Attorney’s Office in Atlanta and the FBI-Atlanta Field Division have connections to the international investigation into AlphaBay announced today. First, an investigation conducted in Atlanta has identified an AlphaBay staffer living in the United States. Attorney’s Office in Atlanta and FBI-Atlanta prosecuted Aaron Glende, a.k.a IcyEagle, who operated as a vendor on AlphaBay. Glende pled guilty to access device fraud and aggravated identity theft and was sentenced to four years and two months’ imprisonment on November 30, 2016. The migration of buyers and sellers comes as authorities around the world crack down on digital marketplaces that cater to growing numbers of shadowy sales. By comparison, Silk Road had just 14,000 when the Federal Bureau of Investigation closed it four years ago.
“I had given Cazes many ‘holy grails’ of anonimity, but he chose to use only certain things while he branded other methods/ways as ‘overkill,’” DeSnake writes, in his seemingly foreign-inflected and occasionally misspelled English. The platform’s rise and fall serve as a cautionary tale about the risks of operating on the darknet. From its explosive growth in 2014 to its dramatic takedown in 2017, and its brief return in 2021, AlphaBay’s journey is marked by events that left a big mark on the darknet scene. If a seller didn’t fulfill orders or was caught violating these rules, they could be banned from the platform. When buyers made a purchase, their funds were held in escrow by the platform until the product was delivered and verified.
The Top 7 Dark Web Marketplaces In 2025
AlphaBay accessed through the TOR network, had over 40,000 vendors at its peak, and over 250,000 listings of drugs and other chemicals, as well as over 100,000 listings for stolen identities, credit cards, counterfeit goods, malwares, and firearms, among others. Estimates suggest this marketplace facilitated trades worth USD 1 billion in bitcoin and other cryptocurrencies. Similarly, at the time of the takedown, Hansa was the third largest dark web marketplace, the perfect honeypot for global law enforcement teams to lure in cyber criminals and strike back. This operation to seize the AlphaBay site coincides with efforts by Dutch law enforcement to investigate and take down the Hansa Market, another prominent dark web market. Like AlphaBay, Hansa Market was used to facilitate the sale of illegal drugs, toxic chemicals, malware, counterfeit identification documents, and illegal services. The administrators of Hansa Market, along with its thousands of vendors and users, also attempted to mask their identities to avoid prosecution through the use of Tor and digital currency.
- Shortly after the breach, these records appeared on dark web forums, where they were sold to malicious actors aiming to exploit customers through targeted scams and phishing attacks.
- Alexandre Cazes, was discovered in Bangkok from a lead the authorities picked up from his own marketplace’s welcome email.
- AlphaGuard is a technology that allows users to withdraw funds and the server hosting the market to self-destruct in case of any unexpected changes to any or all of the servers.
- AlphaBay had significant real-world consequences that impacted both individuals and businesses.
Incognito Market provides 20,000+ listings with 2FA security, a 5% market share, and $2.8M monthly transactions. Drughub Market specializes in pharmaceuticals with 15,000+ listings, holding a 10% share of the drug trade and $2M monthly volume. A Canadian market established in 2021, WTN offers over 9,000 products, including narcotics, fake goods, and digital services. It operates in both French and English and has built a reputation for ease-of-use.
Shuttered Dark Web Marketplaces
The first major darknet market pioneered BTC trading, processing $1.2 billion before its 2013 shutdown. Take control of your digital security with an exclusive demo of our powerful threat management platform. The Australian Institute of Criminology is Australia’s national research and knowledge centre on crime and justice. It’ll be quiet on the dark web until people can find a reliable marketplace again, but eventually they will, said Emily Wilson, the director of analysis at Terbium Labs. Security company McAfee found that the upstart dark market House of Lions was offering vendors from AlphaBay a discount if they moved to their platform.
Torzon Market
In July 2017, police in the US and Europe, including the US Federal Bureau of Investigation, the Drug Enforcement Agency, Europol and the Dutch National Police, partnered to take down the site. AlphaBay’s servers were seized with the help of authorities in Thailand, Lithuania, Canada, the United Kingdom and France. The operation included the arrest of suspected AlphaBay founder Alexandre Cazes on 5 July, detained on behalf of the US in Thailand. He was held by the Royal Thai Police for approximately seven days before apparently committing suicide while in custody on 12 July 2017.
Each time, Christin points out, the dark web’s overall business took a temporary dive, but came roaring back more quickly after those setbacks and continued to grow as a whole. AlphaBay, for example, had more than 20 times as many product listings as the original Silk Road. (Some research has found that even bad news about the dark web markets only attracts more users to them.) And AlphaBay’s buyers and customers will eventually find a new home. AlphaBay’s takedown “may give people pause. But will it scare people away? I doubt it.” FBI deputy director Andrew McCabe acknowledged shutting down such markets was like playing whack-a-mole. His agency would likely have to take on more massive dark web marketplaces in the future, he said.
Cyble TIP Threat Intel
Rabenn was captivated by these glimpses into a world of billions of dollars moving in invisible transactions. But he also found that he admired and envied the prosecutors on the other side of the table—the way they worked in the public interest and possessed a certain autonomy, choosing which cases they would pursue. Shortly before AlphaBay took over the dark web’s top spot, Alpha02 had changed his username on the site to merely “admin” and announced that he would no longer accept any private messages sent to him by anyone other than AlphaBay’s staff.
Agentic AI In Cybersecurity: Transforming Threat Detection And Defense
WeTheNorth is a Canadian market established in 2021 that also serves international users. It offers counterfeit documents, financial fraud tools, hacking and malware services. It has an active forum and community along with an extensive user vetting process.
Tor Browser: Accessing The Darknet
- Alphabay rose to prominence with 400,000+ users and $600M yearly trades, ending in a 2017 bust.
- Prior to AlphaBay, Alexander Cazes had a reputable history on the darknet – specifically in the carding community.
- The takedown of AlphaBay was the result of effective cooperation between at least 11 agencies from six different countries.
- The law enforcement may have shut down AlphaBay Market, but the darknet drug markets are alive and even booming in the very same niche.
- On 7th August 2021 DeSnake re-opened AlphaBay for business after having his identity verified by PGP, forum admins, ex-AlphaBay staff members (those not caught) and multiple security researchers.
He claims, in fact, not to store any incriminating data on hard drives or USB drives at all, encrypted or not, and declined to explain further how he pulls off this apparent magic trick. DeSnake also claims to have prepared a USB-based “kill switch” device designed to wipe his computers’ memory and shut them off in seconds if they ever leave his control. A kind of practical paranoia permeated DeSnake’s messages to WIRED, both on a personal level and in his plans for AlphaBay’s revamped technical protections.
DeSnake has discussed that decentralization project since his earliest posts to the AlphaBay forums, and he acknowledges that it’s still years away. But he sees it as a way to both make AlphaBay invulnerable to future law enforcement takedowns and to pay back the dark web’s users for the millions they lost when the original AlphaBay server was seized. “When it comes to the money making this is investment in the future of AlphaBay,” DeSnake writes.
By mid-2013, Rabenn found that more and more of those reports were being triggered by financial transfers out of crypto exchanges, platforms where users could trade digital currency for traditional money like dollars, euros, or yen. The banks often suspected that these currency swaps were cash-outs of dirty digital profits. So Rabenn immersed himself in dozens of hours of YouTube videos to understand this still new currency called Bitcoin, its mechanics, and how it seemed to be powering an anonymous underworld of online commerce. For Grant Rabenn, the Fresno-based prosecutor, it was clear that Alpha02 was now the most wanted man on the dark web; Rabenn compared his notoriety among digital crime investigators to that of Osama bin Laden. AlphaBay and Alpha02 were invoked at every law enforcement conference on cybercrime, every interagency meeting, every training event, Rabenn says.
Evolution Of Darknet Markets
The platform was shutdown in 2017 by authorities during Operation Bayonet but they were unable to capture many of the staff members including its co-founder and security administrator DeSnake. AlphaBay operated as a hidden service on the “Tor” network, and utilized cryptocurrencies including Bitcoin, Monero and Ethereum in order to hide the locations of its underlying servers and the identities of its administrators, moderators, and users. Based on law enforcement’s investigation of AlphaBay, authorities believe the site was also used to launder hundreds of millions of dollars deriving from illegal transactions on the website. Discover the leading darknet markets of 2025 that dominate the Tor network with innovative features, massive transaction volumes, and unparalleled user trust. Below, we highlight two standout platforms—Alphabay and Abacus—based on their performance, security, and market influence as of February 2025. These markets exemplify the evolution of cryptomarkets, offering robust ecosystems for anonymous trading.
After all, the closure of previous dark web marketplace Silk Road in 2013 was eventually followed with AlphaBay – bigger, more lucrative and, by the looks of it, more dangerous. “Some people have really asked this question. Of course not,” the site answered, according to the complaint. Archetyp Market offers 28,000+ listings with a 6% market share and $3.5M monthly turnover. Falling short may be DeSnake’s push to adopt I2P as an alternative to Tor, as it has not had the impact on the marketplace landscape as expected. Other marketplaces, including Bohemia and Libertas, have since attempted to stand up I2P mirrors, though the adoption by users and vendors seems slow and unenthusiastic.
The indictment from 2017 listed them individually by their monikers and many have been arrested. In 2016, an angry user of AlphaBay known as “Kinger” stated that alpha02 had left the market in late 2015, sold his stake to DeSnake, and DeSnake was supposedly acting as admin for its final two years. Kinger’s ominous threat suggested they knew his real life identity and his citizenship was actually Dutch.
This solution focuses on identifying stolen data, brand misuse, and potential threats before they can cause significant harm. With Brandefense, businesses gain early visibility into risks that may otherwise remain undetected until it’s too late. In May 2024, Ticketmaster faced a significant data breach affecting millions of customers. Dark web listings surfaced almost immediately after the breach, advertising this information for sale to cybercriminals.
