AlphaBay grew to become the largest darknet marketplace in history, dwarfing even Silk Road. Its takedown in July 2017, coordinated with the Dutch police's covert operation on Hansa Market, marked the most sophisticated law enforcement action against darknet markets ever conducted.
The Rise of AlphaBay
- Launched: December 2014
- Founder: Alexandre Cazes (Alpha02)
- Peak Users: 400,000+
- Peak Vendors: 40,000+
- Listings: 350,000+ at peak
- Estimated Revenue: $1 billion+
AlphaBay launched in late 2014, founded by Alexandre Cazes, a 25-year-old Canadian living in Thailand. The market quickly gained reputation for:
Robust Infrastructure
Multiple redundant servers, DDoS protection, and quick recovery from attacks.
Multi-Currency
Accepted Bitcoin, Monero, and Ethereum—first major market to accept XMR.
Active Support
Responsive admin team and active forum community.
Diverse Categories
Beyond drugs: fraud, hacking services, malware, and digital goods.
Growth Statistics
Hansa Market: The Honeypot
Hansa Market was a smaller, security-focused marketplace popular among privacy-conscious users. What buyers and sellers didn't know: Dutch police had been running it since June 20, 2017.
[2017-06-20] Dutch police seize Hansa infrastructure
[2017-06-20] Operation begins: police operate market covertly
[2017-07-04] AlphaBay goes offline
[2017-07-05] AlphaBay refugees flood to Hansa
[2017-07-05] Hansa registrations increase 8x
[2017-07-13] Alexandre Cazes found dead in Bangkok
[2017-07-20] Hansa revealed as honeypot, shut down
What Police Captured on Hansa
- 10,000+ home addresses of buyers (password removed from images)
- Vendor real IPs through modified login pages
- Chat logs between buyers and sellers
- Bitcoin transactions linked to real identities
- Order histories and shipment tracking
The Fall of Alpha02
Alexandre Cazes's downfall came from basic OPSEC failures—remarkable for someone running a billion-dollar criminal enterprise.
Critical Mistakes
- Email Leak: Password reset emails sent from pimp_alex_91@hotmail.com—linked to his real identity
- Unencrypted Laptop: When arrested, his laptop was open and unencrypted
- Lavish Lifestyle: Multiple Lamborghinis, Porsche, houses in Thailand and Cyprus
- Technical Artifacts: Welcome message on AlphaBay forum contained his personal email in headers
On July 5, 2017, Thai police, working with the FBI, arrested Cazes at his home in Bangkok. He was found with his laptop open, logged into AlphaBay's backend. Days later, he was found dead in his cell—Thai authorities ruled it suicide.
"The supposed anonymity of the dark web is not guaranteed."
— Attorney General Jeff Sessions, announcing the takedown
Operation Bayonet
The coordinated takedown became known as Operation Bayonet, involving:
- FBI (United States)
- Dutch National Police
- Europol
- Thai Police
- Canadian Authorities
- Multiple other countries
The Genius of the Double-Sting
Law enforcement anticipated that AlphaBay's closure would drive users to alternatives. By controlling Hansa, they created a trap:
The Strategy
- Take over Hansa covertly (June 20)
- Shut down AlphaBay (July 4-5)
- Watch AlphaBay users migrate to Hansa
- Collect intelligence for nearly a month
- Reveal the honeypot operation (July 20)
Aftermath & Impact
Immediate Effects
- Massive paranoia in darknet communities
- Trust in any marketplace severely damaged
- Dream Market briefly becomes largest by default
- Monero adoption increases dramatically
Arrests and Prosecutions
Following the operation:
- Over dozens of arrests across multiple countries
- Prosecution of major vendors
- Seizure of millions in cryptocurrency
- Evidence used in ongoing investigations for years
Long-Term Legacy
- Decentralization push: Inspired development of decentralized marketplaces
- OPSEC awareness: Users became more security-conscious
- Monero standard: XMR became the preferred cryptocurrency
- Market fragmentation: No single market ever dominated as completely again