Finnish Customs has identified users of Sipulitie – the site had the same administrator as Sipulimarket

In September last year, Finnish Customs closed down the network servers of the Sipulitie marketplace, which had been operating on the encrypted Tor network since 2023, and seized the contents of the servers. The site was used for selling narcotics, narcotic medicines, medicines and doping substances anonymously. During the preliminary investigation, several persons have been held and remanded on suspicion of maintaining the website or for complicity in the customer service and moderation of the website.

In autumn 2024, Finnish Customs seized the Sipulitie servers in cooperation with the Swedish Police and copied the server contents (see previous release). The Sipulitie website had more than 17 000 registered user accounts, of which more than 150 were sale accounts. In the material seized by Customs, investigators have found messages sent between the users of the marketplace, payment transaction details, user contact details as well as purchase and sales data. Customs has identified several persons behind the user accounts, and as regards these persons, has started preliminary investigations of narcotics offences.

Before the seizure, the site administrator publicly stated that the turnover of Sipulitie was 1.3 million euros, which corresponds to the figure established by Customs in the preliminary investigation. A total of almost one million euros in criminal proceeds has been traced in the course of the investigation. Some of these proceeds have been seized, some confiscated as security.

“The online crime investigators of Customs have done an excellent job in investigating this case. We are able to effectively intervene in and uncover instances of anonymous trade in illegal goods and substances over the internet,” says Hannu Sinkkonen, Director of Enforcement.

The site administrator organised customer service for the marketplace

A man residing in eastern Finland is suspected of being the administrator of Sipulitie. The man is suspected of three aggravated narcotics offences involving the maintenance of narcotics websites. In a house search, investigators seized items such as IT equipment and material on crypto currencies from the suspect, as well as about 150 000 euros worth of cryptocurrency as proceeds of crime. More than half a million euros worth of the suspect’s assets has been requested to be confiscated for security.

The administrator of Sipulitie recruited sellers operating on the marketplace to help him with the customer service and paid them for their work. Customs has established the identities of these persons. To begin with, two men from the Uusimaa region were recruited. Some days before the marketplace was closed down, a group of three persons from Uusimaa and Central Finland started providing customer service. The group consisted of two men and one of their mothers.

Sipulitie, Sipulimarket and Tsätti had the same site administrator

Customs suspects the administrator of Sipulitie of also having administered Sipulimarket and the Tsätti sales website. Both are marketplaces for illegal substances and items. Customs closed down the Tsätti website at the same time as Sipulitie, in September 2024. Sipulimarket was closed by Customs in 2020. After Sipulitie was taken down, there has no longer been a narcotics marketplace operating in Finnish on the encrypted Tor network.

Finnish Customs has cooperated broadly with the Swedish Police, Europol and various police units in Finland. During the preliminary investigation, several persons have been held and remanded on suspicion of maintaining the website or for complicity in the customer service and moderation of the website.

The preliminary investigation is ongoing, and this spring, the case will be transferred to the Prosecution District of Western Finland for consideration of charges. The criminal matter will be tried at North Karelia District Court.