Has The FBI Ever Run A Dark Web Marketplace Undercover?
Not the FBI alone — but yes, in 2017, law enforcement secretly operated a major marketplace for nearly a month while its users had no idea.
Yes. As part of Operation Bayonet in 2017, Dutch National Police — working with Europol, the FBI, and the DEA — secretly took control of Hansa Market, then the dark web's second-largest marketplace, and operated it covertly for 27 days before publicly announcing its seizure. The operation was primarily run by Dutch authorities, with the FBI and DEA playing coordinating roles as part of the same broader effort that simultaneously took down AlphaBay.
For 27 days in the summer of 2017, one of the dark web's largest marketplaces kept running exactly as it always had.
Vendors listed drugs. Buyers placed orders. Nothing about the site looked any different from the outside.
TL;DR
Quick answer
Yes — in 2017, as part of Operation Bayonet, Dutch National Police (with FBI and DEA coordination) secretly took control of Hansa Market and operated it as a functioning marketplace for 27 days, timed to catch users displaced by the simultaneous public seizure of AlphaBay.
The setup
Two takedowns, engineered to work together
Operation Bayonet targeted AlphaBay and Hansa Market simultaneously, on the theory that taking down just one large marketplace would simply push its users to the next-largest alternative. Dutch police had already covertly compromised Hansa's servers before the operation's public phase began, giving investigators a rare vantage point: a live, functioning marketplace they fully controlled.
When AlphaBay was publicly seized on July 5, 2017, Dutch authorities kept Hansa running quietly rather than shutting it down immediately. As displaced AlphaBay users flooded into Hansa looking for a new marketplace, they were, in effect, walking straight into a law enforcement-controlled honeypot.
What actually happened, precisely
- Dutch National Police covertly took control of Hansa's infrastructure before the public operation began.
- They kept it running as a functioning marketplace for 27 days after AlphaBay's public seizure.
- During that period, they collected real IP addresses, delivery addresses, and other identifying data from users who believed the site was still secure.
Story in brief
- 2016
Europol develops an investigative lead into Hansa Market's backend infrastructure.
Laid the groundwork for the eventual covert takeover.
- June 20, 2017
Dutch National Police secretly take control of Hansa Market.
Gave investigators full operational control of a live, major marketplace.
- July 5, 2017
AlphaBay is publicly seized in a coordinated FBI/DEA-led operation.
Sent a wave of displaced users searching for a new marketplace.
- July 20, 2017
Hansa's seizure is finally announced publicly, after 27 days of covert operation.
Revealed the full scope of what had actually happened during those weeks.
The safest place to buy drugs on the dark web was, for a month, run by the police
Dutch police reportedly adjusted some of Hansa's backend security settings during the covert period specifically to expose more information about buyers and vendors than the original operators' setup would have.
AlphaBay's users, fleeing what they thought was an unrelated shutdown, specifically sought out Hansa because it had a reputation for stability and security — completely unaware that reputation was, by that point, being maintained by the very authorities trying to catch them.
It's a striking illustration of how thoroughly the operation exploited the platform's own trust mechanisms against the people relying on them.
What people get wrong
Myth
The FBI directly ran Hansa Market undercover.
Reality
Dutch National Police were the primary operators of the covert takeover; the FBI and DEA were coordinating partners in the broader operation, focused mainly on the simultaneous AlphaBay seizure.
Myth
Users could tell something was different once police took over.
Reality
The site was deliberately kept running with no visible changes, specifically so users would continue behaving normally.
Myth
This was a one-off, isolated tactic.
Reality
Similar honeypot-style operations against other kinds of hidden services have occurred separately, showing this approach as an established, if still relatively rare, law enforcement technique.
If they already controlled the site, why not shut it down immediately?
Once Dutch police had control of Hansa, why keep it running at all instead of shutting it down right away?Because a live, functioning marketplace under their control was far more valuable as an intelligence source than an immediate seizure would have been. Every day it stayed operational, investigators collected more real IP addresses, more delivery addresses tied to actual buyers, and a clearer picture of the vendor community — all data that simply wouldn't exist if the site had been shut down the moment they gained access.
How well-documented is this?
The evidence behind the claim that law enforcement covertly ran a major marketplace.
Europol and Dutch National Police have publicly confirmed the covert operation of Hansa Market for 27 days.
Drawn from law-enforcement records.The FBI and DEA played coordinating and supporting roles, primarily focused on the parallel AlphaBay seizure.
Drawn from law-enforcement records.Thousands of delivery addresses and user identifiers were collected during the covert period.
Drawn from government policy.This was the first large-scale example of this specific 'honeypot marketplace' tactic against a major dark web market.
Drawn from historical records.A private cybersecurity firm helped make the takeover possible
Dutch investigators' initial breakthrough into Hansa's backend infrastructure was aided by information from a private cybersecurity company, blending corporate threat research with a state-run undercover operation.
It's a reminder that major law enforcement operations against the dark web increasingly rely on partnerships well outside traditional policing, including private-sector security research.
The takedown's biggest weapon was trust, not force
Operation Bayonet didn't rely on breaking Tor's encryption or any dramatic technical exploit against the network itself — it relied on users trusting a familiar-looking marketplace enough to keep behaving normally. The most effective tool turned out to be psychological, not technical.
The delayed AlphaBay announcement
Investigators deliberately delayed publicly confirming AlphaBay's seizure, allowing rumors of an exit scam to spread — a move researchers believe was designed to further erode trust across the marketplace ecosystem, compounding Hansa's eventual reveal.
It shows the operation's psychological strategy extended beyond just Hansa itself, aiming to damage trust across the dark web marketplace community as a whole.
So, has it happened?
Yes — though it was primarily Dutch National Police, not the FBI alone, that covertly ran Hansa Market, with the FBI and DEA as coordinating partners in the broader Operation Bayonet.
A real, well-documented case, just with a more international cast of agencies than the popular 'FBI ran a market' framing usually credits.
Trust is the actual currency being fought over
Operation Bayonet is a useful window into how dark web law enforcement has evolved: less about breaking encryption, more about exploiting the fragile trust that keeps any anonymous marketplace functioning at all. Once that trust is gone, it's very hard for an ecosystem to rebuild it quickly.
The short version
- Dutch National Police covertly operated Hansa Market for 27 days in 2017 as part of Operation Bayonet.
- The FBI and DEA coordinated the simultaneous, publicly announced seizure of AlphaBay.
- Displaced AlphaBay users who moved to Hansa were unknowingly interacting with a law enforcement-controlled site.
- The operation collected significant identifying data, including delivery addresses, before Hansa's seizure was publicly revealed.
Questions people ask
Where to go next
Does the dark web exist anymore?
How the ecosystem absorbed this particular disruption and kept going.
Is Tor safe from police?
How this operation fits into the broader picture of what actually gets people caught.
What is Empire Market and why did it disappear?
The marketplace that rose in this exact ecosystem's aftermath.
What happens to seized dark web cryptocurrency?
What typically follows a takedown like this one.
Can the dark web be hacked?
How this operation compares to other ways dark web infrastructure gets compromised.
The storefront never changed. Everything behind it did.
For 27 days, thousands of people trusted a marketplace that had already switched sides.
You now know
- Dutch National Police covertly operated Hansa Market for 27 days in 2017, with FBI and DEA coordination as part of Operation Bayonet.
- The operation was timed with AlphaBay's public seizure to catch users displaced from that marketplace.
- Significant identifying data, including delivery addresses, was collected before Hansa's seizure was publicly revealed.
Safety note
Educational, not operational
This guide is educational. It does not provide instructions for illegal activity, evading law enforcement, buying prohibited goods, or attacking systems. Laws and risks vary by country, so stay within your local rules and avoid interacting with unknown services.
Common myth
Myth vs reality
The FBI directly ran Hansa Market undercover.
Dutch National Police were the primary operators of the covert takeover; the FBI and DEA were coordinating partners in the broader operation, focused mainly on the simultaneous AlphaBay seizure.
FAQs
Questions people ask
Sources
Further reading
- Hansa Market Taken Down In Global Law Enforcement OperationEuropol / Bitcoin Magazine
- Operation Bayonet: How the FBI Took Down AlphaBay and HansaCybelAngel
Glossary
Terms in this guide
Continue learning