Operation Bayonet
Operation Bayonet was a 2017 international law-enforcement operation that seized AlphaBay and took covert control of Hansa marketplace for a month.
Operation Bayonet was a coordinated international law-enforcement operation that led to the seizure of AlphaBay and the covert operation of Hansa marketplace in mid-2017. It was publicly announced on 20 July 2017 by the United States Department of Justice, Europol and the Dutch National Police, and is widely considered the most consequential single operation against darknet marketplaces to date. [1]
Background
By early 2017 AlphaBay had become the largest Western darknet marketplace, and the mid-sized Hansa market was growing as a secondary platform. The Dutch Team High Tech Crime (THTC) had already identified the Hansa infrastructure through a lead unrelated to AlphaBay. The decision was taken to coordinate the two investigations so that AlphaBay could be seized first, driving its users to Hansa, where they could be observed in real time.
Covert operation of Hansa
On 20 June 2017 Dutch police arrested the two German administrators of Hansa in Siegen, Germany and seized the server infrastructure. From that date THTC officers operated the market directly for about four weeks. During this period they modified the site to record un-encrypted passwords, log previously PGP-encrypted messages in plaintext and embed a tracking image in a pre-filled vendor order sheet downloaded from the site.
AlphaBay seizure
On 5 July 2017 AlphaBay went offline. Users assumed an exit scam and migrated in large numbers to Hansa, which was still operating under police control. The Dutch task force reported that Hansa saw an eight-fold increase in new registrations in the week after AlphaBay disappeared. On 20 July the authorities closed Hansa with a seizure banner, named Operation Bayonet in public communications and confirmed that AlphaBay operator Alexandre Cazes had been arrested in Bangkok on 5 July.
Results
Public reporting attributed to Operation Bayonet:
- the arrest of Alexandre Cazes and the seizure of assets valued at roughly US$23 million;
- the collection of several thousand delivery addresses used to post orders through the Dutch postal system during the covert phase;
- the subsequent arrest of multiple vendors across Europe and North America;
- a long-term reputational blow to large multi-category marketplaces.
Legacy
Follow-up operations Operation DisrupTor (September 2020) and Operation Dark HunTor (October 2021) resulted in dozens of further arrests and were coordinated under the same U.S.–Europe model. Researchers have cited Operation Bayonet as the turning point after which the number of users willing to trust a single dominant market declined and the ecosystem fragmented into smaller, more cautious communities.
References
- U.S. Department of Justice; Europol; Politie (20 July 2017). Joint press briefing on Operation Bayonet.
- Dutch Public Prosecution Service (20 July 2017). Hidden marketplace Hansa taken down after undercover operation.
- Décary-Hétu, David; Giommoni, Luca (2021). “Darknet market resilience after Operation Bayonet.” Trends in Organized Crime.