Darknet market takedowns: every major police operation since 2012, and the sentences that followed
Darknet market takedowns come in three kinds, and the third is the one that catches people. Police take the servers and arrest whoever runs the site, as the FBI did with Silk Road in October 2013 and German police with Archetyp in June 2025. Police take the market over and keep it running, as the Dutch did with Hansa for a month in 2017. Or, a year or two after a seizure, police go through the seized database and arrest the vendors: 288 people in Operation SpecTor in 2023 came out of Monopoly Market's server, and 270 in Operation RapTor in 2025 came out of the data from four markets that closed before it. The record runs from Operation Adam Bomb in April 2012 to the Archetyp seizure in June 2025, and the court cases are still landing in 2026.
Every major darknet market takedown, operation by operation
The last column gives what police seized, or, where the release gives no seizure figure, the market's size in users, orders or listings. Read neither as the market's turnover. The markets themselves, including the ones that ended without any police at all, are in the history of darknet markets.
| When | Operation and target | Who | Arrests | Seized, or scale in the release |
|---|---|---|---|---|
| Announced 16 Apr 2012 | Operation Adam Bomb: The Farmer's Market, an onion drug market that took PayPal and Western Union | DEA Los Angeles, with Dutch police | 8, in the Netherlands, Colombia and the US | About 3,000 customers in 34 countries; 5,256 orders worth about $1,041,244 from January 2007 to October 2009 |
| 1 Oct 2013 | Silk Road. No public operation name | FBI, DEA, IRS | Ross Ulbricht, in a San Francisco library | About 173,991 bitcoin in total, most of it from Ulbricht's own computer, worth over $33.6 million on 25 October 2013 |
| 5 and 6 Nov 2014 | Operation Onymous: Silk Road 2.0 and hundreds of other onion services | Europol's EC3, the FBI, ICE HSI, Eurojust; 16 European countries and the US | 17, among them Silk Road 2.0's operator, Blake Benthall, on 5 November | More than 410 hidden services; bitcoin worth about $1 million; €180,000 in cash |
| 20 Jun to 20 Jul 2017 | Operation Bayonet: AlphaBay. In the same weeks, the Dutch takeover of Hansa | FBI and DEA; Dutch National Police for Hansa; Thailand, Canada, Lithuania, Europol | Alexandre Cazes in Thailand on 5 July; he died in custody on 12 July. Hansa's two administrators, in Germany | AlphaBay servers in Canada and the Netherlands; about 10,000 foreign Hansa buyers' addresses passed to Europol |
| 27 to 30 Mar 2018 | Operation Disarray: vendors, the first operation of the FBI's new darknet team, JCODE | JCODE, announced on 29 January 2018 | 8 | Search warrants and vendor interviews across the US |
| 11 Jan to 12 Mar 2019, announced 26 Mar | Operation SaboTor: vendors | JCODE (FBI, DEA, HSI, CBP, the postal inspectors, the Defense Department) with Europol | 61; 50 darknet accounts shut | 299.5 kg of drugs, 51 firearms, more than $7 million in crypto, cash and gold |
| 23 and 24 Apr 2019, announced 3 May | Wall Street Market, caught in the middle of its own exit scam. Finland's Silkkitie, also called Valhalla, the same day | German BKA and Frankfurt prosecutors, with the DEA, Dutch and Brazilian police; Finnish Customs for Silkkitie | Three German administrators and a Brazilian moderator | Wall Street Market's servers; the Silkkitie server |
| 22 Sep 2020 | Operation DisrupTor: vendors, built on the Wall Street Market servers | JCODE with Europol | 179: 121 in the US, 42 in Germany, the rest in the Netherlands, the UK, Austria and Sweden | More than $6.5 million; about 500 kg of drugs; 63 firearms by the DEA's count, 64 by Europol's |
| Announced 12 Jan 2021 | DarkMarket | Koblenz prosecutors and Oldenburg police, with Australia, Denmark, Moldova, Ukraine, the UK and US agencies | The alleged Australian operator, near the German-Danish border | Servers in Moldova and Ukraine; the market had almost 500,000 users and more than 2,400 sellers |
| 26 Oct 2021 | Operation Dark HunTor: vendors, built on DarkMarket. Italy shut DeepSea and Berlusconi in the same operation | JCODE with Europol and Eurojust | 150: 65 in the US, 47 in Germany, 24 in the UK, the rest in five other countries | More than $31.6 million; about 234 kg of drugs; 45 firearms |
| 5 Apr 2022 | Hydra. No public operation name | German BKA and Frankfurt's cybercrime prosecutors (ZIT), with US agencies; US Treasury sanctions the same day | None announced in Germany. Dmitry Pavlov, a Russian, was charged in the US with running the servers' hosting company | The German servers and 543 bitcoin, about €23 million |
| 4 and 5 Apr 2023 | Operation Cookie Monster: Genesis Market, which sold stolen logins, not drugs | FBI and Dutch National Police, with 17 countries | 119 by the Dutch police's count | 11 domains; the market held data from more than 1.5 million computers |
| 2 May 2023 | Operation SpecTor: vendors, built on Monopoly Market's server, seized in December 2021 | JCODE with Europol, nine countries | 288: 153 in the US, 55 in the UK, 52 in Germany | $53.4 million (€50.8 million) in cash and crypto; 850 kg of drugs, 64 kg of it fentanyl; 117 firearms |
| 16 Dec 2023, announced 20 Dec | Kingdom Market | German BKA and ZIT, with US agencies | Alan Bill, a Slovak administrator, at Newark airport on 15 December | The servers; the market had more than 42,000 listings |
| 20 Mar 2024 | Nemesis Market | German BKA and ZIT, with US and Lithuanian agencies | None. The administrator, in Iran, was sanctioned a year later | The servers and about €94,000 in crypto |
| 27 Jun 2024, announced 8 Oct 2024 | Bohemia and Cannabia, months after the market's own exit scam | Dutch National Police, with the Irish authorities | An administrator at Schiphol airport, and another by the Irish authorities. A Dublin man was sent for trial in Ireland in 2025 on money-laundering charges. | About €8 million in crypto |
| 22 May 2025 | Operation RapTor: vendors, built on Nemesis, Tor2Door, Bohemia and Kingdom | JCODE with Europol | 270: 130 in the US, 42 in Germany, 37 in the UK, 29 in France, 19 in South Korea | More than $200 million; more than two metric tons of drugs, 144 kg of it fentanyl or fentanyl-laced; more than 180 firearms |
| 11 to 13 Jun 2025, announced 16 Jun | Operation Deep Sentinel: Archetyp Market | German BKA and ZIT, with Spain, the Netherlands, Romania, Sweden and the US, through Europol and Eurojust | The administrator, a 30-year-old German, in Barcelona | The servers in the Netherlands; about €7.8 million in assets |
Two patterns are visible down the "Who" column. Germany's BKA and the Frankfurt prosecutors, the ZIT, are behind most of the server seizures since 2019: Wall Street, Hydra, Kingdom, Nemesis, Archetyp. The FBI-led JCODE team, created in January 2018, runs the vendor sweeps that follow them. TRM Labs wrote in early 2025 that no major Russian-language market had been successfully targeted since Hydra, and no release since then has named one.
How one seized server becomes hundreds of arrests
A seized market is evidence for years. Every JCODE sweep since 2020 names the server it was built on, and the gap between the seizure and the arrests has run from nine to 17 months.
- Wall Street Market, seized April 2019
- Operation DisrupTor, 17 months later: 179 arrests.
- DarkMarket, seized January 2021
- Operation Dark HunTor, nine months later: 150 arrests.
- Monopoly Market, seized December 2021
- Operation SpecTor, 17 months later: 288 arrests, including people who had also been selling on other markets.
- Kingdom, Nemesis, Bohemia and Tor2Door, gone between September 2023 and March 2024
- Operation RapTor, May 2025: 270 arrests. Tor2Door and Bohemia ended in exit scams, and the data still reached the police.
An exit scam does not destroy the database: Bohemia's administrator was arrested at Schiphol half a year after the market took its users' money. TRM Labs wrote in 2025 that agencies now often take a market down without announcing it, so vendors under investigation are not warned. It traces the practice to the 2017 AlphaBay operation, which it calls Bayonet/GraveSac. So a market that vanishes without a seizure banner may still be in police hands.
Hansa is the version where the police did not wait for the database to go cold. It is the one operation that collected new evidence live, from people who arrived after the takeover.
The honeypot: Hansa was the police for a month
Dutch police ran Hansa from 20 June to 20 July 2017 and announced the takeover only when they switched it off.
Europol's account: Dutch police, with a lead from Bitdefender through Europol, found Hansa's servers in the Netherlands, arrested two administrators in Germany, and took the servers in the Netherlands, Germany and Lithuania. On 20 June 2017, under Dutch judicial authority, they took the market over and monitored it until they switched it off on 20 July. AlphaBay's administrator was arrested in Thailand on 5 July, in the middle of that window. Anyone who treated "AlphaBay is gone, Hansa is still up" as a reason to move was walking into the operation.
Europol says an eight-fold increase in new Hansa members was recorded immediately after AlphaBay's shutdown, and that the Dutch police "could identify and disrupt the regular criminal activity on Hansa but then also sweep up all those new users." In those weeks they collected delivery addresses and passed some 10,000 foreign addresses of buyers to Europol. Markets hold buyers' money until delivery, as the DEA puts it: "large darknet marketplaces, which typically hold money in escrow while a vendor delivers illicit goods." So whoever runs the market, police or administrator, holds both the money and the delivery addresses.
What happened to the people who ran the markets
In the US and Russia, administrators who were caught got decades unless they cooperated; German and Dutch courts gave between two and nine years. The sentences arrive years after the seizure: Empire went offline in 2020 and its co-creator was sentenced in October 2026. Ross Ulbricht's life sentence, one of two on the list, ended with a presidential pardon after eleven years.
| Who | Market | Outcome |
|---|---|---|
| Ross Ulbricht, "Dread Pirate Roberts" | Silk Road | Life, on 29 May 2015, and forfeiture of $183,961,921. Full and unconditional pardon on 21 January 2025. |
| Roger Thomas Clark, "Variety Jones" | Silk Road, senior adviser | 20 years, on 11 July 2023 |
| Blake Benthall, "Defcon" | Silk Road 2.0 | Pleaded guilty in 2015 and cooperated; sentenced in 2021 to time served and probation, according to The New York Times |
| Alexandre Cazes, "Alpha02" | AlphaBay | Died in custody in Thailand on 12 July 2017, a week after his arrest |
| Gal Vallerius, "OxyMonster" | Dream Market, moderator | 20 years, in October 2018 |
| Three German operators | Wall Street Market | 7 years 9 months, 6 years 3 months, and 5 years 3 months, Frankfurt regional court, 2021 |
| The Australian operator and an accomplice | DarkMarket | 9 years, and 5 years 6 months, Trier regional court, December 2022, open to appeal |
| Stanislav Moiseyev | Hydra | Life and a four-million-rouble fine, Moscow Regional Court, 2 December 2024; 15 accomplices got 8 to 23 years. The Russian case covered Hydra's network from 2015 to October 2018, not its whole life. |
| Alan Bill | Kingdom Market | 200 months, in May 2026 |
| A British administrator, 21 when arrested | Bohemia and Cannabia | Two years, Rotterdam district court, 15 December 2025 |
| Rui-Siang Lin, "Pharaoh" | Incognito Market | 30 years, on 3 February 2026, and forfeiture of $105,045,109.67 |
| Raheim Hamilton | Empire Market | 40 years and a $5 million fine, on 5 October 2026. The other co-creator, Thomas Pavey, pleaded guilty and was due to be sentenced later that month. The sentencing note has the detail. |
| The Archetyp administrator | Archetyp Market | Charged in Frankfurt in August 2026, with alleged earnings of about €20 million. The trial opened on 28 September 2026 with a confession. |
| Behrouz Parsarad | Nemesis Market | Sanctioned by the US Treasury on 4 March 2025 as Nemesis's sole administrator, living in Iran. Indicted in Ohio in April 2025. |
None of these releases describes a break of Tor. Ulbricht was named through a Gmail address and a Stack Overflow account he used on the open web, outside Tor, and the guide to whether Tor can be traced goes through that trail step by step.
Do takedowns stop the darknet drug trade?
No, and Europol said as much in 2015. Its assessment, written after Operation Onymous, said hidden services "continue to grow, multiply and evolve." Chainalysis put the money flowing through darknet markets at nearly $2.6 billion in 2025, three years after Hydra, the largest market police have shut. What takedowns do is end particular markets, move the users to whichever one is left, and fill court calendars for the next five years. Where the users went after each closure, market by market, is part of the history of darknet markets.
Darknet market shutdowns in 2026, and three operations that were not markets
No police force seized a drug market in 2026 up to late October. The year's market endings were exit scams, DarkMatter and Nexus among them, and those are in the history page's 2023 to 2026 section. What 2026 added on the police side is the court end of older markets, plus three operations that a "markets seized" list will absorb if you let it.
Operation Alice's 373,000 sites would dwarf every other row in a takedown table. In March 2026, authorities in 23 countries, led by Germany with Europol, moved against one operator's network of more than 373,000 fraudulent dark-web sites. The release, published 20 March, says 105 servers were seized and 440 of his roughly 10,000 customers were identified; the case is still open against more than a hundred of them. The sites advertised child sexual abuse material and crime-for-sale services, but Europol says customers paid and received nothing. Europol describes the operator as a 35-year-old man in China whom it has identified but not arrested; Germany has an international warrant out for him, and his profit was over €345,000. One man running scam sites does not belong in a column next to Hydra.
On 3 and 4 March 2026, agencies in 14 countries seized LeakBase, a forum for buying and selling stolen data, with over 142,000 members and more than 215,000 messages. The Justice Department announcement is 4 March. Searches and arrests ran in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain and the United Kingdom. No single operator is named in that release. It is a forum for stolen credentials and card data, the successor in the department's telling to RaidForums and BreachForums, not a drug market.
On 10 June 2026, in the country of Georgia, two alleged administrators of AudiA6 were arrested. Eurojust's release the next day says the service is suspected of laundering more than €336 million in criminal cryptocurrency between 2022 and 2025, taking a commission of 3% to 10%, and that the same group ran a forum called Dark2Web. Twenty-five domains were taken down, more than 30 servers seized, €692,000 in cryptocurrency frozen and over €86,000 seized. A co-perpetrator had been arrested in Poland in September 2025. A laundering service is what a market's vendors use to cash out, and the €336 million is the suspected flow through the service, whatever its source.
The open endings are the ones a fresh headline will get wrong first. The Treasury said in March 2025 that Parsarad was talking with former Nemesis vendors about a new market; he was indicted in Ohio the next month and has not been arrested. Abacus went offline in July 2025, and TRM Labs called it a likely exit scam in the same post that describes agencies taking markets down without announcing it. Hansa is why that matters: the busy replacement was the police, and the public found out a month later. If a market vanishes without a seizure banner, its database may still be in police hands, and the exit scam warning signs cover the buyer's side of the same ending.
Sources
The primary documents this page leans on most: operation announcements from the agencies involved, and the court and clemency records for the sentences.
- DOJ, Operation Adam Bomb (2012), the Farmer's Market arrests and order figures.
- DOJ, Silk Road seizure (2013), Ulbricht's arrest and the 173,991 bitcoin.
- Europol, Operation Onymous (2014), hidden services, arrests and seizures.
- DOJ, AlphaBay shut down (2017), Cazes's arrest and death in custody.
- Europol, AlphaBay and Hansa (2017), the Dutch takeover of Hansa and the 10,000 buyer addresses.
- Europol, Wall Street Market and Silkkitie (2019), the server seizures.
- Europol, Operation DisrupTor (2020), 179 arrests by country.
- Europol, DarkMarket takedown (2021), the operator's arrest and the market's size.
- DOJ, Hydra shutdown (2022), the US charges against Dmitry Pavlov.
- BKA, Hydra servers (2022), the German seizure and 543 bitcoin.
- Europol, Operation SpecTor (2023), 288 vendor arrests and the seized assets.
- DOJ, Operation RapTor (2025), 270 arrests and the record seizures.
- Europol, Archetyp Market takedown (2025), the servers and the administrator's arrest.
- FBI, Ulbricht sentencing (2015), the life sentence and $183,961,921 forfeiture.
- DOJ, Ulbricht pardon (2025), the full and unconditional pardon.
- Trier regional court, DarkMarket verdict (2022), the sentences for the operator and an accomplice.
- DOJ, Incognito Market sentence (2026), 30 years and the forfeiture.
- DOJ, Empire Market sentence (2026), 40 years for the co-creator.