Timeline of Major Dark Web Marketplace Takedowns
Every few years, a marketplace that seemed untouchable disappears overnight. Here's the chronological record — and the surprisingly consistent pattern behind it.
Major dark web marketplace takedowns span from Silk Road's 2013 seizure through AlphaBay and Hansa's coordinated 2017 takedown, Wall Street Market and Dream Market's 2019 closures, and continued operations against successor markets into the 2020s. Nearly all of them share a common pattern: investigators infiltrate or covertly seize control before making any public arrest.
In July 2017, two of the largest dark web marketplaces in history were seized within days of each other.
One vanished with a dramatic law-enforcement banner. The other kept running silently under police control for weeks first, quietly logging everyone who used it.
TL;DR
Quick answer
Silk Road (2013) and AlphaBay/Hansa (2017) anchor the timeline; most major takedowns involve a covert investigative phase, and successor markets consistently re-emerge afterward.
The recurring shape of a takedown
Why these busts tend to look alike
Dark web marketplace takedowns rarely happen the way a movie would stage them — a sudden raid, doors kicked in, servers unplugged live on camera. The pattern that keeps recurring across the biggest cases instead involves a long quiet phase first: investigators infiltrating forums, tracing cryptocurrency flows, or in some cases literally taking over server operations without announcing it.
That quiet phase can last weeks or months, during which law enforcement often continues operating the marketplace — filling orders, hosting the forums — purely to gather evidence and identify users before the public seizure banner ever goes up. It's a strategy built around patience rather than speed.
The other consistent pattern is what happens afterward: a takedown rarely ends the underlying demand, and a successor marketplace typically emerges within months, often run by displaced vendors from the market that just fell.
The major takedowns, in order
- October 2013
Silk Road is seized by the FBI; founder Ross Ulbricht is arrested.
The first major hidden-service marketplace bust, setting the template for future operations.
- November 2014
'Operation Onymous' takes down dozens of dark web sites across multiple countries in a coordinated sweep.
Demonstrated international law enforcement could act against many markets simultaneously.
- July 2017
AlphaBay is seized and its administrator arrested; Hansa Market is covertly taken over by Dutch police weeks earlier and run silently until shutdown.
The largest coordinated operation to date, combining a public seizure with a silent, evidence-gathering takeover.
- May 2019
Wall Street Market, a major AlphaBay successor, is shut down in a joint US-European operation.
Showed that successor markets inherited both the user base and the law enforcement attention of their predecessors.
- 2019–2021
Dream Market shuts down voluntarily; several other markets exit-scam or fold amid mounting law enforcement pressure.
Highlighted that not every closure is a bust — some operators simply vanish with user funds.
- 2021–2023
Operations against Hydra Market and other large non-English-language markets result in server seizures and asset freezes.
Extended the pattern beyond English-language markets to some of the largest non-Western operations.
Police ran a major marketplace for weeks without anyone knowing
During the 2017 investigation, Dutch police reportedly took covert control of the Hansa marketplace's infrastructure and continued operating it — processing orders, hosting forums — for roughly a month before its public shutdown, gathering evidence the entire time.
It's a strange inversion of the expected story: the marketplace wasn't shut down at the moment police found it — it was kept deliberately running, because a working marketplace under quiet observation is more valuable to investigators than a dead one.
A single takedown can flood a rival marketplace overnight
When AlphaBay was seized in 2017, researchers observed a surge of displaced vendors and buyers migrating to Hansa Market within days — unaware, in many cases, that Hansa was already under covert police control.
That coincidence became one of the more effective parts of the entire operation: investigators anticipated the migration and simply waited for the displaced users to walk into a market they already controlled.
Some of the biggest 'takedowns' weren't takedowns at all
Not every marketplace closure on this timeline involved law enforcement. Several large markets simply vanished on their own, with operators disappearing along with users' funds still held in escrow — a practice known as an exit scam. It's a strange irony of this whole ecosystem: markets built on the promise of trustless, anonymous trade have repeatedly been undone not by police, but by the same lack of trust they were supposedly designed around.
Major dark web marketplace takedowns, year by year
- 2013
Silk Road seized; Ross Ulbricht arrested.
Established the template: patient investigation, public arrest, server seizure.
- 2014
Operation Onymous coordinates takedowns of dozens of hidden services internationally.
Showed the scale of coordinated multinational action possible.
- 2017
AlphaBay seized; Hansa covertly run by Dutch police before public shutdown.
Combined public and covert tactics in the same operation for the first time at this scale.
- 2019
Wall Street Market shut down; Dream Market closes voluntarily.
Illustrated both law-enforcement action and voluntary closures happening in parallel.
- 2021–2023
Hydra Market and other large non-English markets face seizures and asset freezes.
Extended enforcement attention beyond the English-language marketplace ecosystem.
Misconception
A major marketplace takedown ends dark web drug and fraud trade for good.
Reality
Researchers have consistently observed successor markets emerging within months of a major takedown, often absorbing displaced vendors and users from the market that closed.
Misconception
Every time a major marketplace disappears, it's because law enforcement shut it down.
Reality
A significant number of closures are exit scams, where operators simply vanish with funds held in escrow — no law enforcement involvement required.
Misconception
Marketplace takedowns are fast operations once police identify the site.
Reality
The major cases on this timeline typically involved months to years of quiet investigation, sometimes including covertly operating the marketplace itself, before any public action was taken.
If takedowns don't stop the trade, why keep doing them?
Given that new markets keep replacing old ones, what's actually being accomplished?Investigators and researchers point to several effects beyond permanently ending the trade: each takedown captures a fresh trove of evidence and user identities, raises the operational cost and risk for anyone considering running or using a new market, and has measurably shortened the average lifespan of successor marketplaces over time.
How the Hansa operation turned a marketplace into a trap
After covertly seizing Hansa's servers, Dutch investigators reportedly modified the site to secretly log additional information from vendors, effectively turning the marketplace into a data-collection tool while it appeared to buyers and sellers to be operating normally.
It's a case study in how the most effective enforcement action wasn't the eventual public shutdown — it was the quiet weeks beforehand where the marketplace kept running under different management entirely.
So — are these takedowns actually working?
Partially. They don't eliminate the underlying market, but the pattern of increasingly sophisticated, covert operations has measurably raised the risk and shortened the operating life of each successive marketplace — a slow squeeze rather than a knockout blow.
Judged against 'end dark web markets forever,' the record is mixed; judged against 'make running one progressively riskier,' the trend is fairly clear.
What this timeline says about cat-and-mouse online
This pattern isn't unique to dark web marketplaces — it echoes decades of enforcement against any decentralized, replaceable system, from piracy sites to spam networks. Taking down the current leader rarely ends the category; it resets the clock and raises the entry cost for whoever tries next. The dark web marketplace story is really a fast-forward, well-documented version of a much older dynamic.
What to remember
- Silk Road (2013) set the template; AlphaBay/Hansa (2017) remains the largest coordinated operation.
- Many takedowns involve a covert phase where investigators quietly run the marketplace first.
- Not every closure is law enforcement — exit scams have ended several major markets too.
- Successor markets consistently emerge, though each takedown raises the operational cost of running one.
Questions people ask
Where to go next
What was Silk Road, exactly?
The case that started the pattern.
What are the uses of hidden services on the Tor network?
Understand the technology these markets relied on.
Dark web movies based on true events
See how several of these cases became films.
What are Tor exit node risks?
A related technical risk worth understanding.
I got a dark web alert — what do I do now?
See how takedown data ends up affecting ordinary users.
The clock resets, but it does reset
No single takedown ends the story. But each one changes the terms for whoever comes next, and that quiet compounding pressure — more than any one dramatic bust — may be the real, unglamorous point.
You now know
- Silk Road (2013) and the AlphaBay/Hansa operation (2017) are the two most significant takedowns on record.
- Many major takedowns involve a covert phase where investigators run the marketplace before the public shutdown.
- Successor markets consistently re-emerge, though each takedown raises the operational risk for the next one.
Safety note
Educational, not operational
This guide is educational. It does not provide instructions for illegal activity, evading law enforcement, buying prohibited goods, or attacking systems. Laws and risks vary by country, so stay within your local rules and avoid interacting with unknown services.
Common myth
Myth vs reality
A major marketplace takedown ends dark web drug and fraud trade for good.
Researchers have consistently observed successor markets emerging within months of a major takedown, often absorbing displaced vendors and users from the market that closed.
FAQs
Questions people ask
Sources
Further reading
- DOJ and Europol press releases on marketplace operations
- Academic research on dark web marketplace lifecycles
Glossary
Terms in this guide
Continue learning