Every arrest has a story. Almost every story has the same shape: years of careful work, consistent tradecraft, maintained separation between identities - and then one moment. One forum post. One unmasked connection. One email address used across two contexts. The pattern repeats so reliably that it functions less like a series of individual mistakes and more like a structural feature of how people get caught.
This is a catalogue of documented operational security failures - cases where the mistake is on record, verified by court documents, journalist investigation, or forensic disclosure. No speculation. These are the actual mistakes that made the arrests possible.
//Hector Monsegur (Sabu) - LulzSec / Anonymous
Sabu was the most important figure in Anonymous and LulzSec during their most active period: the de facto leader of the group that hacked HBGary Federal, the CIA, Fox News, and Sony, and the coordinator of the broader AntiSec operation with Anonymous. How he was caught is the best-known OPSEC story in the field, and it is disputed.
The story everyone repeats comes from Fox News in March 2012: that he once logged into an IRC chatroom from his own IP address without masking it, and the FBI had him. Monsegur disputes it. The Register's editor's note records his account - he always connected through hacked machines, and the FBI unmasked him from personal details leaked when he was doxed on EFnet years earlier. His name was not secret anyway: in March 2011 the rival group Backtrace Security published it, having found an IRC log in which Sabu linked his personal website.
Federal agents arrested him on 7 June 2011, and the next day he agreed to become an informant. For more than ten months, while still publicly operating as Sabu, he worked with the FBI. His role became public on 6 March 2012, when the FBI announced the arrests of five more suspects.
//Ross Ulbricht (Dread Pirate Roberts) - Silk Road
Covered separately in depth elsewhere on this site - but the OPSEC failure belongs in any catalogue. In March 2012, while building the hidden service infrastructure for Silk Road, Ulbricht asked a PHP-cURL programming question on Stack Overflow under his real name and Gmail address: [email protected]. He edited the post within a minute, changing the username to "frosty." The edit was too slow. Stack Overflow preserves history.
Months later, when FBI investigators examined the Silk Road servers, the admin handle was "frosty." The same handle he had used on Stack Overflow after hastily changing his real name. The convergence was documented in the indictment.
The compounding factor: he kept a detailed personal diary on the server. Not encrypted. Accessible to anyone with administrative access. The diary discussed hiring a hitman, the daily operations of the marketplace, and his personal ideology. When the server was imaged by law enforcement, they read everything.
//Alexandre Cazes (Alpha02) - AlphaBay
The founder and primary administrator of AlphaBay - for years the largest dark web marketplace in existence - used a personal Hotmail account as the sender address for AlphaBay's automated user emails: [email protected].
The address was registered to his legal name. The "91" matched his birth year. Microsoft's response to the FBI subpoena connected the email to a Canadian named Alexandre Cazes and to a registered Thai software company. The rest of the investigation - property records, financial flows, immigration records - was straightforward from there.
He also kept unencrypted text files of all administrative passwords on his laptop. When Thai police arrested him at his home in Bangkok while he was mid-session on the admin panel, they found a full asset spreadsheet listing every property, vehicle, and cryptocurrency holding. He had effectively documented his own case for the prosecution.
//Conor Fitzpatrick (Pompompurin) - BreachForums
BreachForums was the successor to RaidForums after its seizure in 2022 - a major English-language cybercrime forum that hosted leaked database sales, access credential marketplaces, and tool discussion. Its administrator, operating as "pompompurin," was one of the most recognised handles in the breach community.
In a RaidForums conversation, pompompurin mentioned that a particular data breach being discussed did not include an email address that matched his personal account. He typed: "this email seems to have the same case as mine" - and then, apparently demonstrating what he meant, typed what he described as a similar format:[email protected]. He added, almost immediately, that he didn't want to share his "actual email for obvious reasons."
The email he had just typed was his actual email. The FBI confirmed this by cross-referencing it against login logs from a separate forum - Raid Forums - where nine IP addresses used by pompompurin were connected to mobile devices registered to a Verizon number belonging to Conor Brian Fitzpatrick of Peekskill, New York.
He was 21 when arrested. The FBI agent who knocked on his door reported that Fitzpatrick identified himself immediately and admitted he was pompompurin in the first conversation.
//Arion Kurtaj (WhiteDoxbin) - Lapsus$
Arion Kurtaj was 16 when he purchased Doxbin - the internet's most notorious personal information repository, active since 2011 - apparently because he could. He ran it for a period, then in January 2022 grew frustrated with the community and leaked the entire Doxbin user database to Telegram. This included credentials, posts, and the personal information that members had contributed to the site.
The community's response was immediate: they posted a comprehensive dox of WhiteDoxbin (Kurtaj's handle) on the very site he had just leaked, including his real name, home address in Oxford, UK, photos, and videos filmed outside his home. The information reached law enforcement. UK police began surveillance.
By the time Kurtaj was arrested, he was deeply embedded in Lapsus$ - the group that had compromised Nvidia, Samsung, Microsoft, Ubisoft, and Okta. He had also hacked Uber and leaked Grand Theft Auto VI footage from within Rockstar Games' internal systems - reportedly from inside a Travelodge hotel while on bail for previous offences, using a Fire Stick, a phone, and a hotel TV.
He was found not criminally responsible due to severe autism and sentenced to an indefinite hospital order. His co-defendant, who was 17 at the time of the offences, was convicted of multiple counts of computer misuse.
//The Pattern
Across every case, the mechanics of the failure are different but the structure is identical:
- A long period of careful, consistent behaviour
- A single anomalous event - a moment of distraction, impatience, or carelessness
- A mistake that, in isolation, might not be fatal
- Existing investigative threads that provide the context to make the mistake fatal
Sabu's unmasked session would have meant nothing if law enforcement hadn't already been interested in Anonymous. Ulbricht's Stack Overflow post would have meant nothing without Gary Alford's separate investigation into early Silk Road forum activity. Pompompurin's email slip would have meant nothing without the pre-existing IP correlation data from Raid Forums.
Operational security doesn't need to fail completely to fail fatally. It needs to fail at the exact moment when the failure is meaningful - when the adversary is already watching, already interested, already building a case. The mistake that ends everything is rarely the first mistake. It's the last one that gets noticed.
The practical implication: there is no opsec regime that survives indefinite exposure to a motivated, resourced investigative team. The goal of opsec is to raise the cost of attribution high enough that it isn't worth pursuing. When the cost ceiling is "federal prison," investigators are quite motivated.