Everything about it was ordinary except what was in the boxes

1. Gohlis

Maximilian Schmidt was born in 1994 and grew up in Gohlis, a quiet residential district north of the centre of Leipzig. In December 2013, at nineteen, he opened an online shop. By the time it closed he had, on the German courts’ reckoning, handled something in the region of a tonne of controlled substances and taken roughly four million euros.

The detail everyone fixes on is the bedroom, and it is the right detail, but not for the reason it is usually given. It is not remarkable that the stock was in a bedroom. It is remarkable that it needed to be nowhere else. There was no organisation to house, no staff to manage, no premises. The entire enterprise fitted into a room in his mother’s flat because the entire enterprise was a website and a stack of parcels.

2. The stack

Shiny Flakes ran on WordPress. Not a bespoke marketplace, not a hardened darknet platform: WordPress, with the WooCommerce shopping cart plugin, on a commercial theme called Maximize, sitting behind Cloudflare on servers in the Netherlands, with the domains registered through Tonga. It is the same stack a plumber or a village bakery would have been sold in 2013, assembled by someone who read the manual.

Look at what that gave him for free. Product categories. A cart and a checkout. Customer accounts with a lost-password flow. Order statuses - processing, completed, cancelled - that he referred to in his FAQ exactly as any retailer would. Star ratings, which customers used. Product tags, which he used for search. An RSS feed. An XML-RPC endpoint, because nobody ever turns that off.

He was not hiding. There was an onion address, and there were vendor profiles on the darknet markets of the day - Evolution and Agora - but the shop that mattered was on the ordinary web at an ordinary domain, and it was optimised for people who would find it by typing a word into a search engine. The recovered listings carry his keyword tags: koks, schnee, pervitin, emma, mandy. German street names, chosen for search volume. The single most sophisticated thing about Shiny Flakes was its marketing, and the marketing was not very sophisticated. It was merely competent, applied to a market where nobody else was bothering.

The full recovered shop front, with prices, ratings and tags, is on the catalogue page.

3. The voice

What survives most vividly is the tone. The shop wrote to its customers the way a slightly exasperated small business writes to its customers, which is to say without much warmth and with a great deal of process.

ORDER, PAY, RECEIVE. THERE IS NO REASON TO COMMUNICATE.

Shiny-Flakes FAQ (English), captured 4 December 2014

The FAQ set out precisely which three circumstances would earn a reply within twenty-four hours, and stated that every other enquiry would be ignored without exception. It quoted a flat six euro delivery charge. It explained the dispatch window and asked people not to chase before nine working days had passed. It is a service level agreement.

There is a particular kind of confidence in publishing a complaints procedure for a crime. It is the confidence of somebody who has correctly worked out that its customers have nowhere else to go, and it is the same confidence that later let him sit down in front of a Netflix camera. The FAQ is annotated in full here, with the operational passages described rather than reproduced.

4. The mistake was the post office

Nothing about the website brought him down. The cryptography held. The hosting held. What failed was logistics, in the dullest possible way.

Vice’s reporting on the investigation traces the first thread to a package with insufficient postage - an underpaid parcel that drew an investigator’s attention to Leipzig. From there it was a matter of patience, because he had a habit: he used the same automated packing station, number 145, near where he lived, over and over again. A one-man operation shipping thousands of parcels has to post them somewhere, and he had optimised for convenience.

On 24 February 2015, by Vice’s account, a Bulgarian courier delivered a resupply and was arrested in a car park shortly afterwards. The delivery was substantial: twenty-five thousand ecstasy pills, twenty-seven kilograms of amphetamine, twenty kilograms of hash, ten thousand doses of LSD. Police entered the flat in Gohlis, most sources say on 26 February.

And then the case effectively ended, because of two files. On his laptop was a plain text document containing his important logins. Alongside it was a spreadsheet listing every delivery he had made since December 2013, with notes on individual orders. He had built the prosecution’s case for it, in the ordinary course of running a business properly. The same instinct for record-keeping that made the shop work made it indefensible.

5. The police take the address

On 11 March 2015, thirty-eight search warrants were executed and further arrests followed. The same day, the Leipzig police did something that has been under-reported ever since: they kept the domain running and served their own page from it.

A crawler caught it at 20:16:31 UTC. The page title was Sorry :-(. The body was a single image: a Polizei Sachsen recruitment advert reading VERDACHTIG GUTE JOBS - suspiciously good jobs - over a photograph of seven smiling officers. Buried in the source was an HTML comment reading YOUR ACCESS HAS BEEN TRACKED.

And beneath the advert, a link marked Impressum, because German law requires a website to publish the identity and contact details of its operator, and the Saxon police were now the operator. It resolves to an image of a plain address block: Polizeidirektion Leipzig, Dimitroffstrasse 1, 04107 Leipzig, with a telephone number and an official email address. They seized a narcotics marketplace and then filed the correct paperwork on it. The recovered page and both images are here.

6. Seven years, and out in four and a half

The trial opened in Leipzig on 24 August 2015. Prosecutors reached for the phrase “Amazon for drugs”, which stuck. The court found Schmidt emotionally immature and tried him under juvenile law, a decision that mattered enormously: it capped his exposure far below the adult tariff. The sentence was seven years in juvenile detention. Contemporary reporting noted he could have faced fifteen as an adult, and the leniency was controversial.

He was released in June 2019, having served four years and seven months. Not every cryptocurrency wallet was ever decrypted. Where the money went has never been established, which is why German reporters were still writing pieces headlined where are his millions? nearly a decade later.

7. Candylove

This is the part that turns the story from a caper into something harder to be charmed by.

Prosecutors allege that a second shop, candylove.to, was set up from April 2019 - beginning, they say, while he was still serving the first sentence on day release. The alleged scale is a fraction of the original: roughly five hundred shipments and around twenty kilograms between 2019 and 2021, against a tonne first time round.

The timing is what lands. Netflix released its documentary about him on 3 August 2021. During the period the film was being made, he was, on the prosecution case, running another drug shop. The documentary is in part a study of a young man reckoning with what he did. The allegation is that he was doing it again while it was being filmed.

He was charged in February 2022 and convicted on 17 May 2023 by the 8th Criminal Chamber of the Landgericht Leipzig, which gave him four years and six months and rejected the prosecution’s gang-trafficking theory for want of enough principals.

8. Still open

On 5 November 2024 the Fifth Criminal Senate of the Bundesgerichtshof set that conviction aside (5 StR 599/23). The findings of external fact survived, but the Leipzig court had failed to properly examine whether the participants amounted to a Bande, a gang in the technical sense. The case went back to a different chamber in Leipzig.

The remittal is not good news for him. If gang membership is established, section 30a of the Betaubungsmittelgesetz carries a minimum of five years - more than the sentence that was quashed. One small thing went his way: 2.64 kilograms of hashish fell to be reclassified under Germany’s new cannabis statute rather than the narcotics act.

He remains at liberty pending the rehearing. As of the last check made for this archive, no final verdict has been reported. The Legal Tribune Online topic page is the place to look for anything newer, and if you know of a judgment we have missed, the address on the about page is open.

9. What is left

The drugs were destroyed. The money is largely unaccounted for. The servers were decommissioned in 2015 and the .to domain drifted through other hands. What remains is a set of web captures: a shop front, a catalogue of twenty-eight items, two FAQs, a police recruitment advert and an address block for the Polizeidirektion Leipzig.

That is the whole of it, and it is more than most of the internet leaves behind. The domain is now this archive, which sells nothing and never will sell anything that resembles what was once sold here.

shiny-flakes.com was acquired on 15 August 2026. It has no connection to the events described above, to anyone involved in them, or to any previous owner or operator of the domain.