawsuit accused Royce and Monster of mishandling and embezzling funds. According to the complaint, Epik owed a client $327,000 after failing to transfer a domain the client had purchased for that amount.

In April, less than a month after the lawsuit was first filed, a series of tweets from Epik’s Twitter blamed Monster for the company’s financial woes and scandals. In one April 14 post, Epik blamed Monster for Masterbucks’ failure, saying that it continued to struggle “to manage debt from his company-wide oversights.” Two days later, on April 16, Epik’s Twitter account stated that the company “requested his resignation from the board over apparent conflicts” with creditors.

Epik issued a press release on June 8 stating that the core domain name registration portion of the company had been sold to a new entity, Epik LLC, which retained Royce as CEO. Monster returned as CEO of Epik Holdings Inc., where he retained ownership of some of the lesser-known products, including Masterbucks. Monster rebranded his share of the operation into a new company called Kingdom Ventures.

Photo illustration of Epik founder Rob Monster (left) and current Epik CEO Brian Royce by SPLC