Investigators looking into the 2018 disappearance and suspected murder of the wife of a Norwegian billionaire are focusing on a cryptocurrency scam, fake passports, and a plot to deceive police.
On Halloween 2018, Anne-Elisabeth Falkevik disappeared without a trace from the palatial Lørenskog home she shared with her husband, the real-estate baron Tom Hagen. He said he found a computer letter demanding $10 million to be transferred into cryptocurrency, and was told to stay quiet or his wife would die. When he finally went to police, they told him to keep it hushed up for another 10 weeks while they investigated.
Police found scant forensic evidence in the family home beyond evidence of a struggle where the then-69-year-0ld woman may have hidden from her kidnappers before they took her. There was no sign of forced entry into the house, but it was rare for Falkevik to keep the doors locked when she was at home alone.
ADVERTISEMENT
After more than a year and a half, police arrested Hagen and an unnamed 30-year-old man in April 2020, charged with kidnapping and murder, even though Falkevik’s body still has never been found.
Hagen was released from custody 11 days later and remains a free man, though still charged with the crimes. The 30-year-old now is believed to be Ole Henrik Golf, who does not exist at all. His identity was sold on the darknet web by a now-defunct (or renamed) company called CardPass.
Investigators in Norway have traced the identity of the nonexistent man named Golf to another Norwegian man who bought Golf’s identity packet in 2016 as a way to buy hard drugs online when he was in his twenties. That man, who is not named, was interviewed by Norway’s E24 news service, and has been cooperating with police to help track down just how false identities are bought and sold. E24 interviewed him but agreed not to reveal his real identity, but instead refer to him as the first false Golf.
The first false Golf sold back the identity to a darknet service that recycles false identities. It is the person who bought it next that is now tied to Falkevik’s demise. That person, the second false Golf, opened a series of cryptocurrency exchange accounts under the email address ohgolf@mail.com, which are now tied to the Norwegian billionaire.
But police need to find the man who sold Golf’s identity to the second buyer, hoping that in doing so they can uncover where Falkevik is, or where her remains might be found. There has never been a followup letter from the alleged kidnappers, but police have studied the original one, and determined a number of interesting details, according to E24, all the way down to where the paper and envelope were purchased. They say the letter was created using WordPad for Windows, using standard defaults. It was painted on Clas Ohlson copy paper, made in Portugal but widely sold in Norway, which they say means it was likely purchased locally. They even know that the letter was printed on a Hewlett Packard inkjet using HP302 or HP 304 cartridges. But since no one licked the envelope, made with Mayert Kuvert paper for Clas Ohlson, the clues stop there.
At first police believed that the letter was written in poor Norwegian by a non-native speaker. But now, according to a recent report, they believe that it was written by a mother tongue Norwegian speaker trying to fake bad writing. “In other words, the other language features we see in the text are assumed to be artificial or intentional,” police said last month in an update on the case.
Police are now focused on CardPass, or whatever incarnation is its current state, but are trying not to spook the person or people who run it to go further underground. They say they do not want to arrest the person who sold the Golf identity to the second buyer. Instead they just want the biometric information of that buyer—who would have likely used a clever alias to make the purchase.
Other new information that has emerged in the last few months is that the kidnapper or kidnappers used the chat feature on a bitcoin trading app to communicate with police through highly untraceable coded messages. The letter also contained a link to a website called pasted.co, which is a way to transfer text documents discreetly. The password they supposedly gave Hagen was, somewhat predictably, “Anne.” They also used the less known cryptocurrency Dash to hide the money trail involved in the kidnapping, which authorities believe was likely wealthy Hagen paying someone to nab his wife.
Now police are again asking the public for information. Lørenskog prosecutor Gjermund Hanssen told E24’s television arm VG that they are looking for someone savvy. “We are wondering who in 2018 had both these skills and the willingness to do this to Anne-Elisabeth Hagen,” he said. The letter had instructed Tom Hagen to send bitcoin to an address for which he would be then given instructions, which he did. The instructions led him to 12 more bits of instruction, each one to be paid in bitcoin.
Another crypto address was given if he wanted to pay the ransom in full, which he had the funds to do but did not. Instead, police helped him pay the equivalent of $1.45 million after which all communication stopped. Police are hoping that by reopening the line of communications for information, they can inch closer to the real truth about the billionaire and his wife.
