Dark Web Marketplace Takedowns: A Sourced Timeline
Major milestones include Silk Road in 2013, Silk Road 2.0 in 2014, AlphaBay and Hansa in 2017, Wall Street Market in 2019, DarkMarket in 2021 and Hydra in 2022. Later DisrupTor, Dark HunTOR and SpecTor announcements concern follow-up enforcement. The dated register below separates seizures, takeovers, charges and announcements, with links to official records.

Understanding the question
Follow the event as well as the date
This selection follows documented marketplace seizures and the later enforcement campaigns that show why closure dates matter. It covers milestones from 2013 through 2023, not every closure or a complete record through 2026. Cases qualify when an official source identifies the platform or directly connected operation and makes the kind of event clear.
The table distinguishes operational dates from publication dates. Where the cited record does not establish an exact shutdown day, the entry keeps a month or explicitly labels the announcement instead of supplying false precision. Voluntary exits and alleged exit scams are compared separately below.
Marketplace takedowns and their aftermath: a visual timeline
- October 2013
Original Silk Road seized
Platform seizure: the original marketplace was disrupted. Later asset seizures and court proceedings are separate events.
- November 7, 2014
Silk Road 2.0 seizures publicly announced
Announcement: the FBI reported action against a separate Silk Road platform and other dark-market sites. The publication date is not an exact shutdown date for every site.
- June 20, 2017
Dutch authorities take control of Hansa
Covert takeover: investigators controlled the destination before its public closure, an important distinction from simply switching it off.
- July 4, 2017
AlphaBay taken down
Platform takedown: the official Bayonet notice places this after the Hansa takeover, not on the later public-announcement date.
- July 20, 2017
Bayonet announced and Hansa publicly closed
Public closure and announcement: the coordinated operation became public after the earlier takeover and AlphaBay takedown.
- May 3, 2019
Wall Street Market operation and charges announced
Enforcement announcement: the record describes action against alleged operators and an alleged exit scam during the operation. Charges are not convictions.
- September 22, 2020
Operation DisrupTor results announced
Follow-up enforcement: vendor investigations followed the earlier Wall Street Market seizure. This is not another marketplace shutdown date.
- January 2021
DarkMarket dismantled
Platform takedown: evidence from the disruption supported later investigations. The month is retained rather than implying an exact operational day.
- October 26, 2021
Dark HunTOR results announced
Follow-up arrests: this later campaign arose from the earlier DarkMarket disruption; it should not replace the original shutdown date.
- April 5, 2022
Hydra infrastructure seized and charges announced
Server seizure and charging announcement: a separate operation from DarkMarket and Bayonet. Allegations must remain distinct from judicial findings.
- May 2, 2023
Operation SpecTor results announced
Follow-up enforcement results: the announcement illustrates how investigative consequences can continue after a marketplace disappears.
Marketplace enforcement timeline: dates, events and sources
Source keys correspond to the linked official records immediately below. This is an event register: multiple rows can belong to one operation, and an announcement is not silently treated as the day a server went offline.
| Date | Event | Type | Source key |
|---|---|---|---|
| October 2013 | Original Silk Road seized; later October asset action is separate | Platform seizure (month-level date) | T1 |
| November 7, 2014 | Silk Road 2.0 and other dark-market seizures publicly announced | Announcement; not a claim every seizure happened that day | T2 |
| June 20, 2017 | Dutch authorities take control of Hansa | Covert platform takeover | T3 |
| July 4, 2017 | AlphaBay taken down | Platform takedown | T3 |
| July 20, 2017 | Bayonet becomes public; Hansa closure distinguished from takeover | Public closure / coordinated announcement | T3 |
| May 3, 2019 | Wall Street Market operation and U.S. charges announced | Enforcement announcement / charges | T4 |
| September 22, 2020 | Operation DisrupTor results announced after Wall Street Market seizure | Follow-up arrest campaign; not a new market seizure | T5 |
| January 2021 | DarkMarket dismantled | Platform takedown (month-level date) | T6 |
| October 26, 2021 | Dark HunTOR results announced following DarkMarket disruption | Follow-up arrests / public announcement | T6 |
| April 5, 2022 | Hydra infrastructure seized and charges announced | Server seizure / charging announcement | T7 |
| May 2, 2023 | Operation SpecTor results announced | Follow-up enforcement results; not the original closure date | T8 |
- [T1] DOJ: Silk Road seizure and later asset action
- [T2] FBI (November 7, 2014): Silk Road 2.0 and additional seizures announced
- [T3] Official Bayonet notice: operational dates
- [T4] DOJ (May 3, 2019): Wall Street Market operation and charges
- [T5] FBI (September 22, 2020): Operation DisrupTor follow-up
- [T6] Eurojust: DarkMarket and Dark HunTOR
- [T7] DOJ: Hydra seizure and charges
- [T8] FBI (May 2, 2023): Operation SpecTor results
2013: Silk Road
Silk Road is an early landmark in marketplace enforcement. The October 2013 DOJ record is useful for its contemporaneous description of seizure and assets, rather than as a complete account of every later court development.
Keep the platform seizure separate from later proceedings involving individual people. A timeline of websites is not automatically a timeline of final convictions.
2014: Silk Road 2.0 and Operation Onymous
Silk Road 2.0 was a separate platform from the original Silk Road. The FBI’s November 7, 2014 release announces its seizure alongside additional dark-market sites. Its date belongs in a chronology as a public announcement; it should not automatically replace a technical shutdown date reported elsewhere.
Counting onion addresses is also different from counting independent marketplaces or people. One operation can remove several addresses associated with one service. The release establishes enforcement action against named infrastructure; it does not by itself supply a complete technical account of how every operator or customer was identified.
2017: a takeover as well as a takedown
The official Bayonet seizure notice gives June 20 for the Dutch takeover of Hansa and July 4 for AlphaBay’s takedown. That sequence matters: a controlled platform and a publicly unavailable platform are different operational states.
The July 20 DOJ announcement documents international cooperation. It does not imply that every user of Tor was identified or that the underlying network was universally decrypted.
2019–2020: Wall Street Market, then DisrupTor
The May 3, 2019 DOJ announcement describes charges against alleged Wall Street Market operators and a coordinated investigation. It also describes an alleged exit scam during the enforcement sequence. That overlap is a reminder that a platform’s ending can involve more than one event, rather than fitting a single neat category.
The FBI’s September 2020 DisrupTor account connects subsequent vendor investigations to the earlier marketplace seizure. The two announcements should therefore occupy different rows. Information recovered during a platform operation can remain useful after the website disappears; a later arrest campaign does not mean the market stayed open until that later date.
2021 and 2022: distinct investigations
Eurojust describes the later Dark HunTOR action as stemming from the earlier DarkMarket takedown. The October 2021 arrests therefore should not be presented as the original platform shutdown date.
The Hydra record is a separate April 2022 seizure and charging announcement. A charge identifies an allegation; it should not silently be rewritten as a final judicial finding.
Why the date on a press release can mislead
A case announcement may combine an earlier server action, an arrest, a later forfeiture filing and a public explanation. Using only its publication date can put the platform event in the wrong place in a chronology. Keep the operational date beside the event it describes, then record the announcement separately when it adds context.
Bayonet is a clear example because a takeover, a takedown and the public announcement occurred on different dates. The later Dark HunTOR announcement illustrates another distinction: follow-up arrests can arise from an earlier platform disruption. These are related events, but they should not occupy the same timeline slot.
Why closures do not end the whole ecosystem
Research on migration after Operation Bayonet examines how activity shifted toward another market. That is one reason a successful seizure does not equal the disappearance of all illegal trade.
For historical comparisons, distinguish a police seizure from voluntary closure, an unexplained outage or an alleged exit scam. Require dated evidence before assigning a cause, and do not authenticate present-day sites from historical names.
Compare outcomes without inventing a single score
- A server seizure, a recovered dataset, an arrested operator and reduced trading are different possible outcomes. A source documenting one does not necessarily establish the others. Even a large user count may refer to registered accounts rather than active individuals, so avoid treating unlike figures as directly comparable.
- For a useful historical comparison, ask what changed at the platform, what evidence the announcement describes and what later research can measure. Separate immediate disruption from longer-term displacement. That preserves the significance of an operation without implying that every subsequent marketplace was a direct successor or that the whole ecosystem ended when one site disappeared.
2023: SpecTor is an enforcement-results date
The FBI’s May 2, 2023 SpecTor account reports an international operation against darknet trafficking. This entry extends the timeline of investigative consequences without presenting the announcement as a new opening or closing date for every marketplace discussed in it.
A reader asking “wasn’t that market already gone?” has identified a real distinction. Servers can be taken offline first, evidence can be analyzed later, and coordinated arrests can become public later still. Record each event under its own description. Arrest totals describe suspects or enforcement actions, not final convictions of everyone counted.
Not every disappearance was a police takedown
These historical closure dates and labels follow EUDA’s dataset, published in 2024 with status checked December 31, 2023. They are source classifications, not this article independently proving an operator’s intent or authenticating any current site using an old name.
| Subject | EUDA classification | Why it is separate |
|---|---|---|
| Evolution — March 18, 2015 | Exit scam | Do not add it to a police-seizure count merely because the site disappeared |
| Agora — September 6, 2015 | Voluntary exit | A closure can be a platform decision rather than a documented raid |
| Unexplained outage | Not assigned a cause here | An inaccessible site alone cannot establish seizure, scam or permanent closure |
Questions people ask
Sources
Further reading
- DOJ: Silk Road seizure records, October 2013
- Official Operation Bayonet seizure notice
- Eurojust: DarkMarket and subsequent investigations
- DOJ: Hydra shutdown, April 2022
- DOJ: AlphaBay seizure, July 2017
- Original research: vendor migration after Operation Bayonet
- [T2] FBI (November 7, 2014): Silk Road 2.0 and additional seizures announced
- [T4] DOJ (May 3, 2019): Wall Street Market operation and charges
- [T5] FBI (September 22, 2020): Operation DisrupTor follow-up
- [T8] FBI (May 2, 2023): Operation SpecTor results
- EUDA market-lifetime dataset (published March 2024; status checked December 31, 2023)