SAM BENT▊
A Vermont computer-repair man who ran a darknet drug shop for about a year, pleaded guilty, drew five years, and then wrote his own way out of federal prison in eighteen months with a compassionate-release motion a federal judge granted over the government's objection. Sixteen months after walking out he was on the DEF CON 30 stage presenting as "a Veteran Darknet Vendor." attrition.org now carries him on its Breaking Bad errata. He has never hidden a line of it: the conviction is the résumé.
I suggest nobody take this route to make money. It’s a bad business model, even if you have perfect OpSec.
Sam Bent, closing slide of his DEF CON 30 talk (Aug 13 2022) FACT (that he said it) · DEF CON media server (slides, PDF)
I came to the realization that at the end of the day, it’s not her fault. It’s my fault. I was in charge, right?
Sam Bent, on the co-defendant cousin whose mailing habits, by his account, drew the postal inspector, to Jack Rhysider — Darknet Diaries, ep. 132 “Sam the Vendor”
While on federal probation denegrated the shit out of feds, went to defcon and showed the cooperation documentation I had on my cousin, which was ‘property of the court’, and they tried to send me back to prison for it.
@DoingFedTime, on X, Aug 5 2026 (spelling his) HIS CLAIM · x.com/DoingFedTime/status/2085044326380290544
- WHO
- Sam Bent of East Burke / St. Johnsbury, Vermont — online DoingFedTime; earlier handles, by his own account, killab and 2happytimes2 FACT
- SELF-DESCRIPTION
- “OSINT & OPSEC Specialist | Darknet Expert (Ex Vendor & DNM Admin) | Content Creator| DEFCON/SANS Speaker | Social Engineer | Author | Paralegal” — his YouTube channel, @Sam_Bent HIS WORDS
- RECORD
- Pleaded guilty Mar 21 2019 to four counts — conspiracy to distribute controlled substances and money laundering — U.S. v. Bent, D. Vt. No. 5:18-cr-00061; $14,000 forfeiture ADJUDICATED
- SENTENCE
- 60 months (Aug 2 2019); reduced on his own compassionate-release motion to time served, effective Apr 24 2021, after about 18 months. Supervised release left in place ADJUDICATED
- STAGE
- DEF CON 30 (2022); SANS OSINT Summit (2023); Darknet Diaries; his own channel and podcast
- STATUS
- RELEASED 2021 — the listing is attrition.org’s Breaking Bad errata, which says “no judgement is being made after release”
This file is not a fresh accusation. Every fact in it was settled by a guilty plea seven years ago, and the subject tells the story himself, for an audience, on purpose. What the file records is a different specimen from the usual charlatan: not the man who invents a credential, but the man whose credential is a federal docket number, and who has built a public second act on reciting it.
The question attrition put on the table — should a convicted vendor be teaching OPSEC from the conference stage — is a real one. So is the answer the court gave in 2021. Both are below, with their receipts.
the drama timeline
ACT I — THE SHOP (2017–2018)
A man who spent ten years teaching himself computers applies the lesson to the one market that pays in Bitcoin and punishes in decades.
-
AUG 2017–EARLY 2018
The vendor account
Bent buys controlled substances online, repackages them, and resells them on darknet marketplaces for Bitcoin; a cousin mails the packages from post offices in northern Vermont and New Hampshire. The court would later describe him as "primarily a dealer in marijuana and hashish" who "sold other drugs, including morphine, LSD, MDMA, and cocaine on occasion," working "essentially alone except for his cousin," and "not part of a larger criminal organization."
The court's own word for the enterprise was "opportunistic." The subject's word, on stage, would be "OpSec."
-
MAY 2018
Operation Dark Gold
A sealed indictment is returned May 24 and unsealed May 30 2018. By the prosecutor's account, Bent had cashed out through a darknet Bitcoin exchanger that turned out to be run undercover by Homeland Security Investigations. Bent's own account adds a second thread: that a postal inspector opened one of the cousin's packages without a warrant, which he says on his DEF CON slides was the "law" agents "had to break" to catch him.
ACT II — THE PLEA (2019)
The defense files the motion that could have ended the case. The hearing on it becomes the hearing where he pleads guilty.
-
FEB–MAR 2019
The Franks motion, and the plea instead
On Feb 4 2019 his lawyer moves to suppress the evidence and for a Franks hearing on the warrant. On Mar 21 2019 — the date set to hear that motion — Bent instead pleads guilty to Counts 1, 7, 8 and 9 under an 11(c)(1)(C) plea agreement and acknowledges a $14,000 forfeiture. The docket records the suppression motion as "terminated pursuant to guilty plea." It was never decided.
His slide says he "was granted a 'franks hearing.'" The docket says the hearing was scheduled and the plea came first. Both can be true; only one was litigated.
-
AUG 2 2019
Five years
Chief Judge Geoffrey W. Crawford sentences him to 60 months, accepting the plea agreement's proposed term; the co-defendant cousin receives probation. Bent apologizes in court, says he deserves punishment, and says he plans to use the time for a business degree and legal work. The judge, per VTDigger: "I look forward to welcoming you back to the community when you have finished your sentence." He self-surrenders Oct 1 2019.
ACT III — THE MOTION (2020–2021)
A prisoner in a pandemic, a law library, and a 200-page filing. The first attempt fails. The second does not.
-
APR–MAY 2020
Denied
Bent files a motion for compassionate release himself on Apr 17 2020; the court appoints the Federal Public Defender for the limited purpose of pursuing it. The government opposes. Denied May 4 2020.
-
APR 16 2021
Granted, over objection
On his second emergency motion, opposed by the government, the court vacates the sentence and imposes time served, effective Apr 24 2021, with supervised release left in place. He had served 18 months of 60. The order finds he "cooperated with law enforcement" from the day of arrest, "confessed immediately," that his prison conduct "has been excellent" with "no discipline history," and that "recidivism appears unlikely." It also records the other side of the ledger: a two-point sentencing enhancement for a loaded rifle found in his bedroom, with "no evidence that he threatened anyone." Its conclusion: "The purpose of punishment is met by 18 months of incarceration."
The exploit, as he would later present it, was a motion. The patch, as the court wrote it, was a finding that he no longer needed to be there.
ACT IV — THE STAGE (2022–2026)
The specimen migrates from the prison law library to the conference hall, and keeps the prison number in the speaker bio.
-
2022–2023
Early termination, refused twice
Acting pro se, Bent moves in May 2022 to end his supervised release early. The government opposes; denied without prejudice in July 2022 until he completes half the term. He refiles in September 2022; the government opposes again; denied Mar 10 2023.
-
AUG 13 2022
DEF CON 30: “a Veteran Darknet Vendor”
Bent presents Tor: Darknet Opsec By a Veteran Darknet Vendor & the Hackers Mentality, a 45-minute DEF CON 30 talk. His speaker bio describes him as a "former admin and co-founder on Dread Forum," "staff on multiple Darknet sites," and "a certificated paralegal," and says he "got himself out of federal prison after a year and a half by acting as his own lawyer." His slides introduce him as "Sam Bent aka DoingFedTime aka 12189-082" — his federal register number — and close by telling the room not to follow him.
-
2022–2026
The post-talk fallout, in his telling
Bent says in posts on X that after the DEF CON talk, in which he says he showed a co-defendant's cooperation paperwork, "they tried to send me back to prison," and that he was accused of "encouraging people to sell drugs at defcon (not true)." The docket entries indexed by CourtListener show no petition to revoke his supervised release; troll.fan could not verify the episode either way. By 2025–2026 he had turned on the conference publicly — "It's not a hacking con anymore" — and posted in August 2026 that he was "glad that I'm not going to defcon this year."
-
2023
SANS, and the podcast circuit
He presents Uncovering Law Enforcement Activities: Darknet Vendor OSINT Perspectives at the SANS OSINT Summit 2023, billed as "Sam Bent, DoingFedTime, LLC," and sits for a full Darknet Diaries episode, where he opens: "my name is Sam Bent. It's a matter of public record."
-
2026
The errata
attrition.org lists him on Breaking Bad, its errata page of information-security professionals convicted of crimes, summarizing the case and his move to "the conference circuit" as an OSINT/OPSEC "darknet expert." The same page says: "In cases where someone was arrested, convicted, served time, and subsequently released, we sincerely hope that they have found a new path forward… No judgement is being made after release." We found no public response from Bent to the listing.
both sides, on the record
The adjudicated core: he pleaded guilty to conspiracy to distribute controlled substances and money laundering, forfeited $14,000, and was sentenced to five years. That is not an allegation [1] [2].
The expertise is the offense: the stage credential — "Veteran Darknet Vendor," "Ex Vendor & DNM Admin" — is the conduct he was convicted for, repackaged as a qualification. attrition's stated reason for keeping such pages up is that "future employers deserve to know if their employees have a criminal past, especially if they re-enter the information security industry" [5] [12] [14].
His own story outruns the docket in places: his slide says he "was granted a 'franks hearing'"; the docket shows the motion terminated on his guilty plea, never ruled on. His account of a post-DEF CON attempt to return him to prison has no match in the indexed docket [1] [5] [9].
A federal judge already weighed him. The court that sentenced him found he cooperated from the day of arrest, confessed immediately, kept a clean prison record, and was unlikely to reoffend — and released him over the government's opposition, holding that "the purpose of punishment is met" [2].
He hides nothing. Unlike the credential-fabricators this archive usually catalogs, he leads with the conviction: his prison number is on his first slide, and he opens interviews by calling his name "a matter of public record." His talk tells the audience not to do what he did: "It's a bad business model, even if you have perfect OpSec" [5] [8].
He owns it. At sentencing he apologized and said he deserved punishment; on Darknet Diaries he took the blame off his co-defendant: "it's not her fault. It's my fault" [4] [8].
attrition's own terms. The list that names him says it makes "no judgement… after release" and "sincerely hope[s]" its subjects "have found a new path forward." attrition's errata FAQ also states it has "no policy" of contacting subjects before publishing, but that "anyone may dispute" an entry and that it has removed people who "demonstrated awareness of those mistakes." We found no dispute from Bent and no independent critique of the Breaking Bad page [12] [13].
YOU DECIDE
Scoped to one claim: is "darknet expert" a charlatan's credential? Not in the usual sense. The expertise is real in the only way that counts in court — he did it, pleaded to it, and served for it — and it is disclosed, not invented. Where his telling runs ahead of the record, it runs on details (a hearing that was scheduled, not held; a revocation the docket does not show), not on the conviction.
Weigh the costly signals. He paid eighteen months and a forfeiture; he still carries the register number on his slides. A federal judge wrote that he no longer needed to be locked up; the government fought his release and his early termination and lost the first, won the second. Whether a conference should hand that résumé a microphone is the argument attrition started. The record supports the listing and the second act at the same time.
The archive does not judge after release. It keeps the docket and the slide deck side by side.
evidence locker
PRIMARY RECORD — COURT & DOJ
Docket, United States v. Bent, No. 5:18-cr-00061 (D. Vt.) — CourtListener RECAP mirror ADJUDICATED — indictment (May 24 2018), suppression /
Franks motion (Doc. 22), change-of-plea minute entry (Doc. 47: guilty to Counts 1, 7, 8, 9; $14,000 forfeiture; Doc. 22 "terminated pursuant to guilty plea"), both compassionate-release motions (Docs. 67, 77), both early-termination motions and orders (Docs. 90–99). Bot-blocked (403) to scripts; live in a browser.
courtlistener.com/docket/22458977/united-states-v-bent/
PRESS
FIRST-PARTY — HIS OWN TALKS, INTERVIEWS AND POSTS
DEF CON Conference (YouTube) — "DEF CON 30 - Sam Bent - Tor - Darknet Opsec By a Veteran Darknet Vendor" FACT — the talk, on DEF CON's own channel.
youtube.com/watch?v=01oeaBb85Xc Darknet Diaries, ep. 132 — "Sam the Vendor" (official transcript) TESTIMONY — his own long-form account: the shop, the arrest, "it's my fault," the plea, the release. Note: the host's narration places his paralegal qualification after release; attrition places it in prison.
darknetdiaries.com/transcript/132/ SANS Cyber Defense (YouTube) — "Uncovering Law Enforcement Activities: Darknet Vendor OSINT Perspectives," SANS OSINT Summit 2023 FACT — the SANS talk; speaker listed as "Sam Bent, DoingFedTime, LLC."
youtube.com/watch?v=dXV6hZzV94k Sam Bent — YouTube channel (@Sam_Bent) HIS WORDS — the self-description quoted in the poster.
youtube.com/@Sam_Bent
THE ERRATA — ATTRITION.ORG
attrition.org — Errata: Breaking Bad ATTRIBUTED — the list of information-security professionals convicted of crimes, maintained by attrition.org; its rehabilitation and "no judgement is being made after release" statement.
attrition.org/errata/breaking_bad/ attrition.org — Errata Project FAQ ATTRIBUTED — attrition's own stated method: peer review before posting, no pre-publication contact policy, disputes welcomed, removals made.
attrition.org/errata/faq.html
CONTEXT & CROSS-LINKS
The standard. Sam Bent is a living person who has served his sentence. Every conviction fact is stated as the federal docket and the court's own order state it; every claim of his is attributed to him and set beside what the record shows, including where the record is silent. The court's favourable findings, his own disclosure and apology, and attrition.org's own "no judgement after release" statement are given at full strength. His co-defendant is a private person and is not named. No motive is asserted beyond the record. If a line here couldn't survive a defamation challenge, it wouldn't be on the page.