Dark Web Timeline

Last updated: 3 October 2026 · By Ehtijad Ali

The dark web did not appear overnight. It was built slowly, over about 60 years. The pieces came from the army, from university maths, from people who wanted privacy, and later from criminals. Most of the people who built those pieces never imagined how they would be used.

This timeline tells that story in order, from the very first computer message in 1969 to today. We built it from real records. When a famous story is not proven, we tell you.

Jump to a time period

• 1969–1990Building the internet
• 1991–2003Secret codes for everyone
• 2004–2010Tor and Bitcoin arrive
• 2011–2015The Silk Road years
• 2016–2020Crime becomes a business
• 2021–2026Shutdowns and money trails

---

1969 to 1990: building the internet

The big idea: none of this was built to be secret. The early network was tiny, and everyone on it mostly trusted each other. Nothing was locked with codes, because nobody thought it needed to be.

• 29 October 1969Two computers send the very first message. One is at a university in Los Angeles. The other is at a research centre near San Francisco. The system crashes halfway through typing the word “LOGIN”. By the end of the year, there are four computers on the network.
• 1971 to 1972Students at Stanford use the early network to arrange a cannabis sale with students at MIT. People often call this the first online drug deal. But it is based on people’s memories years later, not on a record from the time. So treat it as a good story, not a proven fact.
• 3 May 1978A salesman at a computer company sends an advert to several hundred people at once. It is the first spam message ever. People are angry right away.
• 1979Usenet is created at Duke University. It is a set of public discussion groups with almost no rules. Online forums have copied its style ever since.
• 1 January 1983The network switches to TCP/IP, the system we still use today. You can think of this as the real birthday of the internet.
• 1983A group of teenagers in Milwaukee, called the 414s, are caught after breaking into dozens of computer systems. These included a cancer research centre and a nuclear weapons lab. For the first time, hacking becomes big news in America.
• 1986The United States passes the Computer Fraud and Abuse Act. Many court cases on this page use this law. Some people still say it is written too broadly.
• January 1986A teenager writes a short essay after being arrested, explaining why he hacks. It is printed in an underground magazine and becomes the most famous piece of writing in hacker culture.
• 2 November 1988A student at Cornell releases a program meant to quietly measure how big the internet is. A mistake makes it copy itself again and again, and it crashes a large part of the network. He becomes the first person found guilty under the new computer crime law. The panic leads to the first emergency team for computer security.
• March 1989A researcher at CERN in Switzerland writes the plan for what becomes the World Wide Web. His boss writes on it: “vague but exciting”.
• May 1990The US Secret Service raids hackers in 14 cities. One raid, on a small games company, is so clearly wrong that it leads to the start of the Electronic Frontier Foundation. That group still fights for digital rights today.

1991 to 2003: secret codes escape the lab

The big idea: the big change here was about people, not machines. Strong encryption (secret codes that are very hard to break) stopped belonging only to governments. Almost every tool the dark web uses today was made in these years.

• June 1991Phil Zimmermann gives away a program called PGP for free. For the first time, normal people can use codes strong enough to stop a government reading their messages. The US government investigates him for “exporting weapons”, because encryption was legally treated as a weapon. They drop the case in 1996 without charging him.
• 1992A group of programmers and activists start an email list called the Cypherpunks. They believe privacy must be built with code, not just asked for. This idea shapes everything that comes next, including Bitcoin.
• March 1993One of them publishes “A Cypherpunk Manifesto”. It has the line the group is still known for: “cypherpunks write code”. Another member had already described anonymous online markets in detail, years before anyone could build one.
• 1995 to 1996Three researchers at a US Navy lab invent “onion routing”. It hides messages inside layers, like the layers of an onion. The goal was to protect American spy communications. Their 1996 paper describes the design Tor uses later. It also shows the big problem of hiding online: a hiding place only works if lots of different people use it.
• 1999 to 2000A student in Edinburgh designs a new system. It stores files in small pieces on many people’s computers. That way, there is no single server to shut down. It is released as Freenet in 2000 and still exists today as Hyphanet.
• 20 September 2002Roger Dingledine announces the first public version of Tor. It mixes onion routing with a network of computers run by volunteers. Its code is open, so anyone can check that there are no hidden back doors.
• 2003Work starts on I2P, a different hidden network built mainly for websites that live inside it.

2004 to 2010: Tor opens up and Bitcoin appears

The big idea: two new inventions made a hidden online shop possible. Tor hides who you are. Bitcoin lets you pay without a bank. Neither one was built for crime.

• August 2004Tor’s design is shown at a big security conference. The Navy lab gives the code away for free, and the Electronic Frontier Foundation starts paying for its work. Tor becomes a public project instead of a military one.
• December 2006The Tor Project becomes an official non-profit. This matters because its money and decisions become public, so people can check them instead of just trusting them.
• 2006 to 2007WikiLeaks appears. It uses Tor to protect people who send it documents. The public sees clearly that hiding tools have good uses too, even when governments do not like them.
• 31 October 2008Someone using the name Satoshi Nakamoto posts a paper called “Bitcoin: A Peer-to-Peer Electronic Cash System”. It solves a problem the cypherpunks were stuck on for 15 years. How do you stop someone spending the same digital coin twice, with no bank to check?
• 3 January 2009The first Bitcoin block is created. Hidden inside is a newspaper headline from that day, used like a date stamp. Nobody knows who Satoshi Nakamoto really is. We look at the theories in our Conspiracy Files.
• 2010Lists of hidden “.onion” websites start getting noticed by normal people. Everything needed for an anonymous market now exists. Nobody has put the pieces together yet.

2011 to 2015: the Silk Road years

The big idea: one website changed how people think about the internet more than anything else on this page. Every dark web market since has copied its pattern.

• February 2011Silk Road opens as a hidden .onion website. It mixes Tor, Bitcoin and “escrow”. Escrow means the site holds the money until the buyer gets the item. It also has normal shop features, like seller ratings and refunds. Its owner calls himself “Dread Pirate Roberts”. Read the full Silk Road story.
• 1 June 2011A news article makes Silk Road famous overnight. US senators demand it is shut down. Instead, visitors shoot up. This is the first clear proof that news coverage is the best advert these sites ever get.
• 2011 to 2012The hacker groups Anonymous and LulzSec carry out many hacks and leaks. The arrests that follow depend mostly on one member telling police about the others. It becomes a lasting lesson in how “anonymous” groups really fall apart.
• June 2013Edward Snowden reveals how much of the world’s communication American and allied spy agencies were collecting. Interest in encryption jumps worldwide, and big tech companies start turning it on by default.
• 1 to 2 October 2013Ross Ulbricht is arrested in a San Francisco library, with his laptop open and unlocked. Silk Road is seized. Police did not break Tor. They followed his own early mistakes, like an old forum post linked to his personal email address.
• November 2013Silk Road 2.0 opens, just weeks later. This sets a pattern that is still true today: shutting down a market removes the owner, not the customers.
• November 2014A European and American operation called Onymous seizes Silk Road 2.0 and other sites. Officials say hundreds of sites were taken down, but researchers later show the real number of separate services was much smaller. How police found the servers has never been explained.
• December 2014AlphaBay opens. Over the next few years it grows much bigger than Silk Road ever was.
• 29 May 2015Ross Ulbricht is sentenced to life in prison with no chance of parole. How harsh that sentence was is still one of the most argued-about parts of the case.

2016 to 2020: crime becomes a business

The big idea: cybercrime stopped being a rare skill and became more like a factory. Different criminals did different jobs, so attacks could happen on a huge scale, and attackers no longer needed to be clever. See how this works in How Do Ransomware Gangs Work?.

• October 2016The Mirai botnet takes over home devices like cameras and routers that still had their factory passwords. It knocks a big internet company offline and takes a large part of the web down with it. Its code had been posted online weeks earlier, so copycats were sure to follow.
• 12 May 2017WannaCry spreads around the world. It used a hacking tool made by a government spy agency that had been leaked. Hospitals, factories and transport companies are hit. A fix had been available for two months.
• 27 June 2017NotPetya appears. It looks like ransomware, but it was built only to destroy. It becomes the most expensive cyberattack ever recorded, and shows that an attack aimed at one country can spread worldwide in hours.
• July 2017Operation Bayonet. Police seize AlphaBay and arrest the man said to run it in Thailand, where he later dies in custody. At the same time, Dutch police reveal they had secretly been running another market, Hansa, for weeks, recording everyone who fled there. Read the full story: Operation Bayonet.
• Late 2017Tor releases a new version of onion sites with longer addresses and stronger encryption. This fixes weaknesses that let people collect lists of hidden sites.
• 25 May 2018The GDPR privacy law starts across Europe. Companies must now report data breaches. The number of known breaches jumps. Not because there were suddenly more attacks, but because hiding them became illegal.
• May 2019Wall Street Market is seized in a German-led operation. Its owners had already started running off with users’ money as police closed in.
• December 2020The SolarWinds attack is discovered. Attackers had hidden inside a trusted software update, which gave them months of quiet access to government and business networks. It teaches everyone that trusting your suppliers is also a security risk.

2021 to 2026: shutdowns and money trails

The big idea: these years are not really about new technology. They are about police getting good at this, mostly by following the money instead of chasing computers.

• January 2021DarkMarket, then the biggest market around, is shut down in a German-led operation. In the same month, an international team takes over the Emotet botnet by seizing its control systems.
• May 2021A ransomware attack shuts down Colonial Pipeline, causing fuel shortages across the eastern United States. In June, the US Justice Department gets most of the ransom back by seizing the key to the criminals’ Bitcoin wallet. It proves that Bitcoin payments can be followed and taken back.
• 5 April 2022German police seize the servers of Hydra Market. It was by far the biggest darknet market ever. The US also puts sanctions on it. Hydra had money-laundering and delivery systems that no Western market came close to.
• 8 August 2022The US Treasury sanctions Tornado Cash, a crypto “mixing” service that hides where coins came from. Because it punished a piece of software instead of a person, it started a legal fight that is still going through the courts.
• April 2023Genesis Market is shut down in Operation Cookie Monster. It sold stolen browser “sessions” that let criminals walk straight into accounts without the password or the two-step code. This marks the point where stealing sessions became bigger than stealing passwords. Learn more in What Do Hackers Do With Stolen Data?.
• August 2023The Qakbot botnet is taken apart. Police push a removal program onto infected computers around the world. It works, but it raises hard questions about how far police should reach into private computers.
• February 2024Operation Cronos. A team led by the UK’s National Crime Agency takes over the systems of LockBit, a big ransomware gang. Then police use the gang’s own website to post news about the takedown. The embarrassment hurts the gang more than the takedown itself.
• February 2024A ransomware attack on Change Healthcare stops medical payments across the United States for weeks. It shows that when one company handles so much of a country’s healthcare, it becomes a weak point for the whole country.
• 21 January 2025US President Donald Trump gives Ross Ulbricht, the creator of Silk Road, a full pardon. He is released from prison after more than 11 years.
• June 2025Archetyp Market is shut down in Operation Deep Sentinel. It was the oldest darknet drug market still running. Germany led the operation, with help from Europol. Its admin is arrested in Spain, and servers are seized in several countries.
• 28 January 2026The FBI seizes RAMP, a Russian-language forum running since 2012 that had become the main meeting place for ransomware gangs. Its websites are replaced with FBI seizure notices. Experts note that the biggest gangs used their own separate systems, so the damage falls mostly on smaller groups.
• 9 March 2026A global operation led by Germany with Europol support, involving 23 countries, shuts down more than 373,000 fake dark web sites. It is described as one of the largest networks of its kind ever taken down. The investigation had been running quietly since 2021.
• TodayMany criminals now also use chat apps instead of only hidden websites. Read why Telegram rivals the dark web.

---

What this whole story teaches us

Read the timeline from top to bottom and five lessons stand out. Most of them are the opposite of what people expect.

• The tools were not made for crime.Onion routing came from a Navy lab. Encryption came from university maths and privacy campaigners. Criminals just used what already existed.
• The codes almost never break.In almost every case above, people were caught by their own mistakes, their money, or someone telling on them. The maths held. The humans did not.
• Closing a site just moves the problem.Silk Road, then Silk Road 2.0, then AlphaBay, then Hydra, then Archetyp. After each shutdown, users simply moved somewhere else.
• Money is the weak spot.The most powerful police tool of the last ten years is following payments. Bitcoin turned out to be a public receipt that never goes away.
• News makes these sites grow.Every big market grew fastest right after the news talked about it. Remember that when you read about this subject, including on this website.

Keep reading

• Dark Web GlossaryEvery hard word on this page, explained simply.
• Deep Web vs Dark WebThe difference, in 7 simple points.
• InvestigationsSingle cases told in much more detail.
• Dark Web HistoryAll our articles on this subject.
• Hackers & Hacking HistoryThe people behind these events.
• Do VPNs Make You Anonymous?What hiding tools can and cannot do.