US, Europol, and the Netherlands Announce Shutdowns of Two Massive Dark Web Markets

A man suspected of running AlphaBay was found dead in a Thai prison last week; Dutch police say they have infiltrated another market called Hansa.

|
Jul 20 2017, 3:03pm

On Thursday the US Department of Justice and Europol jointly announced the shutdown of two major dark web marketplaces, including AlphaBay, which was until recently the largest such site.

The episode is one of the most significant law enforcement actions against the dark web to date, and the highest profile since the arrest of Ross Ulbricht, the creator of the original Silk Road. Dutch authorities announced they had also taken down Hansa, another popular dark web marketplace that grew in popularity after AlphaBay went down earlier this month. However dramatic, the actions are unlikely to significantly dent the overall online trade in narcotics, stolen data, or weapons.

"The dark web is not a place to hide," US Attorney General Jeff Sessions said during a press conference on Thursday. Officials in the press conference did not give explicit details on how they identified the administrators or the location of the sites' servers.

The operation was international in scope. Sessions thanked authorities from Thailand, Germany, France, and the UK. The European Union's law enforcement agency, Europol, posted its own announcement about the takedowns.

During the press conference, the head of Europol Rob Wainwright described the action as a "groundbreaking operation."

Notice published on Hansa by Dutch law enforcement.

Robert Patterson, deputy administrator of the Drug Enforcement Administration, also confirmed that Alexandre Cazes—who was arrested in Thailand July 5 and was found dead while jailed there—was the suspected administrator of AlphaBay.

The Dutch police force Politie led the investigation into Hansa, and gained control of the market after the arrest of two staff members in Germany.

"The fall of Hansa Market is the culmination of an infiltration operation, the Dutch police in June had management control of the marketplace," a Google translation of the Politie press release reads. It adds that the authorities intercepted tens of thousands of unencrypted messages, which allowed investigators to identify delivery addresses. "Some 10,000 foreign addresses of buyers [of] Hansa Market are transferred to Europol," the release reads.

In an ironic twist, when AlphaBay closed, many users migrated to Hansa, which was already under the control of the authorities.

ALPHABAY, THE CENTRE OF THE DARK WEB
AlphaBay launched in December 2014, around a year after law enforcement seized the original Silk Road marketplace. After the administrators of Evolution, another marketplace, seemingly disappeared with millions of dollars worth of their users' bitcoins, AlphaBay quickly became the dominant dark web trading site. Nicolas Christin, a researcher from Carnegie Mellon University who has followed the dark web marketplaces closely, told Motherboard in an email on Thursday he estimated the AlphaBay was generating revenue of between $600,000 and $800,000 a day in 2017.

The site had very few rules, doing away with the libertarian-driven ideals of the drug focused Silk Road, and offered stolen credit card data, hacked databases, and weapons. AlphaBay even introduced an "autoshop" for buyers to quickly find credit cards from specific states, and had both English and Russian language forum sections, with the latter focused on hacking tools. One rule that did stick out, however, was that AlphaBay banned the sale of personal data stolen from Russians.

Several people have tried to uncover the identities of AlphaBay staff in an attempt to generate blackmail material. Some of these attempts have seemingly resulted in payments, although none of the names blackmailers have provided to Motherboard over the last few months match those in Thursday's indictment.

FROM CANADA TO THAILAND
On the morning of July 5, Canadian authorities searched properties in Montreal and Trois-Rivières, including Cazes' family residence and a warehouse. That same day, police in Thailand arrested Cazes, 26, a programmer who owned three houses and at least one Lamborghini sports car.

On July 12, Cazes died in a Bangkok prison, according to the Bangkok Post , which first reported the news. At around 7AM, prison officers discovered Cazes dead in his cell, a towel hanging from the toilet door. Cazes is believed to have hanged himself, the report continues. That same morning, he was due to meet with a lawyer about starting the extradition process to the US.

Cazes is listed as president of a software company called EBX Technologies, according to the company's website. According to Cazes' LinkedIn profile, he worked as a freelance software designer.

"EBX Technologies is a business specialized in computer services such as web programming and software integration," an archived version of the company's website reads. Over the last week, EBX has not responded to requests for comment, and the company's website has remained inaccessible since going offline around July 3.

In a brief interview with Canadian media, Cazes' father described his son as someone who wouldn't hurt a fly.

"Very, very bright. He skipped a year at school, a little genius," Cazes' father said, according to a translation of the interview.

According to the Justice Department press release, Cazes used the moniker alpha02. At the start of the site's launch, alpha02 would communicate with journalists and site members, although after the site gained popularity alpha02 had faded from public view. The FBI and DEA have seized Cazes' alleged stockpiles of millions of dollars worth of bitcoin, and the FBI has allegedly identified an AlphaBay staffer living in the US, the release adds.

THE DARK WEB, NOW
After AlphaBay vanished earlier this month, users started migrating to other marketplaces; something of a tradition in the lifecycle of illegal trading sites. Both AlphaBay vendors and buyers signed up to Hansa, where stolen database sellers recently opened shop, and Dream Market, a site that launched way back in 2013.

Hansa was allegedly so inundated with the influx of former AlphaBay users, that administrators temporarily closed new registrations, according to a message posted on the market earlier this month. Now, it is clear that Dutch law enforcement likely closed those registrations themselves.

"Critics will say, as we shut one site, another site emerges. And they may be right, but that is the nature of criminal work: It never goes away, you have to constantly keep at it, and you've got to use every tool in your toolbox," Deputy Attorney General Rod Rosenstein said during the press conference.

Independent researcher Gwern Branwen examined dozens of markets and catalogued how long they stayed online, and what eventually led to their closure. The majority of market shut downs have not been due to law enforcement action, but scams, hacks, or other reasons instead.

"These presses were pretty strong," a Hansa user wrote in a review for the substance MDMA on Thursday.

Got a tip? You can contact this reporter securely on Signal at +44 20 8133 5190, OTR chat at jfcox@jabber.ccc.de , or email joseph.cox@vice.com

Editors Note: The National Suicide Prevention Hotline is toll-free in the US and available 24/7 at 1-800-273-8255, while suicide.org has a list of international suicide hotlines , including Canada and the UK .)