What Was Operation Bayonet?
Two of the largest dark web marketplaces in history fell within weeks of each other in 2017 — and it wasn't a coincidence. It was one operation, executed in two carefully timed acts.
Operation Bayonet was the joint name for the coordinated 2017 international law enforcement effort that took down both AlphaBay and Hansa Market, then two of the largest dark web marketplaces in the world. Led by agencies including the FBI, DEA, and Dutch National Police, with support from Europol, the operation first publicly shut down AlphaBay in early July 2017, then revealed weeks later that Dutch police had secretly seized and covertly operated Hansa Market throughout that same period, capturing displaced AlphaBay users who fled there believing it was a safer alternative.
Law enforcement agencies across multiple countries pulled off something unusual in July 2017: they took down not one major dark web marketplace, but two, in a single coordinated sequence.
The second takedown depended entirely on the first one happening exactly when it did — the whole plan only worked because of what the first takedown would predictably cause.
TL;DR
Quick answer
Operation Bayonet was the joint 2017 international law enforcement effort that took down AlphaBay and Hansa Market. AlphaBay was publicly shut down while Hansa had already been secretly seized by Dutch police weeks earlier, deliberately capturing displaced AlphaBay users who migrated there before both operations were revealed together.
The entity
One operation, executed in two deliberately timed acts
Operation Bayonet refers to the joint 2017 law enforcement effort that dismantled both AlphaBay, then the largest dark web marketplace in history, and Hansa Market, a smaller but still significant platform. The operation combined agencies across multiple countries, including the FBI, DEA, and Dutch National Police, with coordination support from Europol.
The strategy unfolded in two distinct phases. First, AlphaBay was publicly and abruptly shut down in early July 2017, following the arrest of its alleged operator, Alexandre Cazes, in Thailand. Second, and this is the part that made the operation genuinely novel, Dutch police had already secretly seized control of Hansa Market weeks earlier and kept it running under covert police supervision, anticipating that AlphaBay's sudden disappearance would send a wave of displaced users toward Hansa as an alternative.
That's exactly what happened. As AlphaBay's users scrambled for a new platform, many chose Hansa specifically because of its existing reputation and stability, unaware that reputation was, by that point, being maintained by the very law enforcement agencies they were trying to avoid.
Why Operation Bayonet is considered a significant law enforcement milestone
- It combined a public, traditional takedown (AlphaBay) with a covert, honeypot-style operation (Hansa) in the same coordinated effort
- It deliberately anticipated and exploited the predictable user-migration pattern that follows a major marketplace shutdown
- It required unusually close international cooperation between multiple countries' law enforcement agencies operating simultaneously
- It became a widely referenced template in discussions of subsequent dark web law enforcement strategy
Operation Bayonet at a glance
- Late June 2017
Dutch police covertly seize control of Hansa Market's servers
Set up the second, hidden phase of the operation ahead of the public AlphaBay takedown
- July 5, 2017
AlphaBay's servers go dark following Alexandre Cazes's arrest in Thailand
Triggered the predictable wave of displaced users searching for a new marketplace
- July 2017 (following weeks)
Displaced AlphaBay users migrate in large numbers to Hansa Market, unaware it's under covert police control
Delivered a substantial volume of new evidence directly into the ongoing covert operation
- July 20, 2017
The DOJ and Europol publicly announce both takedowns together, revealing Hansa's covert operation for the first time
Unveiled the full scope and coordination of the joint operation to the public
The strange part: the two halves of the operation looked completely different
Officials publicly described the dual-phase strategy only after both operations concluded, explaining that the delay in announcing Hansa's seizure was specifically designed to maximize the intelligence gathered from displaced AlphaBay users.
AlphaBay's takedown was loud, immediate, and highly visible — an arrest, a seizure, servers going dark overnight. Hansa's takedown was the opposite: quiet, gradual, and deliberately invisible for weeks, precisely so its value as a covert operation wouldn't be wasted.
It shows a level of coordinated patience uncommon in law enforcement announcements, where the instinct is often to publicize a win as soon as possible rather than sit on it for strategic advantage.
The two-phase plan, step by step
How investigators sequenced the operation for maximum effect.
Secure Hansa Market covertly, first
Dutch police seized control of Hansa's infrastructure before making any public move, ensuring it would already be under police supervision by the time it mattered most.
Publicly shut down AlphaBay
The larger, more prominent marketplace was taken down loudly and visibly, triggering an immediate, predictable user migration.
Let displaced users migrate to Hansa
Rather than intervening, investigators allowed the natural migration pattern to play out, delivering new vendor and buyer activity directly into the monitored platform.
Announce both operations together
Only after gathering sufficient evidence did authorities publicly reveal Hansa's covert status, alongside the AlphaBay takedown, as one combined operation.
Misconception
Operation Bayonet was simply two separate, unrelated takedowns that happened to occur around the same time.
Reality
The two takedowns were deliberately and closely coordinated as a single strategy, specifically designed so the panic and migration caused by AlphaBay's very public shutdown would funnel activity into Hansa, which was already under covert police control.
The name itself was chosen to reflect the operation's two-pronged nature
'Bayonet,' evoking a weapon with both a firearm's reach and a blade's close-quarters precision, was reportedly chosen to reflect the operation's combination of a broad public strike (AlphaBay) with a closer, more targeted covert action (Hansa).
Even the operation's name carried a deliberate symbolic logic, matching the actual dual-phase strategy investigators had planned.
So how did investigators know users would actually migrate to Hansa specifically?
With multiple marketplaces available at the time, why were investigators confident displaced AlphaBay users would choose Hansa?Investigators drew on the established historical pattern from previous marketplace takedowns, where displaced users consistently gravitated toward the most reputable, stable-seeming alternative available — Hansa was already a significant, trusted marketplace at the time, making it a statistically reasonable bet rather than a certainty.
The loudest takedown was designed to serve the quietest one
AlphaBay's very public, headline-grabbing shutdown wasn't just an endpoint — it was actually a tool, deliberately engineered to drive traffic toward an entirely different, silent operation running in parallel. The visible victory was, in a real sense, working in service of the invisible one.
What Operation Bayonet says about modern law enforcement strategy
The operation represents a notable evolution beyond simply reacting to and shutting down individual criminal platforms — it treated the entire ecosystem's predictable behavior as something to actively plan around. That shift, from single-target takedowns to ecosystem-level strategy, has become a recurring theme in how major dark web law enforcement operations have been designed in the years since.
Questions people ask
If this got you curious
What was Hansa Market?
The full story of the covert half of this operation
What happened to AlphaBay?
The full story of the public half of this operation
What is a honeypot site on the dark web?
The general concept this operation exemplifies
What was Operation DisrupTor?
A later operation that built on intelligence from takedowns like this one
Do dark web marketplaces still exist in 2026?
See how this strategy fits the broader ongoing takedown cycle
The plan worked because it trusted human habits more than any technology
Operation Bayonet's most effective ingredient wasn't a piece of software or a cryptographic breakthrough — it was a bet on ordinary human behavior: that scared people looking for a safer option would choose the most familiar, reputable one available. That bet paid off precisely because it was right.
You now know
- Operation Bayonet was the joint 2017 operation that took down both AlphaBay and Hansa Market
- AlphaBay was publicly shut down first, while Hansa had already been covertly seized by Dutch police weeks earlier
- The operation deliberately exploited the predictable migration of displaced AlphaBay users toward Hansa
- Both takedowns were revealed together on July 20, 2017, showing the full scope of the coordinated strategy
Safety note
Educational, not operational
This guide is educational. It does not provide instructions for illegal activity, evading law enforcement, buying prohibited goods, or attacking systems. Laws and risks vary by country, so stay within your local rules and avoid interacting with unknown services.
Common myth
Myth vs reality
The two takedowns were unrelated and just happened around the same time.
They were deliberately coordinated as a single strategy.
FAQs
Questions people ask
Sources
Further reading
- AlphaBay, the Largest Online 'Dark Market,' Shut DownU.S. Department of Justice
- Massive Blow to Criminal Dark Web Activities After Globally Coordinated OperationEuropol
Glossary
Terms in this guide
Continue learning