By Ehtijad Ali
Updated: October 2026
Reading time: about 10 minutes
How do police catch dark web criminals if the dark web is built to hide people? Most people imagine a genius hacker cracking Tor. The real answer is much simpler, and much more human.
Police almost never break the encryption. Instead, they wait for mistakes. They follow the money. They listen to people who switch sides. And sometimes they go undercover inside the criminal websites. This guide explains those four routes in plain English, with real cases from court records.
The short answer: police catch dark web criminals through four routes: their mistakes, their money, informants, and undercover work. The code that protects the dark web almost never breaks. The people using it do.
Why is the dark web hard to investigate?
The dark web is a hidden part of the internet. You need special software, like the Tor browser, to visit it. Tor bounces your connection through three computers around the world. Each one only knows the step before and the step after. No single computer knows both who you are and where you are going.
This means police cannot simply look up who visited a dark web site, like they could with a normal website. New to these ideas? Start with our guide to the deep web vs the dark web.
But here is the key point. Tor only hides your internet connection. It does not hide everything else you do. Dark web criminals still need to get paid, ship packages, talk to people, and use real computers. Every one of those things can leave a trail.
The 4 ways police catch dark web criminals
- Mistakes: the criminal accidentally links their secret identity to their real one.
- Money: payments leave records that can be traced, even with Bitcoin.
- Informants: someone on the inside decides to help the police.
- Infiltration: police go undercover, or even secretly take over a criminal website.
Big cases usually use more than one route. Think of each route as a puzzle piece. One piece is rarely enough, but together they show a clear picture.
1. Mistakes: when criminals give themselves away
This is the most common way dark web criminals get caught. Security experts call it bad OPSEC, short for “operational security”. In simple words, OPSEC means keeping your secret life and your real life completely separate. One tiny link between them can undo everything.
Common mistakes include using the same username in two places, reusing an email address, posting a photo with hidden location data, or logging in once without Tor.
Even careful dark web criminals slip up over time. They have to stay perfect every single day, often for years. Police only need to find one slip. That is why many cases are solved long after the crime. Police go back through old posts, old payments and old messages with fresh eyes.
Real example: the Google search that caught Silk Road’s boss
Silk Road was the first famous dark web market. Its owner called himself “Dread Pirate Roberts”. For two years, nobody knew who he was.
Then IRS agent Gary Alford tried something simple. According to Sophos’s report on the case, he used Google to search for the earliest posts that mentioned Silk Road. He found a user called “altoid” who had promoted the site in early 2011. Later, the same “altoid” asked for help with coding and left an email address: rossulbricht@gmail.com.
That one old post pointed to Ross Ulbricht. In October 2013, he was arrested in a San Francisco library with his laptop open and unlocked. Read the full story in The Silk Road Dark Web Story.
What research says
In 2024, researchers studied 136 court cases involving Tor. They found that human mistakes were the main way people were unmasked. Direct attacks on Tor itself were rare. When someone is unmasked like this, experts call it deanonymisation.
2. Money: following the payment trail
Many people think Bitcoin is secret money. It is not. Every Bitcoin payment is written in a public record called the blockchain, and it stays there forever. Names are not written there, only long wallet addresses. But if one address is ever linked to a real person, their whole payment history can be followed.
Studying these records is called chain analysis. For dark web criminals, the weak spot is usually where crypto meets normal money. Think of a bank account, or an exchange that asks for ID.
Real example: Bitcoin Fog
Bitcoin Fog was a “mixer”, a service that promised to hide where Bitcoin came from. It ran for about 10 years. According to the U.S. Department of Justice, it moved around $400 million in Bitcoin, much of it linked to dark web markets.
Agents from the IRS used blockchain analysis to follow the money back to its operator, Roman Sterlingov. In March 2024, a jury found him guilty. The very service built to hide money was exposed by following money.
Real example: packages and post offices
Money is not the only trail dark web criminals leave. Drugs sold online still travel by normal mail. In 2016, U.S. agents made undercover buys from an AlphaBay seller called “Area51”. The court case says postal records showed who paid for the postage. Agents also linked the seller’s encrypted email address to the normal Twitter, Instagram and Facebook accounts of a second man. Both were charged.
3. Informants: when someone switches sides
Police do not always need to find dark web criminals on their own. Sometimes a person who was part of the crime gets caught. Then they agree to help the police, in return for a lighter punishment. This person is called an informant or a cooperating witness.
An informant may know a suspect’s real name, what they look like, or how a website is run. Sometimes police even ask them to keep chatting with their old friends while officers watch.
Real example: the hacker who worked for the FBI
In 2011, a famous hacker known as “Sabu” was a leader of the hacker group LulzSec. After the FBI caught him, he secretly agreed to help them. As the Christian Science Monitor reported, he kept talking to the other members online while the FBI watched. In March 2012, police in several countries arrested other leading members of the group.
This is the hard truth about “anonymous” groups. The code may be strong, but you still have to trust the people you work with. You can see more stories like this in our Dark Web Timeline.
Police also have to be careful. An informant might lie to get a better deal. So police try to check what an informant says against other proof, like payments, messages or computer files.
4. Infiltration: going undercover
This is the most dramatic route. Police pretend to be buyers, sellers or even staff on a criminal website, working right next to dark web criminals. Sometimes they take over the whole website and keep it running in secret. A fake or police-run site used to catch people is often called a honeypot.
Real example: an agent on the Silk Road 2.0 staff
After Silk Road closed, a copy called Silk Road 2.0 opened weeks later. According to U.S. Homeland Security Investigations, an undercover agent got a job on its support staff. That let the agent see private parts of the site. The agent could also talk directly with the man police say ran it, Blake Benthall. He was arrested in November 2014.
Real example: police secretly running Hansa
The most famous case is Hansa. In 2017, Dutch police secretly took control of Hansa, a big dark web market. A later U.S. court document says they ran it for about three weeks, logging information about its staff, sellers and users.
At the same time, U.S. police shut down AlphaBay, the biggest market. Thousands of AlphaBay users fled straight to Hansa, not knowing the police were already in charge. Read the full story in Operation Bayonet: 3 Brilliant Steps That Took Down AlphaBay.
Why the encryption almost never fails
Here is the surprising part. In almost every public case, the maths behind Tor and encryption did its job. What failed were the dark web criminals themselves.
A 2026 study of ways to unmask Tor sites ranked the options police can use. It found that mistakes by site owners, and weak spots in the websites, were the most useful. Attacks on Tor’s actual code ranked lowest.
So the better question is not “Can police break Tor?” It is “Can police link the hidden activity to something in the real world?” A payment, a parcel, an old username, a friend who talks. That is where most cases are won.
What police show in court
To convict dark web criminals, police must show proof that a judge and jury can check. In dark web cases, that proof often includes:
- Files and chats found on seized computers and phones
- Copies of the criminal website’s servers and messages
- Bitcoin payment records and chain analysis reports
- Records from undercover buys
- Postal and shipping records
- Statements from witnesses and informants
- Links between secret accounts and normal social media accounts
The key idea is a chain of evidence. One clue proves little. But when a wallet, a parcel, a username and a laptop all point to the same person, the case becomes very strong. Police must also prove the evidence was handled properly, which is called the chain of custody.
What stays hidden
Not everything comes out in court or in the news. Some details are kept secret on purpose:
- Informants’ names are protected to keep them safe.
- Some methods are kept quiet so dark web criminals cannot learn to avoid them.
- Court papers can be “sealed” (kept private) or have parts blacked out.
- Active cases stay secret until arrests are made.
Police press releases also tell a neat, simple story. The AlphaBay announcement, for example, talks about arrests and seizures, while many of the detailed methods only appear in separate court papers.
Why secrecy causes so much guessing
When police do not explain how they found dark web criminals, people fill the gap with guesses. The most common guess is “the police broke Tor”.
A famous example is Operation Onymous in 2014. Police seized Silk Road 2.0 and other sites, but never fully explained how they found the servers. For years, people worried that Tor was no longer safe. Public court cases do not support that simple story. They show a mix of mistakes, money trails, undercover work and witnesses.
Experts also argue about where the limits should be. A 2020 legal study of UK police found that the rules for undercover work and police hacking on the dark web were not clear enough. Secrecy can protect investigations, but it also makes it harder for the public to trust the methods.
What this means for you
Most people will never deal with dark web criminals directly. But their story still teaches useful lessons about online privacy:
- Privacy tools are not magic. Tor and VPNs hide some things, not everything. Read Do VPNs Make You Anonymous? to see what they really hide.
- Small details link your accounts. The same username or email in two places can connect them forever.
- Criminals are hunting your data too. Much of what is sold on dark web markets is stolen from normal people by malware. Learn how in What Is Infostealer Malware? and Session Hijacking: How Stolen Cookies Let Hackers Skip Your Password and 2FA.
Frequently asked questions
Can police track someone using Tor?
Not directly in most cases. Tor makes it very hard to trace someone’s internet connection. But police can still catch people through their mistakes, their money, informants and undercover work.
Do police have to break Tor to catch dark web criminals?
No. Public court cases show that police almost always catch people without breaking Tor’s code. They link the hidden activity to something in the real world instead.
Can Bitcoin be traced?
Yes, often. Every Bitcoin payment is stored in a public record forever. If one wallet is linked to a real person, investigators can often follow the rest of the money.
What is the biggest mistake dark web criminals make?
Linking their secret identity to their real one. Reusing a username or email address, or logging in once without protection, has unmasked many people.
Can police take over a dark web website?
Yes. In the Hansa case, Dutch police secretly ran a dark web market for about three weeks to collect evidence before shutting it down.
Why are some details of dark web cases kept secret?
To protect informants, keep methods working for future cases, and avoid spoiling investigations that are still going on.
Sources
We built this article from court records, official announcements and research. See how we choose sources on our Sources and Research page, and find more deep dives in our Investigations section.
- Tippe & Tippe – Onion Services in the Wild: A Study of Deanonymization Attacks (PETS 2024)
- U.S. Department of Justice – Jury finds Bitcoin Fog operator guilty (2024)
- U.S. Department of Justice – Two Brooklyn men indicted over AlphaBay heroin and cocaine sales (2016)
- U.S. ICE / HSI – Arrest of the alleged operator of Silk Road 2.0 (2014)
- U.S. District Court affidavit describing the Hansa takeover
- U.S. Department of Justice – AlphaBay, the largest online dark market, shut down (2017)
- Sophos – Silk Road founder was tracked down by a Googling tax agent
- Christian Science Monitor – Hacker ringleader turned FBI informant (2012)
- Shin & Shin – A vulnerability taxonomy for Tor-based hidden services (2026)
- Davies – Shining a light on policing of the dark web (Journal of Criminal Law, 2020)
The short version
Police rarely catch dark web criminals by breaking encryption. They catch them through four routes: mistakes that link a secret identity to a real one, money trails on the blockchain, informants who switch sides, and undercover work, including secretly running criminal websites.
The code behind the dark web usually holds. The humans using it do not. In the end, people, not codes, are almost always the weak link. And because police keep some methods secret, people often guess that Tor was “broken”, when the real story is usually a simple mistake.
Comments