What Was Operation Bayonet? AlphaBay and Hansa
Operation Bayonet was the 2017 international operation involving AlphaBay and Hansa. The official seizure notice dates the Dutch takeover of Hansa to June 20 and AlphaBay’s takedown to July 4. The sequence matters because a marketplace can remain accessible while under investigative control. It demonstrates a risk of trusting a service operator, not a universal ability to identify every Tor user.
Understanding the question
Why the two-market sequence mattered
Bayonet is best understood as a coordinated operation against particular services. Its historical importance comes from the sequence and the evidence available at those services, rather than a claim that anonymity technology simply stopped working.
Two marketplaces, different operational roles
AlphaBay and Hansa were separate platforms. The official records describe infrastructure seizure and a police takeover, with cooperation across national boundaries. Treat those descriptions as accounts of this operation, rather than a general model for every later case.
A website’s familiar appearance is not proof that its operator has remained the same. That is the trust problem illustrated by a controlled marketplace.
The sequence in the official record
- June 20, 2017
Dutch police took over Hansa
Control changed before public closure
- July 4, 2017
AlphaBay takedown
A separate service became unavailable
- July 20, 2017
Public international announcement
Announcement date differs from earlier operational events
Why the order of events was important
A takeover before a disruption
The distinctive feature of Bayonet was that Hansa had already come under police control before AlphaBay became unavailable. Someone deciding where to move after the first disruption could therefore encounter a destination whose control had changed without that change being obvious from its continued availability.
The destination trust boundary
That sequence explains the operation’s significance more clearly than the phrase two markets shut down. It also identifies the relevant trust boundary: the service receiving a user’s interaction. The official dates establish the sequence; they do not establish that every displaced user visited Hansa or that every visit produced an identified person.
Why a controlled service changes the evidence
A service operator may observe information submitted to the site and data available on its infrastructure. That is a different vantage point from an ordinary relay forwarding encrypted traffic.
What a particular investigation collected and how it connected records to people depends on its systems, records and legal process. Do not infer a complete list of identified users from the existence of the takeover.
Service visibility is different from identity attribution
A site may receive messages, account activity and transaction-related information. Turning a record into a claim about a person requires further work: understanding what the record represents, whether an account was shared and what independent evidence connects the activity to someone. The existence of a controlled service does not eliminate those questions.
In a hypothetical investigation, an account record might become one lead among several. Whether it is sufficient depends on the evidence and legal standard involved. That distinction prevents two common overstatements: assuming that a Tor route makes the destination blind, and assuming that controlling a destination automatically identifies everyone who uses it.
Did Bayonet break Tor?
Bayonet’s official notices describe actions against marketplaces and infrastructure; they do not establish universal decryption of Tor. A compromised destination, device records and network observations are different mechanisms and should be described separately.
For a technical comparison, start with Tor’s description of the network. A destination still receives information sent to it even when the route to that destination protects the source address in ordinary use.
What happened to activity afterward?
Original research examined vendor migration toward Dream Market after Bayonet. It provides a way to study displacement after an enforcement action, while retaining the limits of its observations.
Migration does not establish that every vendor or buyer followed the same route. Nor does an old platform name verify the legitimacy, ownership or safety of a site that later adopts it.
Questions people ask
Sources
Further reading
Glossary
Terms in this guide
Continue learning