Movie versions of a darknet marketplace look like a fortress behind a mountain. The public record is plainer and stranger. After 2011, large hidden markets opened, ran, and then closed in ways that made headlines. Some were seized with servers. Some were looted by their own admins. Some were run quietly by police for weeks before a banner went up.
This is a timeline, not a map. It follows FBI, DOJ, Europol, and German BKA announcements, plus court-adjacent press. Names, dates, charges, and scams need to stay separate. “The feds killed the whole dark web” is a slogan, not the file.
What a takedown is — and what it is not
A darknet marketplace, in this article, means a hidden storefront with listings, escrow, and vendor-buyer talk in one place. When police say “takedown,” they usually mean some mix of domain or server seizure, arrests of admins or high-volume sellers, and later cases built from the data.
Not every shutdown is a raid. In March 2015, Evolution vanished overnight. Contemporary reporting described admins draining escrow crypto — an exit scam, not a courtroom seizure. Users see the same thing either way: the site is gone. The legal story is not the same.
Another myth dies on contact with the calendar. Silk Road fell in 2013; talk of Silk Road 2.0 started within days. AlphaBay went dark in 2017 and traffic rushed to Hansa — which Dutch police already controlled. Platforms break. Trade fragments. Some people are charged. Some pick a new name. That cycle is what the press releases actually document.
2013: Silk Road, the first landmark arrest
Silk Road launched around January 2011 and ran until October 2013. ICE/HSI and the FBI said the site was seized under a warrant and taken offline on 2 October 2013. Ross William Ulbricht, known online as Dread Pirate Roberts, was arrested on 1 October 2013 at San Francisco’s Glen Park Public Library.
Prosecutors alleged the site was a platform for controlled substances and other illegal goods. An ICE release at the time claimed about $1.2 billion in transactions between February 2011 and July 2013 — an agency figure, not an independent audit. Ulbricht later faced narcotics, money-laundering, and related counts in Manhattan federal court.
A jury found him guilty on seven counts on 4 February 2015. On 29 May 2015 he was sentenced to two life terms plus a concurrent term, with no parole, and a large cryptocurrency forfeiture. Murder-for-hire allegations were not the New York conviction’s core; a separate Maryland indictment was later dismissed. On 21 January 2025 the U.S. president issued a full, unconditional pardon, and Ulbricht left an Arizona prison that evening. A pardon is not a rewrite of the 2015 record.
Silk Road remains the reference point because it was the first giant case in which a hidden market, bitcoin, and a handle reached a public trial. Every later “biggest ever” claim is measured against it.
2014: Operation Onymous and Silk Road 2.0
Silk Road 2.0 filled headlines in November 2014. The FBI and HSI charged Blake Benthall, alias “Defcon,” as operator around 5–6 November. A complaint claimed roughly $8 million in monthly sales and about 150,000 active users as of September 2014 — again, government numbers.
The same week Europol announced Operation Onymous: police from 17 countries, 17 arrests, and hundreds of .onion addresses seized. Early reports circulated a figure above 400 domains. Later reporting found many clones and scam pages in the pile. A U.S. forfeiture complaint listed far fewer real market targets. The “400 sites dead” headline was inflated.
Onymous still matters for two quieter reasons. Cross-border work is how servers, admins, and money in different countries get tied together. And agency tallies need a second look before they become folklore.
2015 versus 2017: scam story, raid story
Evolution’s March 2015 collapse was not a film-style bust. Reporting at the time said withdrawals froze, then the market disappeared, with staff messages accusing admins of taking escrow. Stolen-sum estimates varied; this article will not invent a final total. The point is simpler: disappearance is not always “the FBI arrived.”
Operation Bayonet in July 2017 was the opposite — a coordinated seizure. U.S. agencies called AlphaBay the largest such market then running. They named Canadian Alexandre Cazes, online as Alpha02, as creator and administrator. Thai police arrested him in Bangkok on 5 July 2017. He died in custody on 12 July; Thai officials called it suicide. The DOJ and Europol announced the operation on 20 July. The FBI said AlphaBay was about ten times the size of Silk Road. A court filing cited about $450 million spent on the market between May 2015 and February 2017.
Hansa was the second jaw of the trap. Dutch National Police said they took control on 20 June 2017 and ran the site covertly for about a month. After AlphaBay died, users piled onto Hansa. Police were already sitting in the admin chair. Hansa was shut in public on 20 July 2017. Europol said thousands of foreign addresses went to follow-up cases. That “knock one over, catch the rush on the next” sequence is now a documented tactic, not a rumor.
FACT
Cazes was arrested in Bangkok on 5 July 2017. Dutch police took covert control of Hansa on 20 June 2017. Both markets were announced as down on 20 July 2017 in joint DOJ and Europol briefings. Cazes died in custody on 12 July 2017; Thai officials described the death as suicide.
2019–2020: Wall Street Market and Operation DisrupTor
On 3 May 2019 Europol and Germany’s BKA announced the end of Wall Street Market. German prosecutors said the site had more than 1.15 million user accounts and over 5,400 vendors. Three German suspects were arrested on 23–24 April 2019. The BKA said the platform flipped to maintenance mode on 23 April and that customer balances began moving to the suspects — the scene term is exit scam. Servers were reported seized on 2 May 2019. U.S. filings separately alleged a large escrow drain.
Two tracks run together here. Investigators said they were already watching. At the shutdown moment, they also alleged theft. Raid and rip-off can share a week on the calendar. Allegation is not conviction until a court says so.
On 22 September 2020 the FBI’s JCODE team and Europol announced Operation DisrupTor. It was not one mega-market falling. Agencies said older seizures, including Wall Street, helped attribute vendor accounts to real people. Europol reported 179 arrests, more than $6.5 million in cash and virtual currency, about 500 kilograms of drugs, and dozens of firearms. The lesson is dull and important: a market can die in 2019 and still feed indictments in 2020.
2021–2022: DarkMarket and Hydra
Europol’s 12 January 2021 release said DarkMarket had been taken offline in a multi-country operation. Agency figures: almost 500,000 users, more than 2,400 sellers, over 320,000 transactions, and more than €140 million in crypto flow at then-current rates. German investigators arrested an Australian citizen near the German-Danish border as the alleged operator. More than 20 servers in Moldova and Ukraine were described as the backbone. Face in one country, machines in others — that split is now routine in these press notes.
Hydra Market, a Russian-language platform, was announced down on 5 April 2022. The U.S. Attorney’s Office for the Northern District of California called it the world’s largest and longest-running darknet market at the time. DOJ figures: about $5.2 billion in cryptocurrency since 2015, and an estimated 80 percent of darknet-market crypto activity in 2021. German prosecutors cited about 17 million registered accounts, more than 19,000 sellers, and bitcoin worth €23 million seized. Servers were taken in Germany. The United States announced charges against Russian resident Dmitry Pavlov over alleged server administration. A charge is not a verdict.
Security-industry writeups later described a scramble among Russian-language venues. This article will not name “where trade went next.” The documented point is enough: official size claims are still estimates, and one seizure does not drain the whole underground.
2023: Genesis, Monopoly, and a wider meaning of “market”
In early April 2023 the FBI and partners moved on Genesis Market — publicly nicknamed Operation Cookie Monster. It was not a classic narcotics bazaar. The Justice Department said the site sold access data stolen from malware-infected PCs: more than 1.5 million compromised computers and tens of millions of account credentials. Europol reported 119 arrests and hundreds of searches. “Dark web market” in official language now also means a warehouse for stolen identities, not only drug listings.
Monopoly Market’s timeline is crooked. Europol said on 2 May 2023 that German authorities had seized the infrastructure in December 2021 and stayed quiet so foreign cases would not burn. The later sweep, Operation SpecTor, produced 288 arrests across the United States, the United Kingdom, Germany, and other states, plus a claimed €50.8 million in cash and virtual currency, 850 kilograms of drugs, and 117 firearms. An alleged operator was arrested in Vienna in November 2022 and reported extradited to the United States in June 2023. A site can die years before the press conference.
India’s public cases more often sit at parcels and houses than at global server halls. Agency actions against vendors and courier drops are not the same event as seizing a world-scale market. Mixing them flatters both myth and panic.
Why the same cracks keep showing up
The file trail is less about magic software than about human habits. AlphaBay reporting described personal email traces and clear-text password files found at arrest. In Silk Road 2.0, prosecutors said an undercover agent reached support staff. Wall Street filings described a mobile data stick tying activity to a home and a workplace. On Hansa, police sat in the admin role for weeks.
Geography of servers is the second crack — Moldova and Ukraine for DarkMarket, Germany for Hydra. Wallet freezes appear in almost every major announcement. The third pattern is migration: vendors flee a dead market, and investigators can wait on the landing pad. None of that is a how-to. It is a recap of what agencies chose to put in public. The failure mode is usually arrogance and haste, not a missing movie gadget.
Cinema myths fail here twice. Hidden markets are not immortal. A lone “seized by FBI” splash page is not proof either; fake seizure banners are a known scam wrapper. A real takedown usually arrives with multi-country statements, warrants, and later charges. One scary page is not a case file.
FAQ
Does one takedown end the dark web?
No. The public timeline shows a large market falling, trade scattering, some arrests, and new names appearing. A platform’s death is not the end of the wider crime economy.
How is an exit scam different from a police seizure?
A seizure comes with warrants, servers, arrests, and agency statements. An exit scam is admins draining escrow and vanishing. Both can look like “site down.” Evolution in 2015 is the scam example; AlphaBay in 2017 is the raid example.
Did Operation Onymous really kill 400 sites?
Early headlines used a huge .onion count. Later reporting found many clones and scam pages. Court lists were shorter. Treat the 400 figure as a press tally, not a catalogue.
Did the 2025 pardon erase Ulbricht’s 2015 conviction?
No. It released him. The 4 February 2015 guilty verdict and 29 May 2015 sentence remain the public court record. Clemency is not a rewrite.
Is this a guide to finding a market?
No. No setup steps, no links, no buying method. Seeking or selling illegal goods is a crime. Pages that demand crypto or fees for “entry” are often scams.
Disclaimer: This article explains public court and police releases. It is not a guide to visit the dark web. It does not describe how to find, buy, or sell illegal goods. Pages that demand cryptocurrency or fees for access are often scams. Seeking illegal goods or services is a crime. Charges are allegations until a court decides.
