A crypto data leak led the FBI to America's most wanted sex trafficking fugitive. Now, the victims want his bitcoins.

• Sex-trafficking fugitive Michael Pratt vanished for 3 years — until a data leak led to his capture.
• The leak involved cryptocurrency "wallets" he used to secure his bitcoin passwords.
• The leak revealed he'd shipped one to a Mailboxes Etc. in Barcelona, a clue that cracked the case.

Four days before Christmas in 2022, Michael James Pratt — a New Zealander accused of running the most prolific sex-trafficking ring in US history, with at least 400 young victims — was thrown to the floor of his Madrid hotel room and handcuffed by Spanish police.

As Pratt awaits trial in a Southern California jail, facing a possible life sentence, little has been revealed about how police located and captured him after three years on the run.

But video of his arrest, tweeted afterward by Spain's Policia Nacional, shows the precise instruments of his undoing: four gunmetal-silver cryptocurrency flash drives.

The four pieces of hardware held the passwords for $500,000 in bitcoin that federal prosecutors say he earned during his decade of running the notorious Girls Do Porn trafficking ring.

Here is the story of Michael Pratt, the Girls Do Porn ring, and how a team of civilian supersleuths followed a twisty trail that began with these pocket-sized crypto hard drives and ended on that hotel room floor.

Here, too, is a story of justice. Last month, federal prosecutors said that the trafficking proceeds they seek to recover include the bitcoins protected by those four hard drives. The money would be returned to the ring's victims.

"If there's a hero, it's certainly them; it isn't me," Charles DeBarber, a civilian cyber-intelligence analyst who spent eight years chasing Pratt, told Business Insider of the Girls Do Porn victims.

Fraud, coercion, threats

The Girls Do Porn conspiracy ran from 2007 to 2019, and worked like this, according to federal prosecutors and victim testimony:

Cash-strapped college students were pulled into the ring's web by answering bogus fashion modeling ads on Craigslist. "Cute Teen Girls Make $5,000 Today," one typical ad read, above photos of smiling young models in swimsuits and athletic wear. A series of friendly emails from "Jonathan@beginmodeling.com" eventually revealed that the job was for an "adult" shoot.

When a prospective recruit demurred, "Jonathan," a fictitious name, would make a series of false promises. The job paid $5,000 cash up front for a 30-minute shoot with "an attractive male actor," the women would be promised. The video, they'd be assured, would be DVD-only, for the exclusive use of private collectors in Australia. It would never go online or be seen by anyone they knew.

If a prospect still hesitated, she'd be offered more money, more false assurances. "Jonathan" would forward her the phone numbers of "former models" who were paid to say whatever it took to reel in a victim.

"No no no you're totally fine!" a fictitious former model named "Kailyn" texted one victim. "That's what I was worried about but there is absolutely no way anyone will find out."

The video shoot

Once a victim agreed to do a shoot, "Jonathan" — prosecutors believe several in the ring took turns using the name — would immediately send a one-way plane ticket. She would be flown alone to San Diego before she could change her mind.

Victims remember being picked up at the airport and chauffeured to an upscale hotel. One thought it odd when the child safety locks were engaged during the ride.

At the hotel, these young women, barely out of high school, suffered the first hours of what would be a decadelong nightmare.

Of at least 400 women who recorded Girls Do Porn videos, more than 100 have told their stories in civil and criminal cases. Some describe being raped in their hotel rooms by their male actor before the shoot started — a "test drive," they were told.

"Jonathan's" lies quickly unraveled. The promised pay would be docked by thousands of dollars for small imperfections in their appearance. And instead of 30-minute shoots, the women would be forced to film for six or more hours — however long it took to get five uninterrupted minutes of footage for each of five sexual positions.

Heavy equipment blocked the hotel room door, trapping them inside with men who warned that if they didn't finish the shoot, they'd be sued for breach of contract and left to buy their own flight home.

Victims describe violent ordeals that left them bleeding, vomiting, and sobbing. Their distress would be edited from the final video, though the editing was imperfect.

"I'm now known on the internet as the GDP girl with the tear tracks in her makeup," a victim who'd been filmed at age 18 said in March at the sentencing of Girls Do Porn webmaster and cameraman Matthew Isaac Wolfe, now serving 14 years in federal prison for sex trafficking

"Stop being a whiny little bitch!" another victim recounted porn actor Ruben Andre Garcia shouting as she begged to leave. Garcia is now serving 20 years for sex trafficking.

A million views in just days

Months after the filming, these graphic, hardcore productions went live. Videos went viral in as little as 48 hours, as 700,000 subscribers to Pornhub's Girls Do Porn channel clicked on 5-minute teaser clips that drove traffic to Pratt's site, where 100,000 subscribers paid $30 a month for the full videos.

Federal prosecutors say Pratt increased traffic by forwarding each victim's video link to her school, work, family, and social connections. Victims attempted suicide after finding themselves fired from jobs, hounded from school, and shunned by loved ones.

"Before I knew it, my video had millions of views, and all my friends, family, acquaintances, and distant relatives knew," one victim said.

Prosecutors say Pratt also uploaded details from victims' original "Begin Modeling" applications — names, emails, family addresses, and even their height, weight, and favorite color — to websites he controlled that catered to so-called porn trolls.

The trolls churned up still more traffic and attacked "without mercy," as one victim described it.

"My mom would walk out of church and come back to her car to find notes in the window shield calling me a whore, slut, prostitute," another victim testified at Wolfe's sentencing.

Even now, long after the 2019 demise of the Girls Do Porn website and its Pornhub channel, the videos remain. Victims say they still pop up when they Google their names.

"Ten years later, I am still receiving harassing text messages," one said in March at Wolfe's sentencing. "I received one yesterday evening while nursing my newborn."

Unmasking the traffickers

But while its victims were humiliated publicly and by name, those running Girls Do Porn remained anonymous for most of the years the ring operated.

A tangle of fake phone numbers, addresses, and shell companies thwarted anyone seeking legal action. When the father of one victim emailed "Jonathan@beginmodeling.com" — the only contact his daughter had — he didn't reach Jonathan at all. Instead, he received a lawyer's cease-and-desist letter with naked photos of his daughter attached, federal prosecutors in California said in Pratt's 2019 criminal complaint.

This is where a former US Army cyber-intelligence analyst named Charles DeBarber arrived.

In early 2016, DeBarber was asked for help by a victim who wanted to know: Who had done this to me? Using publicly available data —including 2010 domain-name registration records and the Panama Papers — DeBarber unmasked Pratt, Garcia, Wolfe, and the underlying corporate entities. All were sued in state court in San Diego later that year.

"This is a very large, weird true crime story you kind of need a chart to explain," DeBarber said.

"We were able to find Garcia through his Facebook page, by reverse-imaging a tattoo that appeared on his shoulder" in the videos, he told Business Insider. Garcia was the actor who victims said told them to stop being "whiny bitches."

A walk to Tijuana

Girls Do Porn raked in some $17 million in subscriptions and content deals, federal prosecutors say.

"He would constantly punch holes in the walls and break computer monitors," Wolfe said of Pratt in his March sentencing statement, describing his "manic" and "terrifying" boss.

Pratt "was making millions of dollars and was driving around in a Lamborghini, living in a multimillion-dollar house in Rancho, Santa Fe," Wolfe's defense lawyer, Jeremy Warren, said at the sentencing.

Then, in the fall of 2019, Pratt fled his life of luxury, crossing into Tijuana on foot. Weeks later, a federal grand jury in San Diego indicted him, Wolfe, and Garcia. He was still missing months later, when a state judge awarded $13 million to the 22 victims in the 2016 lawsuit.

In pleading guilty, Wolfe, Garcia, and three other Girls Do Porn employees implicated Pratt as the ring's mastermind. He faces 19 felony counts, including conspiracy to commit sex trafficking by force, fraud, and coercion.

Finding Michael Pratt

Pratt vanished for three years.

Federal investigators believe he quickly boarded a flight to his native New Zealand, where he visited family members and made quick stops in Hong Kong and Cypress in unsuccessful attempts to sell the still-profitable Girls Do Porn operation.

He was somewhere in Europe when the indictment dropped at the end of 2019. "He didn't have any fake papers at the time," DeBarber told BI. "He was just Michael Pratt."

But Pratt began using an alias and the trail went cold — except for one key clue.

In the summer of 2020, the cryptocurrency world was rocked by a major data breach. Hackers exposed the names, addresses, and phone numbers of more than 700,000 customers of a company called Ledger.

Ledger makes cryptocurrency "wallets," small USB or Bluetooth devices that look like little metal thumb drives. They safely store and protect the lengthy digital passwords that cryptocurrency owners need to access and move their money.

Pratt, DeBarber discovered, was one of the Ledger customers whose data was hacked.

He had used his real name to have a hardware wallet shipped to the W Hotel in Barcelona shortly before the indictment, the breach revealed. After the indictment, in the spring of 2020, Pratt used the alias "Mark Williams" to have another hardware wallet shipped to a Mailboxes, Etc., also in Barcelona.

"We decided, you know what? Let's go there and see," DeBarber said.

The cyber-sleuth and the victims' lawyer flew to Barcelona in July 2022 — a trip DeBarber described earlier this year on LinkedIn.

They had precious little to go on besides those long-cold locations — the W Hotel and the Mailboxes Etc. They also knew that Pratt liked American hip hop and collected pricey, vintage Air Jordans, based on what federal investigators had found searching Pratt's luxury apartment in San Diego.

Once on the ground, the pair connected with Ben Owen, a cyber-security expert DeBarber had met when they worked together in 2017 on the CBS show "Hunted." Owen's partner, intelligence expert Danni Brooke, and their daughter Amelia Brooke, joined them.

Owen located one of the few people in Barcelona who sold vintage Air Jordans. Her face turned pale when shown Pratt's picture. She had spoken to him recently about a $50,000 pair of size-11, 1985, 1st edition high-tops.

Then a bouncer at one of only five nightclubs that played American hip hop said he'd seen Pratt there just a few weeks prior. Both the sneaker vendor and the bouncer described the fugitive the same way.

"They said he was portly and that he wears clean clothes but doesn't wash," DeBarber said. "And they said he carries a Versace bag full of money around his neck.

"He was living pretty recklessly," DeBarber added. "Who goes to a club with a Versace bag full of money, flashing it around? He's obviously not a Spaniard. That's not the kind of behavior I would expect from a talented fugitive."

The best clue of all

But the crucial tip DeBarber and his partners in crime-fighting uncoverd — and passed along to the local FBI consulate — came from that Mailboxes Etc.

There, a very helpful clerk showed them the Swiss ID and contract Pratt had used to open his account two years prior. Pratt would use the ID — which featured his photo and the alias Mark Williams — just before Christmas when he checked into that Madrid hotel.

There at the front desk, Pratt's ID triggered an Interpol alert, sending authorities directly to his door. Inside were Pratt's laptop, two cellphones, a stack of 50-Euro notes, and four of those Ledger wallets.

Pratt was finally extradited from Spain in March. His next court date is September 6, when a trial date may be set. His defense lawyer did not respond to requests for comment on this story.

These days, DeBarber runs the Baltimore-based Phoenix AI cybersecurity firm with cofounder Justine Li, a Girls Do Porn victim and plaintiff.

Li's video was filmed in 2007 when she was still in high school. It was "Video Number One" when Girls Do Porn launched in 2009. Their company builds tech solutions for finding and removing non-consensual sexual abuse materials on the internet.

"I will be at his sentencing and I will be grinning," DeBarber said recently of Pratt. "I'm really, really excited where he is right now, and Dre, and Wolfe," he added, referring to co-defendants Matthew Wolfe and actor Reuben "Dre" Garcia.

"I hope they spend their time in prison wondering how did the women we thought we broke ever manage to do this to them."