How dark web marketplaces end: Europol, DarkOwl and the 2019 closures

How a market is built, and how big one got

Wikipedia’s article on darknet markets describes them as commercial websites on the dark web that operate through darknets such as Tor and I2P. It says contemporary markets follow the model developed by Silk Road: access through an anonymised darknet, typically Tor; payment in Bitcoin or Monero with escrow services; and vendor feedback systems like eBay’s. Silk Road, it says, was the first marketplace to use both Tor and Bitcoin escrow, founded in February 2011. In the escrow step the buyer transfers cryptocurrency to the site, the vendor dispatches the goods and then claims the payment, and the buyer can leave feedback on the vendor’s account. Wikipedia adds that a buyer may “finalize early”, releasing the funds before the goods arrive, and that this leaves the buyer open to fraud.

The same article says that a centralised escrow lets a market close down and “exit” with the buyers’ and vendors’ cryptocurrency at any time, and names BlackBank, Evolution and Wall Street Market as cases. It also says that many vendors list their goods on multiple markets, so that they retain their reputation if one closes, and that PGP use among vendors rose after Operation Onymous in 2014, to near 90 percent on two marketplaces.

For the scale of one market, the case with the most figures in our sources is AlphaBay. Europol’s release of 20 July 2017 says AlphaBay used a hidden service on the Tor network to mask user identities and server locations, and that before its takedown it reached over 200,000 users and 40,000 vendors. It counts over 250,000 listings for illegal drugs and toxic chemicals, and over 100,000 for stolen and fraudulent identification documents and access devices, counterfeit goods, malware, firearms and fraudulent services. Europol gives a conservative estimate of USD 1 billion transacted since the market was created in 2014, paid in Bitcoin and other cryptocurrencies. Wikipedia says AlphaBay was recognised as the largest market by October 2015. For the dark web economy as a whole, Wikipedia says the size is problematic to estimate, so we give no total.

When the authorities end it: what Europol says about four cases

AlphaBay and Hansa, 20 July 2017. Europol’s release says two major operations, led by the FBI, the DEA and the Dutch National Police with Europol’s support, shut down the infrastructure of AlphaBay and Hansa, which together traded over 350,000 illicit commodities. It calls Hansa the third largest criminal marketplace on the Dark Web. For AlphaBay, an FBI and DEA operation called Bayonet identified the creator and administrator, who was arrested in Thailand on 5 July 2017, when the site was taken down; servers were seized in Canada and the Netherlands. For Hansa, Europol says it gave the Dutch authorities an investigation lead in 2016, with the help of the security company Bitdefender; the infrastructure was located in the Netherlands, two administrators were arrested in Germany and servers were seized in the Netherlands, Germany and Lithuania.

The part Europol stresses is the order of events. Under Dutch judicial authorisation, Dutch police took over Hansa on 20 June 2017, which Europol says let them watch the activity of users without their knowledge for a month, and AlphaBay was shut down during that period. Europol records an eight-fold increase in new Hansa members immediately after AlphaBay went down. Intelligence packages went to law enforcement partners in 37 countries.

DarkMarket, 12 January 2021. Europol calls DarkMarket the world’s largest illegal marketplace on the dark web and says it was taken offline in an operation involving Germany, Australia, Denmark, Moldova, Ukraine, the United Kingdom and the United States. Its figures are almost 500,000 users, more than 2,400 sellers, over 320,000 transactions, and more than 4,650 bitcoin and 12,800 monero transferred, which Europol says corresponds, at the current rate, to more than EUR 140 million. Germany took the lead: an Australian citizen described as the alleged operator was arrested near the German-Danish border, and more than 20 servers in Moldova and Ukraine were seized. Europol says the stored data will give investigators new leads on moderators, sellers and buyers, and that its European Cybercrime Centre has set up a Dark Web Team.

Archetyp Market, 16 June 2025. Europol calls it the most enduring dark web marketplace. Actions on 11 to 13 June took place in Germany, the Netherlands, Romania, Spain and Sweden, with around 300 officers deployed. Europol says the market operated for over five years, with more than 600,000 users, a transaction volume of at least EUR 250 million and over 17,000 listings. The infrastructure in the Netherlands was taken offline, the administrator, a 30-year-old German national, was arrested in Barcelona, measures were taken in Germany and Sweden against one moderator and six of the highest vendors, and assets worth EUR 7.8 million were seized. A seizure banner was published on the market. The operation was led by German authorities, with Eurojust coordinating requests for legal assistance. Wikipedia puts the same takedown at an estimated 3200 registered vendors and 600,000 customers, a different measure from the user and listing counts Europol gives.

When the operators end it, or the market simply stops

Wikipedia’s history gives the earlier cases. In March 2015 the Evolution marketplace performed an exit scam, stealing escrowed bitcoins worth $12 million, which it says was half of the listing market share at the time. Users moved to Black Bank and Agora, and Black Bank then announced on 18 May 2015 that it was closing for “maintenance” before disappearing in a similar scam. Atlantis closed in September 2013 and left users one week to withdraw their coins.

DarkOwl’s 2019 account covers Wall Street Market in more detail. It says the market surged in popularity after Dream Market announced its closing, and that in late April, at an estimated peak of 5,400 vendors and 1.15 million customers, with well over $10 million in cryptocurrency, the administrators carried out an exit scam, with a total market value DarkOwl puts between $11 and $15 million. DarkOwl says the administrators claimed the market was in “maintenance mode” while law enforcement was secretly monitoring their accounts. A moderator then posted the server’s IP address and the backend logins on a dark web forum, a detail that Infosecurity Magazine also reports. Infosecurity adds that it is unclear whether the law enforcement action was linked to the exit scam attempt, while DarkOwl describes the seizure and the arrests of the administrators as the end of a two-year investigation by US and Dutch agencies, Europol and Eurojust.

DarkOwl says missteps in operational security led the authorities to the administrators: a home IP address obtained through a cooperating VPN provider, and a mobile USB modem registered under a suspected fictitious name. It also says the same administrators ran German Plaza Market, which shut because of an exit scam around May 2016, and that investigators linked the two markets through cryptocurrency wallet addresses.

Not every closure fits one of those two shapes. DarkOwl describes the Cannabis Growers & Merchants Co-op disappearing around 10 May 2019. Users first thought it was an exit scam, but DarkOwl says it was later determined that the administrators had cancelled all pending orders, returned the funds to customers and released the escrow to vendors. Libertas, a market that took Monero only, moved from Tor to the I2P network in late May 2019 and announced on 19 June that it was shutting down because I2P was little used. For Tochka, DarkOwl reports that many users called it a complete scam, with orders, wallets and accounts deleted in recent weeks, while comments on a forum suggested a server crash in early June. For Empire, it reports complaints about wallets emptied, a head moderator who said the complaints came from phishing links, and 135 known addresses of which DarkOwl believes over 30 percent could be phishing. DarkOwl wrote this in 2019 and updated it on 2 July 2019; we do not know what became of these markets afterwards.

Dream Market in 2019: what the sources establish and what they do not

DarkOwl says Dream Market announced in late March 2019 that it would cease operations on 30 April 2019, with an eventual re-brand as a new hidden service. It says that for over a year Dream had suffered DDoS attacks, with over 600 mirror links circulating. In early April, DarkOwl says, Europol confirmed a multinational operation with 61 arrests, 65 search warrants, almost 300 kg of drugs, 51 firearms and over EUR 6.2 million in cryptocurrency, cash and gold. DarkOwl is explicit that the Europol report does not mention Dream Market. It calls it a reasonable assumption that some of the arrests were vendors active on Dream; that is DarkOwl’s own inference, not a statement from Europol.

On how Dream ended, DarkOwl reports rumours of a police action or an inside exit scam, difficulty withdrawing money from Dream wallets in April, and moderators who asked vendors for their passwords. It says it is unknown whether law enforcement infiltrated Dream’s servers directly, and adds that it would not be surprising if they had. Infosecurity Magazine, writing on 3 May 2019, called Dream the world’s biggest market and said it appeared to still be up and running, even though users had left after it said it would move to a “partner site”. Wikipedia says only that Dream Market was shut down in 2019 (the same article says Wall Street Market was seized by law enforcement in May 2019, where DarkOwl stresses the exit scam), and Europol’s 2025 release on Archetyp calls Dream “now-defunct”. The pages we read do not say that Dream Market was seized, and they do not say what became of its funds.

One more 2019 case sits next to it. DarkOwl says two administrators of DeepDotWeb were arrested on 6 May 2019 on charges of kickbacks for referring users to markets; it adds that the site did not host illicit content itself but catalogued the addresses of markets, with ratings and reviews.

After a closure: follow-up arrests and single-vendor shops

Europol’s release on Operation RapTor, of 22 May 2025, reports 270 arrests of dark web vendors and buyers across ten countries, among them 130 in the United States, 42 in Germany, 37 in the United Kingdom and 29 in France. The suspects were identified from intelligence taken from the seizures of the marketplaces Nemesis, Tor2Door, Bohemia and Kingdom Markets, and Europol says the suspects included vendors who had conducted thousands of sales. The operation follows Operation SpecTor in 2023, which Europol says led to 288 arrests. Officers seized over EUR 184 million in cash and cryptocurrencies, over 2 tonnes of drugs and over 180 firearms. Europol’s own summary of the method is that taking down a platform is the beginning of follow-up investigations, not the end of the story.

The same release describes a change of tactics. With traditional marketplaces under pressure, Europol says criminal actors are shifting to smaller, single-vendor shops run by individual sellers, to avoid marketplace fees and minimise exposure. It says illegal drugs remain the top commodity sold, and that 2023 saw a surge in prescription drug trafficking and a rise in fraudulent services, including fake hitmen.

DarkOwl describes the 2019 version of the same movement from the vendors’ side. After the closures, it says, vendors reposted their PGP signatures and offered to serve customers without a market, by encrypted communication directly. Infosecurity Magazine reports a claim that illegal traders were monitored as they moved to other dark web sites after the Finnish seizure of Silkkitie, and adds that it is unclear whether they were arrested, and Europol’s 2017 release says new members displaced from AlphaBay flocked to Hansa while the Dutch police were watching it. DarkOwl concluded in 2019 that the criminal darknet market community would not be deterred by international law enforcement operations; that is its view in 2019.

What the pages we read leave out

The pages we read do not give the number of marketplaces active today, and they do not say which is the largest today. They do not count the closures that were exit scams against those that were police action. For Dream Market they do not say it was seized, and they do not say what became of its funds. Wikipedia says the size of the whole economy is hard to estimate, and we quote no figure for it. Our sources are press releases from the authorities that carried out the operations, a security company’s account, a trade news report and an encyclopaedia article, so each police figure here is the authority’s own, and the exit scam details are DarkOwl’s.

This page names no market that is active and gives no address, on purpose. Google’s results for the key included list pages from security and VPN companies; we did not read them, and the Google AI box was not verified. We visited no market and tested nothing. For what the dark web is and how it differs from the deep web, see deep web or dark web; for the software people use to reach it, how to access the dark web safely; and for the monitoring services that scan it, dark web scans.