top of page

🏆 Nominis just won 1st place at Mastercard's Fintech Forum - Watch now

Dark Web Investigations: Squid Game IRL

  • Nominis Intelligence Unit
  • 7 minutes ago
  • 3 min read

The massive success of Netflix show Squid Game, and its recent arrival of Season 3, has revealed just how much we as an audience are drawn to dark, high-stakes game shows. While the show is fictional, we discovered a real-life equivalent that’s shockingly similar, thriving quietly with funding driven by blockchain technology.


The Nominis Intelligence Unit uncovered a deeply disturbing illicit service on the Dark Web that epitomizes one of the worst possible uses of cryptocurrency and anonymised networks. Hidden behind the layers of the internet, a platform called ‘Red Room’ offers users the ability to watch, and even control the live-streamed torture of what is most likely kidnapped and or trafficked individuals. Access is granted in exchange for Bitcoin, with different tiers unlocking varying degrees of interaction.


A wooden chair under a spotlight in a dark room with red walls. The light creates a dramatic and tense mood, highlighting the emptiness.

This site operates under the guise of an interactive ‘event’ or ‘experience’, using gamified language to mask its atrocities. Upon entry, users are presented with disturbing participation tiers: 


  • Spectator ($66 in BTC) - passive viewing of the live video feed 

  • Commander ($666 in BTC) - Grants the user partial control over the torture methods, via real-time instructions 

  • Grandmaster ($6,529 in BTC) - Limited to only 2 participants per session, this tier appears to offer full control over the actions carried out on screen. 


Each transaction generates a unique, one-time-use Bitcoin address; a clear attempt to avoid traceability. These burner wallets are a common tactic found in dark web finance, often seen in ransomware, extortion and trafficking schemes. 


"Red Room" text on a black background. Instructions for Bitcoin payment (0.05883 BTC) for "Grand Master Access." Ominous, digital setting.
Screenshots from the site

Linguistic Fingerprints suggest a Malaysian Link 


During linguistic observation of the website’s written content, an unexpected clue surfaced. The content, while written in English, includes spelling patterns, such as ‘Akaunt’, instead of ‘account’, that are consistent with that of typical Malaysian spellings of English words. While not definitive, this linguistic pattern may suggest the page creator has ties to Malaysia or is a native Malaysian English Speaker. 


Such regional quirks, while used alongside other indicators and sources, can assist in narrowing down the origin or operating zone of illicit actors. 


Text on a red-tinted background: "COMMANDER To be the master Price: 666 USD/0.00599 BTC Available: 7 Members INSTANT ACCESS."
Red-tinted image with text: "SPECTATOR, You can only watch. Price: 66.6 USD / 0.0006 BTC, INSTANT ACCESS." Background shows blurred objects.
Screenshots from the site

Instructions to Destroy Evidence


A disturbing display of awareness about digital forensics, the website explicitly warns users not to retain evidence. If a user records or downloads the livestream content onto a USB device, the site advises them to destroy the USB after the livestream. The operators are clearly aware of the legal and ethical consequences of the content being distributed.


Text with instructions and warnings about using a Tails Live USB on a red-toned background. Prominent "Go to RED ROOM" text.
Screenshot from the site

Compliance and Regulatory Response


From a crypto-compliance perspective, this set-up is equally strategic as it is sinister. The use of one-time BTC wallets per transaction makes it difficult for law enforcement to trace the funds to a central source. We suspect that the collected funds are eventually pooled and either mixed using privacy tools or converted into privacy coins such as Monero, making downstream tracing increasingly difficult. 


As all dark web cases do, this case underscores the critical need for KYT monitoring and crypto threat intelligence, and a reliance on transaction monitoring services that include Dark Web monitoring. Any wallet interacting with this platform, or any platform on the dark web, should immediately be flagged as high risk. 


Law enforcement and regulators should take note that this case is a live demonstration of how pseudo-anonymity, crypto payments, and the Dark Web, can merge to support crimes at the highest human cost. 


This platform weaponises blockchain and livestreaming technology to monetize real-world human suffering. It isn’t just a case of dark web depravity: this is a structured, financially-driven business model built on torture, anonymity, and digital obfuscation. 


It is possible to feel paralyzed by the horror of such operations, but every Bitcoin wallet involved creates a trail, and every linguistic observation can become a lead. Our Dark Web investigative reports aim to raise awareness of such cases in order to create a starting point for dismantling illegal businesses, that profit from these horrors in silence. 



While we strive for accuracy in our content, we acknowledge that errors may occur. If you find any mistakes, please reach out to us at contact@nominis.io Your feedback is appreciated!



bottom of page