The dark side of the Matrix messaging app and why criminals love it

In 2021, Dutch authorities stumbled upon an encrypted messaging platform during an investigation into the murder of journalist Peter de Vries, a case tied to the Moroccan mafia.

What seemed like just another communication tool soon unravelled into Matrix– not to be confused with the open-source Matrix protocol at matrix.org – a highly sophisticated service designed explicitly for organised crime.

By December 2024, Matrix was no longer the refuge its creators once promised.

French and Dutch investigators, in collaboration with Europol and other European law enforcement agencies, shut down the network after months of consistent surveillance and reading criminals’ messages in real time.

Its features and exclusivity set it apart, raising the question—what made this app such a haven for criminals?

Why criminals prefer ‘encryption’

Matrix functioned as a subscription-based encrypted app with 40 servers, offering much more than standard text-based messaging.

It first emerged as a prime tool for criminal networks with at least 8,000 users from all over Europe as an alternative to EncroChat and Sky ECC, similar platforms dismantled by law-enforcing agencies.

But why did criminals flock to Matrix in the first place?

The appeal could have been in its perceived invisibility. Traditional chat apps, no matter how secure, often remain on the radar of international task forces.

Legitimate encryption tools, while used widely by privacy-conscious citizens, frequently maintain some relationship with official oversight, at least in the form of cooperation with law enforcement under proper legal frameworks.

But platforms like Matrix attempted to break away from any oversight entirely—operating in the shadows, never acknowledging their true clientele, and continually evolving their systems to avoid detection.

"It was soon clear that the infrastructure of this platform was technically more complex than previous platforms such as Sky ECC and EncroChat," Europol explained Tuesday.

According to Dutch authorities and Europol, the app provided secure calls, voice changers, video conferencing, file-sharing options, and even a dedicated currency for subscription fees.

Subscribers could send encrypted messages, make anonymous calls, and monitor transactions while staying off the radar.

“End-to-end encryption helps people to protect their privacy but unfortunately the criminals as well,” says Serge Vaudenay, a cryptography professor at the Swiss Federal Institute of Technology Lausanne (EPFL).

“Allowing strong encryption or not has always been a hot political debate and where to put the boundary has evolved back and forth a lot over time from ‘it is illegal to encrypt anything with strong means’ to ‘anyone is allowed to protect themselves by strong encryption’,” Vaudenay tells TRT World.

Matrix’s invitation-only access required an expensive subscription fee, ranging from €1,300 to €1,600 for six months, which made it more exclusive and seemingly impenetrable.

‘Made by criminals for criminals’

For three months, law enforcement intercepted communications on Matrix, gathering over 2.3 million messages in 33 languages.

“The messages that were intercepted are linked to serious crimes such as international drug trafficking, arms trafficking, and money laundering,” Europol said, describing the app as a service “made by criminals for criminals”.

Europol noted the platform’s criminal-centric design, stating, “The founders were convinced that the service was superior and more secure than previous applications used by criminals.”

The investigation culminated in coordinated raids across Europe.

In France, one suspect was arrested, and their house was searched. In Spain, two arrests were made following European arrest warrants, with six houses searched. Lithuanian authorities conducted similar searches, while the main servers in France and Germany were taken offline.

The operation also led to the seizure of €145,000 in cash and a million euros in cryptocurrency, Dutch police said.

Despite its sophistication, Matrix was brought under the radar due to the collective expertise of law enforcement agencies across five countries​​.

Europol emphasised the importance of such cooperation to TRT World, stating, “The case is being led by a Joint Investigation Team involving French and Dutch authorities, supported by an Operational Taskforce established at Europol. This task force includes law enforcement from France, the Netherlands, Spain, Lithuania, and Italy.”

A splash screen displayed to Matrix users after the platform was compromised read, “It’s inevitable. This won’t be the last time we can read your messages in real-time. We gained access to data related to this service and our investigation does not end here."

The encryption dilemma

In the end, Matrix’s downfall shows that what makes these secret platforms so appealing to criminals—strong encryption and private networks—also makes them challenging for law enforcement to crack.

As police learn new ways to break into these hidden corners of the internet, developers keep coming up with stronger methods to stay out of reach.

While the takedown of Matrix is a significant win for law enforcement, it also brings attention to the ethical and practical challenges surrounding encryption. End-to-end encryption is a cornerstone of digital privacy, but its misuse by criminals reflects its fundamental dilemma.

Vaudenay sheds light on this dilemma by pointing out a common vulnerability in encrypted apps “One general problem with nearly all end-to-end encrypted apps is that they start by relying on a weak assumption to initiate the communication,” he states.

“To start talking to someone, we must trust that we are talking to the right person, as instructed by some central server. Many attacks are based on this weakness. We are at the beginning of trying to fix this problem.”