NEW YORK—After the lunch break Thursday in the Silk Road trial, defendant Ross Ulbricht took off his jacket. Minutes later, his lawyer Joshua Dratel took off the gloves.

In just over an hour of staccato cross-examination, Dratel's strategy became clear: he was going to pursue a line of questioning suggesting that the man who really controlled Silk Road wasn't his young client, but Mark Karpeles, the wealthy former owner of the Mt. Gox Bitcoin exchange.

If Karpeles could use Silk Road, a free-wheeling drug market, to jack up the price of bitcoin, he could become incredibly rich. It was a currency he had more invested in than anyone else. Until it was shut down, the great majority of bitcoin trades went through his Mt. Gox currency exchange.

"You thought you had probable cause that Mark Karpeles was intimately involved, as the head of Silk Road, correct?" Dratel asked Homeland Security agent Jared Der-Yeghiayan, who has been on the stand since Tuesday.

"By the contents of that affidavit—yes," he answered. In 2013, he had filled out papers asking a judge for a warrant to further investigate Karpeles.

The questioning took the government, and US District Judge Katherine Forrest, by surprise. Prosecutor Serrin Turner objected, saying Dratel was trying to get hearsay evidence. Soon, the jury was out of the room.

Dratel then stated his thesis more clearly. "They had this guy [Karpeles] in their sights and he'd never been charged," Dratel said. "Our position is that he set up Mr. Ulbricht."

The full story didn't unfold today. Der-Yeghiayan was briefly back on the stand, but the government peppered the cross-examination with questions. It was over by 4:00pm, and the jury was dismissed for a long weekend.

Karpeles has denied having anything to do with Silk Road and says he didn't even know of Ulbricht until he was arrested in October 2013. "I am not Dread Pirate Roberts," he said to Ars via e-mail. "The investigation reached that conclusion already—this is why I am not the one sitting during the Silk Road trial." Ars has published Karpeles' full response.

Ulbricht, 30, has pleaded not guilty to charges of drug trafficking and money laundering. The government says he's the one who ran the Silk Road marketplace on the hidden Tor network.

Yesterday, Der-Yeghiayan described how he worked undercover as "cirrus," a Silk Road staffer. Ulbricht was arrested in a public library, with his computer open to the "staff chat" page—the exact same chat dialogue that Der-Yeghiayan had open in a cafe next door.

Business management

Today's testimony began with the prosecution picking up where they'd left off yesterday—with Ulbricht about to be arrested.

DPR wrote his last instant message on October 1: "ok, which post?"

With that, Der-Yeghiayan's cohorts in the San Francisco public library snapped into action. They got his e-mail, then walked over to Ulbricht. Der-Yeghiayan joined them from the Bello Cafe next door, carrying his open laptop.

The agents grabbed Ulbricht and handcuffed him. More importantly, they took his laptop, before he could close it. They snapped photos of Ulbricht's screen. It was open to the chat he was having with "cirrus"—in reality, Der-Yeghiayan, chatting with him from the cafe. Another photo clearly showed the forum-moderation page he was looking at: the exact one "cirrus" told him needed attention.

They weren't done. Agents pressed the "back" button on his browser, going back in the history of Ulbricht's day, taking photos as they went. While he sat handcuffed, his Web history was becoming evidence.

Today the jury saw what Ulbricht was browsing. One page read "account," with just over 50,577 bitcoins in it—several million dollars. Another page kept track of the time spent online by three trusted moderators, inigo, Libertas, and cirrus.

Back again. The jury saw another Silk Road page, with a status bar reading "escrow (usd)," which showed $4,146,736.57, and its equivalent in bitcoin, then 30,951.60. Another page listed packages: how many were "unshipped" (7,681), how many were "in transit" (25,689), and how many needed "resolution" of some kind (2,036).

After the arrest, agents rushed to Ulbricht's house and put their search warrant into action. They found Ulbricht's room and searched it, grabbing his passport and driver's license. On a crumpled-up piece of paper in his trash, they found two crumpled-up notes that made their way to a jury today. One talked about buyer and seller "weights," and was full of equations. The other had musings about a feedback system, with a 1-5 list. 5 was "wow! outstanding;" 4 was "solid, would recommend;" 3 was "meh, they're OK I guess."

The jury saw Ulbricht's passport, with exit and entry stamps showing he traveled to the Dominican Republic in November 2012. (Prosecutors had said in their opening statement Ulbricht was planning his getaway in the Caribbean.)

Government lawyer Serrin Turner finished up just before 11:30am. Their description of the "red-handed" arrest left defense lawyer Joshua Dratel with a serious conundrum: how do you convince a jury your client didn't run a drug empire when his computer was taken while it was open to the management page?

Soon, the jury, the gathered observers, and the whole world, would see.

Acting class

Under direct examination, Der-Yeghiayan had explained the role of "Dread Pirate Roberts" in pop culture. He was a character in the Princess Bride who had taken the identity of someone else.

Earlier in his cross-examination, Dratel turned that around. DPR was using the same PGP key on his posts—but so what? Weren't those like car keys, Dratel said, easily copied or shared?

The agent acknowledged they were.

"You yourself thought DPR had changed over time, right?" Dratel asked.

"There were times when the writing made me think that, yeah, it was a different person," Der-Yeghiayan said.

"Didn't you tell people in your organization that you thought Dread Pirate Roberts had changed, in April?" Dratel asked. "You thought there was a different DPR, notwithstanding the continuity of the PGP key?"

It was true, Der-Yeghiayan said. He had e-mailed his colleagues, saying he thought there's been a change in leadership, which he recalled as being in April 2012.

"Have you taken any acting courses?" asked Dratel.

"No I have not," answered the agent.

"What about computer training?"

"Just the basics from the academy," said Der-Yeghiayan, who was in Customs and Border Patrol before joining HSI.

Dratel: Yet, you were able to do this flawlessly.

Der-Yeghiayan: Yes.

Dratel: You had over a dozen accounts. You were an admin.

Der-Yeghiayan: Yes.

Dratel: You were communicating with other admins? Inigo, and Libertas?

Der-Yeghiayan: Yes.

Dratel: They didn't know you were law enforcement. Other Silk Road users, none of them knew that cirrus was law enforcement?

Der-Yeghiayan: Correct.

Dratel: Without any training, you were able to do that?

Der-Yeghiayan: Yes.

Dratel: You had multiple identities. No one said, "You're law enforcement! You're a cop! Get off the site!"

Der-Yeghiayan: There was always a level of distrust, in terms of, who are you talking to. There were times we didn't know who was operating what account. It was difficult.

Dratel: In fact, at one point, you said "Who's on first?" Literally, right?

Der-Yeghiayan: I may have, if it's in an e-mail.

Dratel's clear message: You don't know who people are online, especially on Silk Road. The "cirrus" account had originally been called "Scout"; Der-Yeghiayan was surprised when he found out Scout was a woman.

"You never spoke to DPR on the phone, right?" Dratel asked. "Never communicated with him in an ordinary Internet communication, right?"

"Nothing outside of Tor," Der-Yeghiayan said.

And the other admins? asked Dratel. Did they know more about DPR?

"Not that they told me," said the agent.

Currency Exchange

In early 2013, Der-Yeghiayan opened an investigation into Mark Karpeles, the owner of Mt. Gox, formerly the world's largest Bitcoin exchange. Mt. Gox collapsed in February 2014, four months after Ulbricht's arrest; Karpeles is mired in a complex bankruptcy case.

"Did you believe him to be the mastermind behind keeping Silk Road secure and operating?" asked Dratel.

"He had the credential to do so," said Der-Yeghiayan. And, he "had ties to the original silkroad.org," he said.

In the middle of the year, Der-Yeghiayan's investigation was heating up. He went to get the warrant mentioned earlier. He got a spreadsheet of transactions between money changing service Dwolla and Mt. Gox.

But another HSI office began investigating Karpeles, as well. In May, the Baltimore-based HSI agents moved ahead with a seizure of some Mt. Gox assets, saying it was an unlicensed money exchange. They notified Der-Yeghiayan by phone, and he wasn't pleased.

Der-Yeghiayan wrote a long memo, apparently asking the Baltimore office to back off. "I was upset, yes," he said on the stand.

"So you had your own investigation—and that could have been wiped out?" asked Dratel.

At that point, the government broke in.

"I think now is a good time to take our afternoon break," said Judge Forrest with a smile. There was scattered laughter in the courtroom. The jury filed out.

Dratel was getting ready for a deep dive; the government said he was bringing in evidence that was hearsay.

"Our position is that he set up Mr. Ulbricht," Dratel said. He told the judge some of the evidence he wanted to bring in. For instance, Karpeles was involved with the creation of Bitcointalk.org, which ran a somewhat outdated version of MediaWiki; Silk Road ran the same version. When DPR gave his only extensive interview, to Forbes in August 2013, he said "I am not the first DPR."

"That sounds very much like Karpeles," Special Agent Der-Yeghiayan wrote in an e-mail to colleagues.

The judge said she'd taken written papers over the weekend to consider both sides. She dismissed the jury for the afternoon, reminding them not to talk or read about the case. "And don't go watch Princess Bride over the weekend," she said.

By the day's end, Ulbricht seemed more relaxed. He smiled, and shared a few laughs with Dratel's younger associate lawyer. His long weekend will be spent in jail, where he has been for more than a year. But he seemed pleased with the cross-examination and the hubbub that ensued. In a way, he was being heard.