The Kid Who Ran Europe's Biggest Drug Empire From His Mother's Bedroom transcript

Leipig, Germany. Thursday, February 26th, 2015. 6:42 a.m. A 12 officer tactical unit from the Saxony State Criminal Police stacks in the stairwell of a beige apartment block on Vilhelmina Reichar Stasa. The battering ram takes the door off its frame in under 3 seconds. In the kitchen, they find Cristiana Schmidt in a dressing [music] gown holding a coffee cup about to leave for her nanny shift. She doesn't understand what's happening.

In the childhood bedroom, they find her 20-year-old [music] son, Maximleian. 12 m, a single bed, a school desk, a computer chair. Inside that tiny room, police find roughly 320 kg of narcotics sorted by product and dose. MDMA crystal, vacuum-sealed cocaine bricks, LSD blotters, amphetamine powder, cannabis, and ecstasy pills stamped with car logos. About€4 million euros in Bitcoin open on an unlocked laptop displaying an Excel spreadsheet.

More than 3.9 million of [music] it locked behind private keys police will never recover. And about €48,000 in cash stuffed into skirting boards, wool socks, and taped under the desk. An afterthought compared to the crypto. The room smells of three things. Bulk amphetamine, a mix of hospital pharmacy and rotting fish. Cheap silica gel cat litter scattered to mask the odor. and isopropanol used to wipe every surface and parcel clean of fingerprints and DNA.

The open spreadsheet holds delivery addresses, real names, DHL tracking numbers, Bitcoin hashes, and order histories for roughly 14,500 customers across Europe and the US. Maxmillion doesn't run. He doesn't close the laptop. He doesn't delete a thing. He just looks up, blinks twice, and puts his hands on his head. Over the previous 14 months, he had personally coded, stocked, packed, shipped, and handled customer service for a clearet drug shop called Shiny Flakes.

He sold roughly 900 kg of controlled substances to 14,500 customers on four continents. Completely alone, having never met a single customer and never using any of the [music] drugs himself. The next morning, Bill puts him on the front page, their Amazon dealer. The spreadsheet on his desktop will trigger roughly 10,000 [music] investigations against his buyers. He is one of the most consequential single operator criminals in European e-commerce history.

He is also a virgin who's never had a girlfriend, the son of a lonely nanny who thought her kid was reselling clothes on eBay. He is Maxmillian Schmidt, born in Leipig July 17th, 1994. His father left before he turned two. His mother, Christianne, raised him alone, working as a private child minder, and getting home most evenings after 7. A quiet child, no close friends, no team sports, no parties. Every teachers report calling him intelligent but socially withdrawn.

Years later, without self-pity, he'd explain he had no friends, not because of bullying, but because other people struck him as inefficient and illogical. At 11, he built his first desktop from parts bought with his mother's credit card with [music] permission, €320 total. At 13, he was writing his own JavaScript. By 15, he'd built and abandoned three websites, including an Elder Scrolls fan portal that briefly hit 4,000 registered users.

He left school at 16 without finishing his Obby tour. took a part-time waiter job. About 18 hours a week, €600 a month, €150 of it handed to his mother as rent. At 18, he was small, pale, [music] unstyled hair, chronic under eye circles from monitor time, about 58 kg, three t-shirts, had never left Saxony. Per the psychological evaluation prepared for his 2015 [music] trial, he'd never had a girlfriend, and never kissed anyone.

What his teachers, mother, and co-workers all missed was one of the most extraordinary self-taught technical minds in German cyber crime history and a quiet obsession since 15 with building a better Amazon. The insight came in summer 2013. He'd spent 18 months browsing Silk Road, watched the FBI take it down in October 2013, watched its successors, Silk Road 2, Agora, Evolution rise and fall. Before drugs, he'd already run small experiments, discounted Flick Bus tickets through other people's loyalty accounts, digital gift vouchers, hacked streaming and shop login.

Then Rolin sold by the strip. Each step taught him the same three mechanics. Anonymous payment, anonymous delivery, customer trust. Hard drugs were just the next most profitable category. Then he noticed what everyone else in the darknet marketplace ecosystem had missed. The darknet itself was the bottleneck. Tour, PGP, Bitcoin wallets, hostile interfaces built by idea logs rather than e-commerce people. The addressable market for that experience was maybe 1% of any European country's population.

So he asked the question that would eventually put him in prison. Why not sell drugs on the regular internet? In any earlier decade, the answer was obvious. You'd be arrested within 48 hours. By 2013, it was less obvious. Encrypted payment was maturing. Package forwarding was standardized. and Deutsche Post's Paxstun anonymous pin access parcel lockers meant a sender never had to interact with a human being. At 18, Schmidt understood he could run a large volume delivery business through the German postal [music] system without ever meeting a customer or a camera.

He registered shiny flakes.2 [music] through an anonymous tongen registar on August 4th, 2013. No ID verification required. Then wrote the entire e-commerce backend himself in PHP and JavaScript on a Lenovo ThinkPad at his childhood desk over about 6 weeks. Then he indexed the site with Google. It was the first drug marketplace in European internet history reachable by typing three words into a search bar. Shiny Flakes went live October 12th, 2013.

Chaos Computer Club journalist Frank Rieger later called its design indistinguishable [music] from a mid-tier European fashion e-commerce site. Clean white background, friendly logo, a product grid Schmidt photographed himself on a 650 Canon DSLR, shopping cart, checkout, [music] password recovery. The catalog, cannabis, MDMA, cocaine, LSD, empetamine, ecstasy, and pharmaceuticals like rolin, Xanax, [music] and oxycodone.

Each with a description, photo, and five-star review system. Volume pricing scaled from market rate at 1 gram up to a 25% discount at 50 grams. Bitcoin only. EU shipping included. [snorts] Delivery estimated 2 to 4 days. Returns and replacements handled personally at his own expense for damaged or wrong orders. Recovered customer reviews from his federal trial included lines like arrived in 3 days. Cocaine as advertised 10 out of 10.

The MDMA was clean, lasted 6 hours. The weed came vacuum-sealed with no smell and discrete packaging. Every parcel, brown cardboard, wrapped in craft paper, shipped with one extra item, a 20 g single serving pack of Huribo Gold Bears, Germany's most popular gummy bear brand. Schmidt believed, and reviews confirmed, that it improved satisfaction. It did. 18 months later, it also became the single most useful piece of evidence the German postal police had.

The one marker letting them pull his parcels out of a river of millions. [music] 7 days a week from 9:00 in the morning to 11 at night, customer support emails, processing new orders, converting incoming Bitcoin to offline hardware wallet storage, updating a self-coded inventory panel. He never manufactured anything. He was purely a retailer, buying multi- kilogram wholesale consignments [music] from a Dutch German syndicate.

Investigators only ever knew by the nickname Red Bull. Around 11 p.m., the physical packing began, weighing product on a supermarket kitchen scale accurate to a tenth of a gram, portioning MDMA into glassine envelopes, vacuum- sealing cocaine bricks with a domestic sousvie sealer, rolling cannabis and wax paper, counting ecstasy pills by hand. Postage came from internet markin. Deutsche posts print at home stamps bought in bulk through hacked accounts and stolen card details [music] printed at home taped to each box alongside the herabbo pack.

By around 3:00 a.m. he'd have 40 to 120 parcels ready. Hood up black hoodie and 80 L backpack down the stairs onto a yellow bicycle and out into empty leipic streets to a pack station. pin entry, parcel drop, printed tracking receipt, then onto another and another, rotating through four to seven machines across a 15 kmter radius each night to avoid tripping volume alerts. The smallest items, single LSD blotters, a few pills, just went into ordinary yellow street mailboxes on the ride home.

He was in bed by 5. His mother, asleep in the next room, never once heard him leave. He ran this without a single day off for 14 straight months. By December 2014, he was shipping 200 to 400 parcels a week. By late January 2015, monthly gross revenue topped €450,000. By the week of his arrest, his crypto holdings had crossed €4 million. He hadn't [music] spent a euro of it on anything bigger than a camera lens. 4 1/2x 3 m, faded off white walls, one window always closed.

The duvet cover, gray and blue geometric shapes, was one he'd picked at 15. The wardrobe still had shelving from his school uniform days. In the corner by the door, a wire basket overflowed with pizza boxes and energy drink cans, some of them 11 weeks old. Cheap cat litter, he owned No Cat, lined the skirting boards as a moisture and odor absorbent for the amphetamine smell leaking under the door. An odor tactical [music] officers later wrote was detectable from the apartment building stairwell on the second floor landing. >> Cristiana Schmidt testified she'd entered her son's room maybe three times across those 14 months. >> She'd taken the smell for body odor and laundry and the boxes for [music] the discounted clothing and electronics he told her he was reselling on eBay. asked at trial if she'd ever suspected wrongdoing.

She wept quietly for about 90 seconds, then said one sentence for the record. >> I didn't know my son at all. >> It was Schmidt's single greatest engineering achievement and the one mistake that ended his empire. Over the operation's first 3 weeks, he'd built from scratch [music] a 12 tab Excel CRM. The primary sheet logged every completed order chronologically. Customer email, real name required by DHL for the packstation [music] pin, real delivery address where home delivery was used, product weight, price, Bitcoin hash, tracking number, order and delivery dates, and cross-referenced [music] support correspondence.

By the last week of February 2015, it held about 31,200 rows. Each one a completed drug transaction. Each one identifying a specific German citizen. Unencrypted, no password, not even on an encrypted drive. He kept it, he later told prosecutors, for repeat order analytics. He wanted to know his best [music] customers, optimize his volume pricing because he was running a business. He was also, in his own words, too lazy to delete the historical records.

It was open on the ThinkPad's desktop mid-review of his [music] monthly revenue over morning coffee the instant the door came off its hinges. Detective Chief Inspector Klaus Schulta, the case's lead investigator, later put it in one line in his incident report. We could not initially believe what we were looking at on the screen. The investigation had started about 11 months earlier with a Deutsche Post sorting clerk named Ranatada at the Leipzig Nord distribution center who in spring 2014 spotted a returned parcel addressed to a non-existent address and a wrong sender too.

A real name and street but in another city belonging to someone who'd never mailed anything. Schmidt filled sender fields with random real people's addresses from other towns. She opened it per procedure and found a vacuum-sealed 100 g brick of high purity cocaine wrapped with a herabbo pack. >> She called the police. Between April 2014 and February 2015, the Saxony LKA logged about 140 intercepted or returned shiny flakes parcels misdelivered, damaged, or flagged by drug detection dogs.

Everyone held drugs. Everyone held Haribo gold bears. In parallel, Deutsche Post's own fraud monitoring flagged a cluster of anomalous internet marketing purchases through hacked accounts around Leipik, landing on the same desk as the Herabbo parcels. By summer 2014, the pattern was unmistakable. The LKA opened a formal case under Klaus Schulta, who [music] spent 7 months closing in, subpoenaing a year of pack station dropoff records between 2 and 5:00 a.m., filtered by weight and unmatched sender identities. returning a cluster of about 3,000 parcels, cross-referencing timestamps against Packstation surveillance footage, which showed the same young man on a yellow bicycle in a black hoodie every time, running a silhouette match against municipal records to a 19-year-old at an address on Vilhelmina Rhodasa, living with a widowed nanny named Cristiana Schmidt.

They put the address under watch, but the address alone wasn't why they broke the door down on that exact morning. >> That came from upstream from his supplier. The LKA was already tracking the Red Bull Wholesale Syndicate's courier network. And on the morning of February 26th, that courier [music] delivered a fresh approximately 40 kg consignment to the block. Officers took the courier down in the courtyard. In that instant, the calculation changed.

A 20-year-old upstairs had just received 40 kg and given even a few minutes would start deleting. There was no time for a cleaner warrant window. The tactical unit went straight up the stairs. Schmidt was charged with 88 counts of commercial scale narcotics trafficking, organized crime participation, and money laundering. His trial opened September 29th, 2015. Defense attorney Stefan Costel argued for German juvenile law, Jugan Strafrect.

Since Schmidt had started at 18 and turned 20 only 6 months before arrest, [music] >> Presiding Judge Frank Shishach agreed. Adult law carried 12 to 15 years. Juvenile law capped it at 10. On November 3rd, 2015, Shishach delivered the verdict. 7 years in a youth correctional facility. [music] confiscation of all identified crypto, cash, and inventory, and a 10-year ban from operating or owning any commercial online platform.

After release, there was a hole the LKA never closed. Police seized roughly €4.1 million in crypto, but Schmidt never surrendered every private key. Prosecutors said plainly he'd handed over some wallets and quietly kept others. Bitcoin's price rose more than 10fold between 2015 and 2019. Investigators remained convinced he still controlled encrypted wallets holding several hundred untraced coins, a hidden fortune quietly growing the entire time he sat in prison.

The spreadsheet was handed to the Bundes criminal in Vizboten, which opened roughly 10,200 individual proceedings against named Shiny Flakes customers over the next 3 years. most ending in fines or suspended sentences, about 1,100 in custodial sentences of 3 months to four years. On Darknet forums, his own former customers nicknamed him the Groata Desat, the biggest rat of the decade. Schmidt served his time at the Jugen Strafan Stalt Regus Brightingan behaved by parole board assessment [music] exemplarily and was released on parole in November 2019 after about 4 years.

He'd already been approached roughly 11 months earlier by a production company representing Netflix. But by then he was also already quietly building something else. Netflix's How to Sell Drugs Online Fast [music] premiered May 31st, 2019. While Schmidt was still inside, a top charting German language original across two dozen countries, renewed for four seasons, its lead character, a heavily fictionalized version of Schmidt, developed with input from Netflix's legal team and his release attorneys.

On release, the production hired him directly as a paid technical consultant. He showed the props department how a shiny flakes parcel was assembled and coached lead actor Maximleian Munt on the physical mannerisms of overnight keyboard [music] sessions, earning roughly €240,000 in his first year from consulting and appearances. In 2021, Netflix released a documentary Shiny Flakes, the Teenage Drug [music] Lord, building an exact replica of his childhood bedroom on a sound stage.

Schmidt walked onto that set [music] smiling and demonstrated on camera exactly how he'd portioned cocaine and dropped in the Herobbo bears, treating it visibly as a masterclass, seemingly proud of the efficiency. He was, by his own later testimony to prosecutors, simply bored. Here's what the documentary didn't show. The second shop, internally Candace Shop, publicly Candy Love, began not after release, but in November 2018, while he was still serving the first sentence at the Fryganger, they release stage.

Permitted to leave the facility for work, he used that internet access to quietly lay the infrastructure for a second marketplace with a lawyer and a small crew. The funding almost certainly came from the wallets police never found. The several hundred untraced Bitcoin appreciated into millions by 2019. The only plausible source for the capital a man 4 years out of the market suddenly had. His first partner was in an unprecedented turn for the German legal profession.

His own former defense attorney Stefan Costel, the man who'd won him the juvenile law reduction from 15 years to seven. Costel didn't merely agree to help. He acted as the operation's financial consultant, helped rent storage space, and advised the group point by point on avoiding the first [music] case's mistakes. The unencrypted spreadsheet, the reused sender addresses the single point of failure. Logistics were run [music] by a court named Reich W, who kept the stock in a rented warehouse and garage deliberately away from anywhere anyone lived.

No childhood bedroom this time. Candy Love went live in November 2019. Its backend was per later forensic reconstruction technically superior. End to end encrypted customer communication, no unencrypted records. Shipping rotated across multiple Saxony cities. Between November 2019 and January 2021, it shipped over 500 kg in roughly 4,700 parcels for turnover exceeding 940,000. And it was under LKA electronic surveillance from close to the moment it launched.

As a standard condition of his release, Schmidt's communications, internet activity, and known associates had been continuously monitored on Claus Schulta's personal request for an extended surveillance order. Every call to Costel was logged, every encrypted message captured at the metadata level, every back-end login from a known connection recorded. The LKA shut it down in early 2021. Schmidt put his hands on his head for the second time in his life.

His second trial, again before Justice Shishock, ran with no juvenile discount this time. He was an adult in the law's eyes, and the prosecution had a witness he'd handed themself, the Netflix documentary. In court, prosecutors played the footage of him on the replica set, smiling, narrating his method like a proud craftsman. evidence. They argued that he'd never repented, that he treated serious crime as a game to be optimized.

On May 10th, 2023, the verdict. Schmidt, 4 years and 6 months in adult prison. Costel disbarred and sentenced to 5 years and 6 months. Reich W 5 years and 11 months. Before sentencing, Shishock looked at the man he'd first met at 20 and said, "For the record, >> "You have learned nothing. You treat the justice system in human lives like an algorithm in a video game.