Police shutter MATRIX encrypted chat service used by criminals

French and Dutch law enforcement have dismantled a “sophisticated” encrypted messaging service used by criminals, Europol announced in a statement on Tuesday.

The platform, called MATRIX, was linked to serious crimes, including international drug trafficking, arms trafficking, and money laundering.

It was first discovered by Dutch authorities on the phone of a criminal convicted of the 2021 murder of Dutch investigative journalist Peter R. de Vries, who was known for his stories about unsolved crimes. 

The dismantled operation is not the same as a legitimate messaging platform hosted at matrix.org.

Over three months of MATRIX investigation, police intercepted and deciphered more than 2.3 million messages in 33 languages from suspected criminals. The platform had nearly 8,000 users, who paid between €1,300 ($1,367) and €1,600 ($1,682) for a six-month subscription.

MATRIX’s infrastructure comprised more than 40 servers located in several countries, with the majority based in Germany and France. During the international operation on Tuesday, law enforcement dismantled those servers and arrested three suspects in Spain, France and the Netherlands.

Among the arrested was the suspected owner and operator of the platform, a 52-year-old Lithuanian citizen who collaborated with a 30-year-old man from the Netherlands, according to Dutch police. During searches of the suspects' homes, police seized €145,000 ($152,000) in cash and about €500,000 ($527,000) in cryptocurrencies. Authorities said they also confiscated four vehicles and more than 970 mobile phones.

A splash page on the seized MATRIX website now alerts its users that some messages sent through the platform were intercepted.

“It’s not the first time and will not be the last time we are able to read the messages in real time. We gained access to data related to this service, and our investigation does not end here,” the splash page states.

According to Dutch police, MATRIX had its own operating system and various apps for encrypted messaging, secure calls, video and voice sharing, and anonymous web browsing. The platform even featured an app for gambling and its own currency for paying subscription fees. The app was primarily installed on Google Pixel phones.

Europol said MATRIX’s infrastructure was technically more complex than that of previously targeted platforms like Sky ECC and EncroChat. Users could only join the service by invitation.

“The founders were convinced that the service was superior and more secure than previous applications used by criminals,” Europol said.

Police took down Sky ECC and EncroChat in 2021 and 2020, respectively. More than 100 people were arrested in the Sky ECC operation, which targeted perpetrators of crimes such as kidnappings, shootings and murders. EncroChat offered a similar secure platform and encrypted phones to cybercriminals.

Sky ECC’s customer base was much larger than that of MATRIX. As of 2021, the platform had more than 70,000 users, including over 11,000 in the Netherlands and another 6,000 in Belgium.

“The landscape of criminal communication has changed following the takedown of Sky ECC, EncroChat, Exclu, and Ghost,” Dutch police said. “Criminals now use a larger number of smaller service providers and deploy more complex technology.”