Encrypted Communications Service ‘Matrix’ Dismantled by the Police

The Dutch and French authorities, supported by Europol and Eurojust, have dismantled Matrix, an encrypted communication service used extensively by criminal networks.

During the operation, law enforcement intercepted and analyzed over 2.3 million messages, gaining unprecedented insight into global criminal activities. The platform, considered a successor to EncroChat, Sky ECC, and ANOM, was seized following an intensive investigation spanning several years.

It is important to clarify that the dismantled service has no connection to Matrix.org, a legitimate open-source communication protocol widely used for secure and decentralized messaging in non-criminal contexts. Users of Matrix.org and its associated services can continue to use the platform without concern, as its operation and purpose are entirely separate.

Complex network unraveled

The Matrix service, described as more advanced than its predecessors, relied on a network of over 40 servers distributed across multiple countries. Its infrastructure was primarily centered in France and Germany, while operations were managed from Spain by a 52-year-old Lithuanian national identified as the platform's owner. Alongside him, a 30-year-old Dutch suspect was apprehended for alleged involvement in both the operation of the service and international cocaine trafficking. Both arrests were made in Marbella, Spain, at the request of Dutch authorities.

Law enforcement executed six searches in Spain, seizing property valued at over €15 million, along with €145,000 in cash, €500,000 in cryptocurrency, 970 devices, and several vehicles. Simultaneously, six additional searches took place in Lithuania, highlighting the international scope of the operation.

Matrix was a central communication tool for criminal enterprises, supporting illegal activities such as drug trafficking, arms dealing, and money laundering. Messages on the platform revealed criminal collaborations across borders, with users primarily located in Southern Europe and conversing in 33 languages. The service offered an ecosystem of applications, including encrypted messaging, video calls, transaction monitoring, and anonymous browsing. Devices pre-loaded with Matrix software were sold exclusively to vetted individuals at prices ranging from €1,300 to €1,600 for six-month subscriptions.

The service's takedown was facilitated by intelligence gathered after the assassination attempt on Dutch crime journalist Peter R. de Vries in July 2021. Investigators recovered a device containing Matrix software in the shooter's vehicle, which led to further probing of the service's infrastructure. A Joint Investigation Team (JIT), comprising Dutch, French, Lithuanian, Italian, and Spanish authorities, was established to share findings and coordinate operations under the supervision of the Dutch National Public Prosecutor's Office.

Insights from seized data

Matrix users believed their communications were secure from law enforcement due to the platform's advanced encryption and distributed infrastructure. However, a combination of innovative data analysis and traditional investigative techniques enabled authorities to penetrate the network. Messages intercepted from the platform revealed detailed plans and operations within organized crime syndicates, providing critical evidence for ongoing and future investigations.

The seizure of Matrix reflects an ongoing trend of law enforcement targeting encrypted communication platforms used by criminals. Earlier takedowns of services such as EncroChat, Sky ECC, and Exclu have pushed criminal groups toward smaller, more sophisticated providers. Authorities warn, however, that no service is impervious to investigation. A banner on the seized Matrix website declared, “It's not the first time and will not be the last time we are able to read the messages in real time.”

Matrix may have had legitimate users too, including lawyers, notaries, and clergy, who could invoke legal privileges. These individuals are advised to report their details to law enforcement for verification and potential data removal from the ensuing investigations.