Home/History

Darknet market history, 2011–2026

Fifteen years of market record produce one striking pattern: almost no marketplace in this category has ever closed in an orderly way. They are seized, they are hacked, or they leave with the money.

Last reviewed 20 October 2026 · Sources at the end

Timeline

1. Feb 2011

   Silk Road opens. The first market to combine Tor, Bitcoin and escrow. It sets the template every later platform copies: listings, seller ratings, a central wallet, commission.

2. Oct 2013

   Silk Road is seized. The FBI takes the site down and arrests its operator. The closure is widely described as the best advertising the category ever received, because it triggers a wave of competitors.

3. Dec 2013

   The first big exit scam. Sheep Marketplace goes offline with roughly six million dollars in bitcoin. Within a year of the first seizure, theft by operators is already a recognised category.

4. Nov 2014

   Operation Onymous. A coordinated FBI and UK action seizes 27 hidden services, including Silk Road 2.0, showing that Tor hosting is not protection in itself.

5. Mar 2015

   Evolution walks away with the escrow. Roughly twelve million dollars disappears overnight — about half the ecosystem's listing share at the time. No seizure, no warning, no arrests.

6. Jul 2017

   AlphaBay and Hansa fall together. AlphaBay is seized in Bangkok. Dutch police then run Hansa for weeks, logging activity while users migrate from the closed market. The arrests follow the recording, not the takeover.

7. May 2019

   Wall Street Market falls, link directories charged. The market is seized in a multi-country operation. In the same month, US authorities charge the operators of a major links site over referral commissions — the first clear sign that publishing links for money is treated as part of the enterprise.

8. Jan 2021

   DarkMarket removed. Europol coordinates the takedown of what it calls the largest illegal marketplace at the time, with servers seized and an alleged operator arrested in Germany.

9. Apr 2022

   Hydra seized. German authorities, backed by the US, take the longest-running major market and its crypto assets. Its users scatter — and the English-language landscape reshuffles around whoever is left.

10. May 2023

    Monopoly seized, 288 arrested. A nine-country operation seizes the market and more than EUR 50.8 million in cash and crypto, plus 850 kg of drugs and 117 firearms. The target is not only operators but users.

11. Jun 2025

    Archetyp dismantled. Six countries, with Europol and Eurojust, remove the longest-standing market then operating — described at the time as having around 3,200 vendors and 600,000 customers.

12. 2026

    Fragmentation. UNODC's June report describes a volatile market environment. Public information about individual brands stays thin, dominated by directory sites.

Markets at a glance

Only markets with a documented ending are listed. The last column is the part users actually experienced.

How policing changed

2011–2015: take the server, arrest the operator. Early operations targeted the person at the top. It worked because markets were small enough for one individual to be the single point of failure — and it produced the first surprise, since removing the biggest market redistributed demand instead of reducing it.

2016–2019: run the market, then arrest the users. Hansa changed the method. Instead of closing it immediately, police operated it and recorded activity. The same period brought the first charges against a links directory, which moved the surrounding industry inside the criminal case rather than outside it.

2020–2026: coordination at scale. Recent operations are multinational by default and count arrests rather than seizures. Hydra, Monopoly and Archetyp each involved several countries and cross-border legal process. Postal interception and marketplace records now convert into individual prosecutions years after a platform closes.

What the record shows

• Seizure and exit scam are the normal endings. Of the ten markets in the table, nine were seized or robbed by their own operators. Voluntary closure is the rare case.
• The escrow is always the target. Police, hackers and operators are all after the same asset: the wallet holding buyer funds in the middle of a transaction.
• Takedowns concentrate risk before they reduce it. Users crowd into the next largest name, which then holds more escrow under the same weak governance. AlphaBay's users migrating into a police-run Hansa is the clearest documented example.
• Longevity is not safety. Hydra ran seven years before it was seized; Archetyp was the longest-standing market when it was dismantled. Survival measures luck, not security.

Sources