Archive / The money
The spreadsheet cost other people far more than it cost the shop
The operator served four years and seven months. Around 5,500 customers got a knock at the door, because the shop kept excellent records while telling them it did not.
Bestellungen.xls
The file was called Bestellungen.xls. Orders.xls. It sat unencrypted on the laptop in the bedroom in Gohlis and held roughly fourteen thousand entries running from December 2013 to the morning of the raid.
It was not a list of transactions. It was, as Motherboard put it, a cleanly prepared and gapless listing of thousands of criminal offences complete with the offenders and their home addresses. Names. Delivery addresses. Order status. Payment data. And a column of bitcoin addresses, which meant that where investigators could tie an address to a person - and German exchanges were handing over user data on police request - they had proof of payment as well as proof of order. The shop had also recorded parcel tracking numbers, which the carrier could confirm against delivery. Order, payment, delivery: the complete evidential chain, in one spreadsheet, filled in by the defendant.
It had been kept for the most ordinary reason imaginable. It was business intelligence. The operator had told Motherboard that customer and purchasing behaviour were analysed from the very beginning, and this is what that analysis ran on. The instinct that made the shop good is precisely the instinct that destroyed everyone who used it.
What happened to the customers
The Leipzig prosecutor’s office confirmed the numbers to Motherboard in October 2017, two and a half years after the raid, and they were still working through the file. Four thousand five hundred and sixteen people in Germany were investigated on the strength of the list. Around a thousand more proceedings were opened outside Germany. Jurisdiction followed the accused’s home address, so the spreadsheet was distributed from Leipzig to prosecutors in all sixteen federal states, and a senior prosecutor confirmed that all sixteen were working it.
A defence lawyer in Düsseldorf who acted for several of them described the clients’ reaction to learning the list existed in a phrase that translates roughly as everything falling out of their faces. He also made the fair point that plenty of buyers had been naive, and that the list was not the only reason they were in trouble.
Aside from the Chemical Love case, it was at the time the largest publicly known instance anywhere of police obtaining that volume of customer data from the arrest of a single online dealer.
Where the money went
The revenue figures vary with what is being counted. Around €4.1m is the value most often attached to the case and the number Netflix used. About €4.4m is cited as the bitcoin received across the whole trading period. At its peak the shop was turning over up to €200,000 a month. Police found €48,000 or €49,000 in cash in the flat.
The rest has never been satisfactorily accounted for. Not every wallet was decrypted. German outlets were still asking where the millions had gone nearly a decade later, and the asset-recovery side of the case generated its own litigation and its own reporting about the cost to the Leipzig authorities of pursuing it.
Why this archive does not trace the bitcoin
It would be the obvious thing to attempt, and this archive tried. It cannot be done from public material, for a specific and documentable reason.
The operator told Motherboard that every order was assigned its own bitcoin address, deliberately, so there was never one large pot. Those addresses were generated at checkout. Checkout sat behind a cart, and no crawler ever completed one. Searching every capture of the shop held by the Internet Archive returns no payment address at all; the only checkout artefact that survives anywhere in the record is a WooCommerce JavaScript file, cart-fragments.min.js, which is useful for dating the software and useless for anything else.
The addresses that would seed a trace exist in exactly one place: the bitcoin column of Bestellungen.xls, which is in the hands of German prosecutors and has never been published. Without a single confirmed address there is nothing to follow, and inventing a starting point would produce a chart that looked authoritative and meant nothing.
If a wallet address is ever published in a judgment or a court filing, the analysis becomes straightforward and this page will carry it. Until then, this section stays a statement of what cannot be known.
The arithmetic nobody does
Set the two ledgers side by side. On one, a nineteen-year-old trainee waiter took roughly four million euros in fourteen months, served four years and seven months, and came out at twenty-four with a substantial and largely unrecovered sum somewhere.
On the other, five and a half thousand people who bought something from a website acquired a criminal investigation, because the person they bought it from was conscientious about record-keeping and untruthful about deleting it.
That is the reason this archive exists in the shape it does. The shop is genuinely fascinating as a piece of web history - the WooCommerce install, the star ratings, tthe shop published delivery metrics, the joke about Australian customs. The cost of it landed almost entirely on people whose names are in a spreadsheet nobody will ever read.