@daily_btc_lore | Daily Bitcoin History Threads

July 5, 2017 | 9 years ago today

AlphaBay Seized and the Exit Was a TrapAlphaBay Seized and the Exit Was a Trap

The FBI called AlphaBay roughly 10 times the size of Silk Road. When it fell on July 5, 2017, the takedown itself was not the trap. The trap was where everyone ran next.

The MarketThe Market

By mid-2017, AlphaBay was the largest darknet market ever built: over 250,000 listings for drugs and toxic chemicals, plus 100,000 more for stolen IDs, malware, counterfeit goods, and fraud tools. It served some 200,000 users and 40,000 vendors, with payments in Bitcoin and Monero. At the takedown announcement, acting FBI Director Andrew McCabe put the scale in perspective: Silk Road, the largest such market before it, had peaked near 14,000 listings.

The Founder's MistakeThe Founder's Mistake

AlphaBay was run by Alexandre Cazes, a 25-year-old Canadian living in Bangkok, known on the site only as Alpha02. His fatal mistake dated to the site's first days in 2014: welcome emails sent to early users came from his personal address, pimp_alex_91@hotmail.com. Investigators found the address sitting in old message headers, and the pseudonym unraveled from there.

The ArrestThe Arrest

On July 5, 2017, Thai police crashed a car into the front gate of Cazes's Bangkok home, playing it off as a botched three-point turn. When he walked out to check the noise, officers moved in. Inside, his laptop sat open and unencrypted, logged into AlphaBay's servers as admin, with a spreadsheet on it cataloguing his net worth: roughly $23 million in Thai villas, a Lamborghini Aventador, a Porsche Panamera, and accounts across Cyprus, Liechtenstein, and Antigua. The U.S. Department of Justice filed to seize it all (justice.gov/archives/opa/pr/alphabay-largest-online-dark-market-shut-down).

The TrapThe Trap

With AlphaBay dark, users fled to Hansa, the next biggest market. What none of them knew: Dutch police had covertly seized Hansa on June 20 and had been running it undercover ever since. Daily active vendors jumped from 1,000 to 8,000 as AlphaBay refugees poured in, registering accounts and typing their delivery addresses into a site operated by the police. Over 27 days, the Dutch team logged everything and passed 10,000 delivery addresses to Europol.

The RevealThe Reveal

On July 20, U.S. Attorney General Jeff Sessions announced the AlphaBay seizure, and Hansa went dark the same day. Cazes never saw either. He had been found dead in Thai custody on July 12, an apparent suicide, one week after his arrest.

The LegacyThe Legacy

Operation Bayonet became the modern takedown playbook: don't just kill the market, control the exit. Every darknet takedown since has been shadowed by the same question the Hansa users learned to ask too late: who is actually running this site?

Further ReadingFurther Reading

The definitive account is Andy Greenberg's six-part WIRED series, excerpted from his book Tracers in the Dark: The Hunt for the Dark Web's Biggest Kingpin, Part 1: The Shadow. For the Dutch side of the sting specifically, see his 2018 feature Operation Bayonet: Inside the Sting That Hijacked an Entire Dark Web Drug Market.

Part of an ongoing series on Bitcoin history. This event falls on July 5, 2017.