In his usual analytic tone, Hemesath launched into a short speech about the crimes they knew Cazes had committed, the indictment against him, and the potential consequences if he were convicted. Hemesath laid out the evidence they possessed, which now included not only archived social media clues and blockchain evidence but Cazes’ own unencrypted laptop and phone. He explained that if Cazes didn’t cooperate with them, he might very well spend the rest of his life in prison.
Dark Web Marketplace Owners Charged With Facilitating $430M In Illegal Goods Sales
To do the same with Cazes, she tried taking an almost maternal approach—one that wasn’t entirely feigned. Despite her hard-charging comments to Miller about sending Alpha02 to supermax prison earlier that year, she felt some warmth and even empathy mixed in with her contempt for Cazes, now that she saw him captive before her. The voice on the other end of the line, another undercover agent, played the role of the cuckolded husband. Cazes, nervously speaking in Thai, offered him 100,000 baht to drop the charges, around $3,000.
And with a handsome portion of that revenue going into the founders’ pockets, the earliest days of AlphaBay were the furthest thing from their minds. Today, the Justice Department announced the results of Operation Grayskull, a highly successful joint effort between the Department of Justice and the FBI that resulted in the dismantling of four… We’re back with another video in our Webz Insider video series on everything web data. Watch our cyber team share their key insights from their investigations into the biggest dark web trends in 2022. Learn how to automate financial risk reports using AI and news data with this guide for product managers, featuring tools from Webz.io and OpenAI. Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data.
The Top 7 Dark Web Marketplaces In 2025
- “AlphaBay name was put in bad light after the raids. I am here to make amends to that.”
- Cazes had gone to great lengths to obfuscate his bitcoin transactions, routing the money through bitcoin laundering services and frequently changing his wallet addresses.
- After the initial shock passed, Rabenn admits, he felt little sympathy for Cazes.
- AlphaBay was one of the most notorious darknet markets, operating on the Tor network and facilitating illegal trade in various goods, including drugs, weapons, stolen data, and counterfeit currency.
- “I understand if you decide not to but over time you will be proven that we are the original AB and we have never been ‘compromised’ in any way shape or form.”
- The shutdown of AlphaBay marks a significant moment in the landscape of the deep web, highlighting both the vulnerabilities within illegal marketplace platforms and the efforts of law enforcement to tackle cybercrime.
However, its rise was paired with a series of events that ultimately led to its dramatic downfall. On August 6, 2021, former AlphaBay security administrator “DeSnake” announced that AlphaBay Market had relaunched. The original AlphaBay, founded by Alexandre Cazes (aka “Alpha02”) in September 2014, was taken down by law enforcement’s Operation Bayonet in July 2017.
Security firm Flashpoint says it has seen evidence and descriptions of DeSnake operating under the same pseudonym—first as a credit-card-focused cybercriminal on sites like Evolution and Tor Carder Forum before becoming a market administrator himself—since at least 2013. But all of those technical and operational protections may matter less than a simple geographic one. DeSnake claims to be located in a non-extradition country, beyond the reach of US law enforcement.
Frequently Asked Questions (FAQs) About Dark Web Marketplaces
But the Operation Bayonet team knew from Cazes’ online boasting that his devices were encrypted and equipped with kill switches that could wipe all data from their drives. Without that data, their case against Cazes might not stand, so they needed to stealthily nab Cazes while his devices were open and unlocked. A search of the name “Alexandre Cazes” turned up years of posts on various tech, hacking, and programming forums, with one containing the biggest bombshell yet.
Shuttered Dark Web Marketplaces
The takedown of AlphaBay, along with the takeover of the dark web marketplace Hansa Market in a related operation, damaged user trust in the dark web, which is necessary for dark web marketplaces to operate. One former US law enforcement official involved in the original AlphaBay investigation, who asked not to be named, also expressed doubts. As DeSnake describes it, AlphaGuard will automatically rent and set up new servers if it detects that AlphaBay’s are being taken offline. He even claims that AlphaGuard will automatically hack other websites and plant data on their servers to give users “withdrawal codes” they can use to save the cryptocurrency they’ve stored on AlphaBay in case of a takedown. “It is a system to ensure users can withdraw funds, settle disputes, and generally go without a cent lost if raids happen,” DeSnake writes, “even if it happens on all servers at the same time. It is unstoppable.”
All of this was designed to allow the agent playing his wife to venture to an upstairs window and get eyes on Cazes’ house and driveway next door, in anticipation of the action set to unfold there. In fact, every one of the characters in this bustling scene was an undercover agent. Thailand’s DEA equivalent, the Narcotics Suppression Bureau, had assembled an entire theatrical production’s worth of actors around the unwitting target, busily performing their roles and waiting for a signal for Operation Bayonet’s takedown to finally begin. Monero’s ring signatures, stealth addresses, and RingCT ensure untraceable trades. In 2025, 95% of markets prefer XMR over BTC’s public ledger, with transaction volume up 60% since 2023. These shifts tie into how markets like these are evolving—check them out below.
FAQ – Dark Web Markets 2025 And Cybersecurity
Miller then found fingerprints on a package of heroin sent from one of his accounts, which matched those of another New York man. Finally, Miller worked with postal inspectors to get photos taken by a post office self-service kiosk. The photos showed the second New Yorker putting a dope shipment in the mail.
Verified Market Links
Established in 2019, Russian Market is a well-known and highly regarded data store on the dark web, specializing in the sale of PII and various forms of stolen data. Despite its name, the marketplace operates primarily in English and serves a global audience. It has gained a reputation for being a reliable source of high-quality data for cybercriminals.
The surface web domain is likely setup specifically to direct users to a phishing site where their credential information can be stolen. In early August 2021, DeSnake resurfaced on Dread, the popular Reddit-like discussion forum on the darknet administrated and moderated by users, Hugbunter and Paris. Dread staff “vouched” for DeSnake to skeptical darknet users with DeSnake signing documents using their historical PGP key. In 2016, an angry user of AlphaBay known as “Kinger” stated that alpha02 had left the market in late 2015, sold his stake to DeSnake, and DeSnake was supposedly acting as admin for its final two years.
A senior member from the carding community Ranklez claimed he had evidence to suggest Cazes wasn’t alpha02. Ranklez and alpha02 had a history in the carding community as Ranklez sold alpha02 fullz for conducting identity theft. In May 2015, the site announced an integrated digital contracts and escrow system.15 The contract system allows users to make engagements and agree to provide services in the future, according to the terms of the contract. Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring. Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity.
The Impact Of Dark Web Marketplace Takedowns AlphaBay And Hansa
It was a small team of “odd ducks,” as he describes them—agents on the more cerebral side, content to work cases largely on a computer screen instead of kicking down doors like their Central Valley colleagues. Trying to give the impression of an inexperienced driver, Nueng slowly rolled the car toward a model home and real estate office at the end of the cul-de-sac. She signaled to a security guard outside the house that she had taken a wrong turn and needed to pull a 180. She heard him shout at her to back directly out instead, that the street was too narrow for a three-point turn.
Altogether, our approach can help Law Enforcement Agencies (LEA) make more informed decisions by verifying and identifying migrating vendors and their potential aliases with state-of-the-art (SOTA) performance on both existing and emerging low-resource (LR) Darknet markets. AlphaBay’s founder, Alexander Cazes, was arrested in Thailand, and U.S. officials successfully negotiated his extradition to the U.S. in early July. But before he could be extradited, Cazes was found dead from an apparent suicide in his cell in Thailand. On the evening after the arrest, Rabenn and Hemesath met with Cazes for the first time. He sat in a conference room of the NSB office—accompanied, for the moment, only by a Thai police chaperone and two Thai lawyers, whom Cazes had hired to temporarily oversee his defense. For Rabenn, who had hunted Cazes for the better part of a year across the digital world, sharing a room with his target still felt surreal.
