By Ehtijad Ali
Updated: October 2026
Reading time: about 12 minutes
Dark web takedowns happen when police shut down a hidden website that sells illegal things. But a takedown is much more than a website going dark. Behind each one are months or even years of detective work, teamwork between countries, and clues hidden in computers and money trails.
This guide explains 11 of the biggest dark web takedowns from 2013 to 2024, in simple words. You will learn what police did, what they found, and what happened next.
Here is the short version. Most takedowns follow the same steps. Investigators find a hidden market. They collect evidence. They take control of its computers, called servers. Then they use what they found to track down the people behind it.
Sometimes one takedown leads to hundreds of new cases. Other times, a market closes but new ones pop up to take its place. New to the topic? First read our easy guide to what is on the dark web.
Table of Contents
Major dark web takedowns at a glance
This table lists the biggest operations. Some shut down a whole market. Others went after the sellers and buyers who used many different markets.
| Operation or target | Year | What happened | Main result |
|---|---|---|---|
| Silk Road | 2013 | US police seized the first famous dark web market. | Site seized and its owner arrested. |
| Silk Road 2.0 and Operation Onymous | 2014 | Police in many countries targeted copycat sites. | Hundreds of hidden sites seized and arrests made. |
| AlphaBay and Hansa | 2017 | Two giant markets were hit in one plan. | AlphaBay seized; Hansa secretly watched, then closed. |
| Wall Street Market | 2019 | A German-led team shut down a big market. | Market seized and suspected owners arrested. |
| Operation DisrupTor | 2020 | A follow-up hunt for sellers and buyers. | 179 arrests announced. |
| DarkMarket | 2021 | A German-led team closed a huge market. | Servers seized and suspected owner arrested. |
| Operation Dark HunTOR | 2021 | A worldwide hunt for dark web sellers. | 150 arrests announced. |
| Hydra Market | 2022 | Police seized a giant Russian-language market. | Servers seized and charges announced. |
| Genesis Market | 2023 | Police hit a market selling stolen logins. | Website seized and wider investigations started. |
| Operation SpecTor | 2023 | A worldwide hunt for dark web drug dealers. | 288 arrests announced. |
| Incognito Market | 2024 | A drug market closed, then its alleged owner was charged. | Criminal case in New York. |
This is not a list of every dark web seizure in the world. It covers the biggest cases that police have talked about in public. Sources for each one are linked below.
The dark web takedown timeline, step by step
Over time, police got better at this. Early cases focused on one market and its owner. Later operations used teamwork between countries, seized data, and crypto tracking to catch people spread across many sites.
1. Silk Road (2013): the first big seizure
Silk Road was one of the first well-known dark web markets. It ran on the Tor network and used Bitcoin for payments. In October 2013, US authorities seized the site and arrested its owner, Ross Ulbricht.
The case proved that a hidden website does not make its owner untouchable. Detective work linked the online market to a real person.
What changed: One market was gone, but the illegal trade did not stop. Copycat sites soon appeared. For the full story, read our guide to how Silk Road worked and fell.
2. Silk Road 2.0 and Operation Onymous (2014)
After Silk Road closed, copycat sites tried to take its place. In November 2014, police from many countries ran Operation Onymous. They seized more than 400 Tor web addresses. Silk Road 2.0 was one of the targets.
What changed: Police showed they could hit many hidden sites at the same time, not just one famous market. Source: US Department of Justice on the Silk Road 2.0 seizure.
3. AlphaBay and Hansa (2017): Operation Bayonet
AlphaBay became one of the largest dark web markets of its time. In July 2017, it was seized after a worldwide investigation. US officials said it had more than 200,000 users and 40,000 sellers.
Here is the clever part. Dutch police had secretly taken control of another market, Hansa. When AlphaBay went down, many users ran to Hansa. Police were already watching, and they collected evidence before shutting Hansa down too.
What changed: Timing became a powerful tool. Police used one shutdown to catch people on another market. Source: US Department of Justice on the AlphaBay shutdown. Learn the full plan in our story of Operation Bayonet.
4. Wall Street Market (2019)
Wall Street Market was a big dark web market. In May 2019, German police led an investigation with help from other countries and shut it down. The people suspected of running it were arrested.
What changed: The case showed that closing a site is only the start. The evidence helped police go after sellers later.
5. Operation DisrupTor (2020)
Operation DisrupTor went after the sellers and buyers, not one website. Europol announced 179 arrests in the United States and Europe. Police also seized cash, crypto, drugs, and weapons.
Evidence from earlier cases, including Wall Street Market, helped police find these people.
What changed: People who thought they were anonymous learned that old market data can be used against them. Source: Europol on Operation DisrupTor.
6. DarkMarket (2021)
In January 2021, a German-led team shut down DarkMarket. At the time, Europol called it the world’s largest illegal market on the dark web. Police seized its servers and arrested a man suspected of running it.
What changed: It showed that big markets were still running even after earlier busts, and that teamwork across borders could still reach them. Source: OCCRP report on the DarkMarket takedown.
7. Operation Dark HunTOR (2021)
Operation Dark HunTOR targeted people selling drugs on dark web markets. In October 2021, authorities announced 150 arrests across several countries, along with large seizures of cash and crypto.
What changed: Police focused on the wider network of sellers and money, not just whether one site was online. Source: Eurojust on Operation Dark HunTOR.
8. Hydra Market (2022)
In April 2022, German and US authorities announced the seizure of Hydra Market, a huge Russian-language dark web market. The US Department of Justice called it the world’s largest and longest-running dark web market at that time.
The department said Hydra had received about $5.2 billion in crypto since 2015. It also estimated that Hydra handled about 80% of all dark web market crypto deals in 2021. These are official estimates, not exact counts.
What changed: A giant service was disrupted, but that does not mean every seller or buyer was found. Source: US Department of Justice on Hydra. Read more in our article on the rise and fall of Hydra Market.
9. Genesis Market (2023)
Genesis Market did not mainly sell drugs. It sold stolen login details taken from hacked computers. In April 2023, the US Department of Justice announced a worldwide operation against it. Officials said it offered data from more than 1.5 million hacked computers, with over 80 million stolen logins.
What changed: It showed how dark web markets help other crimes, like taking over accounts and fraud. This kind of data is often stolen by infostealer malware. Protect yourself with the most important privacy settings to change today. Source: US Department of Justice on Genesis Market.
10. Operation SpecTor (2023)
Operation SpecTor was a worldwide action against dark web drug dealing, announced in May 2023. It involved police on three continents. The US Department of Justice reported 288 arrests and seizures of weapons, drugs, cash, and crypto.
What changed: Evidence from earlier market seizures helped catch sellers working across many sites and countries. Source: US Department of Justice on Operation SpecTor.
11. Incognito Market (2024)
Incognito Market was an online drug market that closed in March 2024. Later that year, US prosecutors charged its alleged owner. The Department of Justice said the market sold more than $100 million in drugs.
What changed: A market closing does not end the case. Police can keep studying the owner, payments, and other evidence long after the site disappears. Source: US Department of Justice on Incognito Market.
5 patterns behind almost every dark web takedown
Every case is different, and police rarely share every detail. But the biggest dark web takedowns show the same five patterns again and again.
1. Police look far beyond the website
A market is more than its homepage. Investigators study servers, payments, messages, seller accounts, and even shipped packages. This can lead them to people who were not named on the day of the takedown.
2. Countries must work together
The owner, the servers, the buyers, and the packages can all be in different countries. Police agencies work as a team so they can act in many places at the same time.
3. Crypto is not fully anonymous
Crypto payments leave a public record. That record alone may not show a name, but it can be a strong clue when combined with other evidence. Learn more in our guide: can Bitcoin be traced?.
4. Old evidence leads to new cases
Seized data can stay useful for years. Operations like DisrupTor and SpecTor used evidence from earlier takedowns to find sellers.
5. A seizure does not catch everyone
A market may have many accounts, fake names, and payments. Some accounts may belong to the same person. Police must check the evidence carefully before linking an account to a real person. To see the methods they use, read how police catch dark web criminals.
Can you trust the numbers in takedown news?
Be careful with the big numbers you see in news about dark web takedowns. Official reports are very useful, but the numbers often measure different things.
- Accounts are not the same as real people. One person can have many accounts.
- Estimates of money may cover a market’s whole life, not one year.
- Arrests are not the same as convictions. An arrest means someone is suspected, not proven guilty.
For example, the Hydra numbers above are official estimates. They do not prove that every payment was checked one by one, or that all hidden trade in the world was measured.
A good rule: always check who reported the number, when, and what it actually counts.
What really changes after a takedown?
The first change is easy to see. The market goes offline, its servers are seized, and its owners may be charged with crimes.
What comes next is more complicated. Sellers lose their reviews, accounts, and reputation. Buyers lose a place they trusted. Police gain evidence that can lead to more cases.
But a shutdown does not destroy every network. Some people quit. Some move to other sites. Others get caught later. That is why the best way to judge a takedown is to ask: Did it disrupt the service? Did police get useful evidence? Were key suspects charged? Did it reduce harm?
Why closing one market does not end the problem
Illegal online markets exist because buyers and sellers want to find each other. Closing one market breaks that link, but it does not remove the reasons people use these sites.
After Silk Road, AlphaBay, and Hansa closed, new markets tried to attract the users who were left behind. Some sellers moved elsewhere. But not everyone moved. Some people stopped completely.
Trust matters, too. Dark web markets depend on ratings and reviews. A sudden shutdown breaks that trust. New sites find it hard to rebuild it, and users feel less safe.
The key lesson is not that takedowns fail. It is that success should be measured in many ways: the site disrupted, the evidence found, the people charged, and the harm prevented.
How to judge a takedown news story
Next time you read about a dark web bust, ask these five simple questions:
- What was seized? A web address, a server, crypto, or a whole market are very different things.
- Who announced it? Read the police or government press release, not just the headline.
- What do the numbers count? Accounts, users, sellers, arrests, and convictions are not the same.
- Was it international? Check which countries and agencies are named.
- What happened later? Look for court cases, new charges, or follow-up operations.
These questions help you tell the difference between a quick headline and the real long-term result.
Explore more dark web investigations
- Dark Web Timeline: follow major events in order.
- Dark Web Glossary: simple meanings of words like “darknet market” and “exit scam.”
- Investigations hub: more evidence-based cybercrime case studies.
Frequently asked questions
What was the biggest dark web takedown?
It depends on how you measure it. In 2017, the US Department of Justice called AlphaBay the largest dark web market at the time. In 2022, it called Hydra the world’s largest and longest-running dark web market. Both statements refer to different years.
Did shutting down Silk Road end dark web markets?
No. Copycat markets appeared soon after, and police later targeted many other sites. Silk Road’s seizure was important, but it did not end illegal online trade.
Why did police target AlphaBay and Hansa at the same time?
Dutch police secretly controlled Hansa while AlphaBay was shut down. When AlphaBay users moved to Hansa, police were already watching and collecting evidence.
Can police find users after a dark web market is seized?
Sometimes. Police can study seized data, payments, and messages. But an account name or crypto address alone does not always prove who someone is.
What is the difference between a takedown and an arrest operation?
A takedown shuts down a website or seizes its servers. An arrest operation goes after people. One case can include both, and later operations often use evidence from earlier takedowns.
Do dark web takedowns stop crime for good?
No single takedown ends all crime. It can disrupt a service, save evidence, and lead to court cases. The long-term effect depends on whether police can reach the people and networks behind it.
Official sources and further reading
These official sources support the events and numbers in this guide. Use the original announcements when quoting figures.
- US Department of Justice: dark market seizures and Silk Road 2.0
- US Department of Justice: AlphaBay shutdown
- Europol: Operation DisrupTor
- Eurojust: Operation Dark HunTOR
- US Department of Justice: Hydra Market seizure
- US Department of Justice: Genesis Market disruption
- US Department of Justice: Operation SpecTor results
- US Department of Justice: Incognito Market case
- Europol newsroom
- UK National Crime Agency
Editorial note: This article is a history of police operations. Figures come from the agencies that reported them. An arrest is not a conviction, and an accusation is not proof of guilt. Numbers from different operations measure different things and should not be compared directly.
Comments